Low risk is only one condition
Section 31 permits simplified CDD when three conditions apply. Customer risk must be low, section 32 must not apply, and the reporting entity must comply with the relevant Rules. All three conditions matter. A low score produced by a tool is not enough on its own.
Simplified CDD remains customer due diligence. It is not a statement that identity, relevant associated persons or the purpose of the service can be ignored. The business must identify which permitted measures apply to the matter being established and follow the conditions. The word simplified does not create a general exemption.
Sources: Federal Register of Legislation: Section 31(a) to (c); Federal Register of Legislation: Sections 6-16 and 6-17.
- Low customer risk
The customer must have low ML/TF risk.
- No section 32 trigger
Enhanced CDD must not apply.
- Relevant Rules met
The reporting entity must comply with the applicable Rules, including the conditions for the measures used.
All three conditions matter
Section 31 conditions are cumulative. A low software score alone does not establish eligibility for simplified CDD.
Decision checkpoints. Read the conditions for each point in the text below.
Use measures supported by your policies
Rules section 6-16 requires the AML/CTF policies to deal with simplified measures. Rules section 6-17 provides a qualified way to establish certain associated-person and beneficial-owner matters. It includes appropriate KYC collection and no reasonable grounds to doubt the adequacy or truth of that information, alongside its other conditions.
This is different from deciding that familiar customers need no evidence. Familiarity may inform the available knowledge but does not replace the legal assessment. If a mandatory enhanced CDD trigger applies, section 31 is not available merely because the rest of the case appears ordinary.
For an individual customer, section 6-17 requires reasonable steps to establish that the customer is who they claim to be. Customer risk must be identified before the service starts, using reasonably available KYC information. KYC means know your customer.
Sources: Federal Register of Legislation: Section 31(a) to (c); Federal Register of Legislation: Sections 6-16 and 6-17.
Invented example: an unresolved contradiction
A fictional customer is initially assessed as low risk. Two items of ownership information then disagree. The business should examine the contradiction before relying on a simplified measure whose conditions include the absence of reasonable doubts about relevant information.
The discrepancy might be an old record or a simple error. It might also expose a material problem. The example does not determine which outcome is correct. It shows why the low-risk label should not prevent staff from reviewing evidence. Record the resolution, or the remaining uncertainty, rather than treating the original rating as permanent permission.
Sources: Federal Register of Legislation: Section 31(a) to (c); Federal Register of Legislation: Sections 6-16 and 6-17.
Explain what was reduced and why
A practical file note can identify the measure used, the facts supporting eligibility and the information still collected. This helps a reviewer distinguish a permitted reduced step from an omitted step. Avoid language such as exempt customer unless a particular exemption actually applies.
As a method check, take the same fictional case and add a clear section 32 trigger. The process should remove access to simplified CDD and route the case to the appropriate response. The exercise tests whether the controls respect the legal conditions. It does not prescribe a specific software design, risk score or universal document standard for every business.
Sources: Federal Register of Legislation: Section 31(a) to (c); Federal Register of Legislation: Sections 6-16 and 6-17.