KYC/CDD Workflows: From Onboarding to Ongoing Monitoring

The KYC/CDD Framework

KYC/CDD is mandated by FATF Recommendation 10 and forms the foundation of AML compliance. It requires financial institutions to:

1. Identify — verify the identity of customers and beneficial owners
2. Understand — the nature and purpose of the business relationship
3. Monitor — ongoing transactions and update customer information

The three tiers of due diligence:

• Simplified Due Diligence (SDD) — low-risk customers, basic verification
• Customer Due Diligence (CDD) — standard risk, full identity verification + source of funds
• Enhanced Due Diligence (EDD) — high-risk customers (PEPs, high-risk jurisdictions), deeper investigation

Onboarding Workflow

Customer Applies → Identity Verification → Risk Assessment → 
 ├─ Low Risk → SDD → Approve → Ongoing Monitoring
 ├─ Medium Risk → CDD → Approve → Enhanced Monitoring
 └─ High Risk → EDD → Compliance Review → Approve/Reject → Intensive Monitoring

Key data points collected during onboarding:

• Full legal name, date of birth, nationality
• Residential address (proof of address)
• Identification documents (passport, national ID)
• Source of funds / source of wealth
• Purpose of account / business relationship
• Beneficial ownership (for legal entities: 25%+ ownership threshold)

Ongoing Monitoring and Periodic Review

CDD is not a one-time event. Institutions must:

• Transaction monitoring — flag unusual patterns (velocity, amounts, counterparties)
• Periodic review — refresh customer information based on risk rating
• Watchlist screening — check against sanctions lists, PEP databases, adverse media
• Trigger events — re-verify when material changes occur

Risk-based approach: FATF recommends calibrating review frequency to customer risk level — high-risk customers reviewed at least annually, low-risk every 3-5 years.