From Customer Risk to Useful Signals
Risk-based AML/CFT programs in banking become real at the customer relationship. The question is how a bank turns its broad risk assessment into a proportionate decision about what it needs to know, how closely it should watch activity, and when an unusual signal becomes a reportable suspicion. Following that lifecycle helps the reader see why customer due diligence is not a one-time form and why monitoring is not simply an alert-generating machine.
The governing idea is straightforward: the bank needs enough understanding of a relationship to assess its ML/TF risk, then needs controls that match that assessment. The exact legal requirements depend on the applicable framework. FATF’s banking-sector guidance supplies the general logic, while the Federal Reserve’s July 2026 notice of proposed rulemaking would expressly place risk-based ongoing customer due diligence within the internal controls of banks supervised by the Board. The notice is a proposal, but the lifecycle it describes is already a useful way to understand the operating problem.
The relationship begins with a risk profile
Customer due diligence, usually shortened to CDD, is the process through which a bank learns who it is dealing with and what the relationship is for. The point is not to accumulate personal data without a decision in mind. Initial CDD should identify the customer and, where applicable, the beneficial owner—the person who ultimately owns or controls the customer. It should verify identity using reliable and independent information to the extent required by the applicable law or regulation. It should also establish the purpose and intended nature of the business relationship, with further information in higher-risk situations.
Those questions establish the bank’s starting knowledge. A customer who opens an account for an ordinary, clearly explained purpose may present a different information problem from a relationship whose ownership or intended use remains difficult to understand. The difference does not arise from a single fact in isolation. It arises from how the facts affect the bank’s ability to understand the customer, the source and movement of funds, and the reason the customer needs the service.
Consider a bank that already knows a customer’s identity but cannot readily determine who controls a company behind the account. Identity verification has not solved the whole risk problem. The bank may need more robust sources, additional information about the purpose of the relationship, an intelligence report, adverse-media searches that can be verified, or information about the source of funds or wealth. These are examples of enhanced due diligence, or EDD. They are not a universal package that must be applied to every customer; they are ways of reducing uncertainty when the relationship presents higher risk.
The opposite response is simplified due diligence, or SDD, for a lower-risk situation where the legal framework permits it. A bank might obtain less information or use a less robust form of verification. But “simplified” does not mean “uninformed,” and a category is not low risk merely because it is convenient to serve. FATF says CDD measures generally apply in all cases. The amount and type of information, and the extent to which it is verified, can be adjusted in line with the ML/TF risk associated with the relationship.
This is where a customer risk profile matters. Based on a holistic view of the CDD information, the bank can form a view of the relationship’s risk and decide the level and type of ongoing monitoring. The profile can apply to an individual customer or, where customers share genuinely relevant characteristics, to a group or segment.