The next customer wants to buy a $5 million commercial building through several companies, using funds arriving from overseas.
Which customer presents a higher level of risk?
That's exactly what Enhanced Customer Due Diligence (Enhanced CDD) is designed to help you assess. Enhanced CDD is about making sure the level of due diligence matches the level of risk.
Enhanced Customer Due Diligence, or Enhanced CDD, is the process of carrying out additional enquiries and checks when a customer presents a high risk of money laundering, terrorism financing or proliferation financing, or where another specific Enhanced CDD trigger applies.
At its core, the goal is simple:
do I know who my customer is, and am I comfortable providing this designated service?
Think about buying a used car. If the ownership history doesn't quite add up or the seller can't clearly explain where it came from, you'd naturally ask a few more questions before handing over your money.
Enhanced CDD works in much the same way.
Why Doesn't Standard Customer Due Diligence (CDD) Always Go Far Enough?
Criminals may use companies, trusts, third parties or complex transaction structures to make ownership more difficult to understand or the movement of funds harder to trace. That doesn't mean every complex customer is suspicious.
Many legitimate businesses operate through multiple entities for perfectly valid commercial, legal or tax reasons.
The important distinction is this: complex doesn't mean criminal. But complexity without a clear explanation should earn a second look.
When Do You Need Enhanced Customer Due Diligence?
One of the biggest misconceptions is that Enhanced CDD only applies to overseas customers or Politically Exposed Persons (PEPs).
Reporting entities must apply Enhanced CDD where a customer presents a high level of money laundering, terrorism financing or proliferation financing risk. There are also specific circumstances where Enhanced CDD is required regardless of the customer's ordinary risk rating. Risk isn't fixed.
A customer who appeared low or medium risk at onboarding may later become high risk if their circumstances change, additional parties become involved or new information comes to light.
This is why CDD is an ongoing, risk-based process rather than a one-off onboarding exercise.
What Does a High-Risk Customer Actually Look Like?
There isn't a definitive list of customers who must always be classified as high risk.
Businesses need to consider the customer in the context of what they know about them, the nature and purpose of the relationship and the designated services being provided.
A practical question is: "Does this transaction make sense based on what I know about this customer?"
Factors that may warrant further enquiries include:
unusually complex ownership structures
uncertainty about who ultimately owns or controls the customer
transactions that don't align with the customer's known circumstances
connections to higher-risk jurisdictions
unusually large cash transactions
inconsistent or difficult-to-verify information
unclear or unexplained source of funds or wealth
None of these automatically indicate criminal activity, however if you can't understand the structure, who's ultimately behind it or how the transaction is being funded, further enquiries may be appropriate.
When Is Enhanced CDD Mandatory in Australia?
Some situations require Enhanced CDD regardless of whether your ordinary customer risk assessment would otherwise classify the customer as high risk.
Under Australia's AML/CTF framework, these include circumstances where:
the customer, a beneficial owner or certain other relevant persons are a foreign PEP
a relevant person is physically present in, or formed in, a high-risk jurisdiction for which the Financial Action Task Force (FATF) has called for Enhanced CDD
the customer requests a designated service involving unusually complex or large transactions, an unusual pattern of transactions, or transactions with no apparent economic or legal purpose
the designated service is, or will be, part of a nested services relationship
you're required to submit a Suspicious Matter Report (SMR) in relation to the customer and intend to continue providing a designated service to them.
These requirements should be reflected in your AML/CTF policies and procedures.
What Does Enhanced Customer Due Diligence Involve?
Depending on the circumstances, this may include collecting or verifying additional KYC information,
taking further steps to understand ownership or control, asking more detailed questions about the transaction, establishing or verifying source of funds or source of wealth where relevant, or conducting more detailed ongoing monitoring.
The goal is to attain information that helps you understand and manage the risk.
Source of Funds vs Source of Wealth in Enhanced CDD
These two concepts are often confused.
Source of Funds answers:
"Where did the money for this transaction come from?"
It might come from the sale of another property, savings, an inheritance, a business sale or a bank loan.
Source of Wealth asks:
"How did this customer accumulate their overall wealth?"
Perhaps they built a successful business, accumulated wealth through employment and investment, or inherited family assets.
One explains the funds being used. The other explains the customer's broader financial position.
Source of funds and source of wealth checks can be appropriate where they're relevant to the customer's ML/TF risk. They aren't automatically relevant to every customer or every type of risk.
However, specific requirements apply in some circumstances. For example, during initial CDD, reporting entities must establish on reasonable grounds the source of funds and source of wealth of a foreign PEP, and of a domestic or international organisation PEP assessed as high ML/TF risk.
Enhanced Customer Due Diligence: The Bottom Line
Most customers won't require Enhanced Customer Due Diligence, and that's exactly how a risk-based approach is meant to work.
The goal is about recognising when the risk is higher and knowing when you need to ask a few more questions.
Sometimes those additional enquiries will provide a straightforward explanation. Other times, they may raise further concerns. What matters is that you have enough information to understand the risk and respond appropriately.
It's about applying the right level of due diligence to the right level of risk.
That's good risk management and good business.
Contact AMLHUB today to book a demo or discuss how we can help your organisation transition seamlessly into the new regime.