KYC, CDD and EDD: What Banks Ask

As of September 2026: US rules described here are current as of September 2026. FinCEN's 2016 customer due diligence rule remains in force. On February 13, 2026, FinCEN issued exceptive relief so banks no longer have to collect beneficial ownership information at every new account opening: first account, when facts call earlier information into question, or as risk-based procedures require. FinCEN has said it intends to revisit the rule, without a stated timeline. Separately, the Corporate Transparency Act reporting requirement (a government registry of company owners) was narrowed in August 2026 to foreign-formed companies only, so US banks cannot lean on that registry. In the EU, the AML Regulation applies from July 10, 2027.

What are KYC, CDD and EDD?

“Know your customer” is the everyday name for the checks a financial institution runs before and after it takes someone on. Regulators split it into layers.

Customer due diligence (CDD) is the baseline. The bank identifies the customer, verifies that identity, learns what the account is for, and builds a risk profile. For a person, that means a name, date of birth, address and an identifying number, checked against documents or databases. In the US, the CDD rule also requires ongoing work: monitoring to spot suspicious activity and, on a risk basis, keeping customer information up to date.

Enhanced due diligence (EDD) is the extra layer for customers the bank rates as higher risk. FinCEN’s own guidance describes the tools plainly: enhanced monitoring, or collecting more information, such as the expected activity on the account. Which customers land here is each bank’s judgment, guided by regulators.

Why do banks look through companies?

A company can open an account without ever showing the human being who profits from it. That is the point of shell companies. So the rules ask banks to look through the entity to the beneficial owner.

Under 31 CFR 1010.230, a US bank must identify two things for each company customer: every individual who owns 25 percent or more of the equity, directly or indirectly, and one individual with significant responsibility to control or run the entity, such as a chief executive. The bank then verifies the identity of those people using risk-based procedures. Some entities, such as listed companies and regulated financial institutions, are excluded.

The EU’s AML Regulation uses the same 25 percent ownership idea, and it begins to apply on 10 July 2027.

What does account opening look like in practice?

For a company, the bank collects the names, dates of birth, addresses and identifying numbers of the beneficial owners. FinCEN’s optional certification form is one way to capture this, and a bank can use its own equivalent. The bank keeps these records for at least five years after the account is closed. The bank may also choose stricter rules than the minimum. FinCEN’s guidance says a bank can collect ownership information below the 25 percent line if its own risk assessment supports it, or use other tools such as enhanced monitoring instead.

In February 2026, FinCEN relaxed one part of this. Banks no longer have to repeat the beneficial ownership collection at every new account opening for an existing customer. They must do it at the first account, when facts call the earlier information into question, or as their own risk-based procedures require. The rule itself is unchanged.

Who is a politically exposed person?

A politically exposed person (PEP) is someone who is or has been entrusted with a prominent public function. FATF’s guidance covers foreign PEPs, domestic PEPs and people prominent in international organisations, along with their family members and close associates. The reason is simple: such roles can be abused for bribery and corruption, and the money has to be hidden somewhere.

FATF is careful to say these measures are preventive, not criminal. Most PEPs are honest. It also warns that commercial PEP databases help but are not enough on their own, because good CDD is what tells a bank who its customer really is. Red flags in its guidance include corporate vehicles that obscure a PEP’s ownership, and information from the customer that does not match public records such as asset declarations and official salaries.

Where do the checks fall short?

Honest limits are part of how the system works.

Verification is of the named people, not the structure. FinCEN’s guidance says a bank need not independently investigate the ownership structure. It may reasonably rely on what the customer’s representative provides, unless the bank knows of facts that call it into question. If the person named is a nominee standing in for someone else, a clean check can still sit on top of a hidden owner.

The check is a snapshot. Banks must update information when monitoring shows a change, but they are not required to re-verify on a fixed schedule. FinCEN says periodic reviews are not by themselves a trigger to update beneficial ownership.

Rules and costs push in two directions. Thorough checks are expensive, and some customers are judged not worth the cost. When banks pull back from whole groups of customers, the result is called de-risking.

Gatekeepers sit outside the bank. Lawyers, accountants and company-formation agents who set up the structures are covered unevenly around the world. See why detection still fails.

How KYC helps catch launderers

KYC rarely stops a determined criminal at the door. Its value comes later. Every account opened creates a record: who signed, which documents were shown, what the customer said the account was for, who they said owned the company. Those records are kept for years after an account closes.

When monitoring flags activity that does not match the profile, that profile is the yardstick. A “consulting company” with three employees that moves millions is suspicious because the bank wrote down what it expected. When a case reaches investigators, false statements at onboarding are evidence, and a suspicious activity report is stronger when the bank can show who it believed it was dealing with. Money mule accounts, for example, can stand out when the stated purpose of the account and the actual flows do not match.

The global standard behind all of this comes from FATF.

First published September 21, 2026 · Last updated September 21, 2026 · Legal statuses current as of September 2026