Customer due diligence measures (CDD) are a set of actions that you, as an obliged entity, must carry out for every client, both new and existing. The scope depends on the risk assessment for the relationship with that client. Below are practical details on when to apply CDD, how to identify and verify clients, and what to consider when documenting the process.
What are customer due diligence measures?
CDD measures are mandatory actions that you take under your AML procedure in relation to prospective and existing clients. Their purpose is to reduce the risk of money laundering and terrorist financing.
The scope is not fixed. You tailor it to the level of risk associated with working with a particular client. A higher risk assessment means a broader set of measures.
When must you apply customer due diligence measures?
AML rules specify the situations in which you must apply CDD. The most common include:
- Establishing a new business relationship, for example, signing an agreement with a new client.
- A change in a business relationship, for example, a change to the terms of cooperation with an existing client.
- Carrying out an occasional transaction, for example, a one-off sale transaction of a specified nature or value.
The complete list is available in the materials on the SiP AML platform.
How should you tailor CDD to the client?
Not every client requires the same level of detail. The decision rule is:
- If the risk assessment is low → apply simplified customer due diligence measures.
- If the risk assessment is high → apply enhanced customer due diligence measures.
To make this decision, first carry out a risk assessment for that client. Select the appropriate scope of CDD only after completing it.
Identifying an individual client
For an individual, check an identity card or passport. Establish and record the following information:
- First and last name
- PESEL number
- Country of birth
- Citizenship
- NIP tax identification number, if the person conducts business activity
Identifying a legal-entity client
For a legal entity, such as a company, establish:
- The entity’s name
- Its legal form
- Its registered-office address
- Its NIP number. If it has no NIP, record the country of registration, registration number and registration date.
Documents used to verify a legal entity
Verify the entity using:
- KRS, the National Court Register
- CRBR, the Central Register of Beneficial Owners
- Other relevant registration documents
Beneficial owner and representative
When identifying a legal entity, you must also:
- Establish and verify its beneficial owner, meaning the person who actually controls the entity.
- Establish and verify the legal entity’s representative.
Enter the information in both cases in the form attached to the internal AML procedure.
Identity verification: rules and timing
Once you have established the details of the client, representative or beneficial owner, verify the identity against appropriate documents.
Remember two rules:
- Identity verification must take place before establishing a business relationship or carrying out an occasional transaction. Not afterwards, before.
- Obtain a statement about PEP status during verification. A PEP is a politically exposed person. This applies to both individuals and legal entities.
Enter the verified information in the relevant form.
What if identification or verification is difficult?
If you have difficulty establishing or verifying a client’s or beneficial owner’s details:
- Document the difficulty: describe the problem and the steps you have taken.
- Increase the risk assessment: verification difficulties generally indicate higher AML risk, which means a broader set of due diligence measures.
Monitoring business relationships
Applying CDD does not end when the relationship begins. Monitor your business relationship with each client throughout its duration.
Frequently asked questions
What exactly are customer due diligence measures under AML, and when must they be applied? CDD measures are mandatory actions taken by an obliged entity in relation to prospective and existing clients to reduce the risk of money laundering and terrorist financing. Apply them in three main situations: when establishing a new business relationship, such as signing an agreement with a new client; when changing the terms of an existing relationship; and when carrying out an occasional transaction. Their scope is risk-based and tailored to the relationship with the particular client.
How should you tailor customer due diligence measures to the client’s risk level? First assess the risk for that client. Only after completing the assessment should you select the appropriate scope of CDD. A low assessment calls for simplified measures; a high assessment calls for enhanced measures, meaning a broader scope of checks and monitoring.
What information must you collect and verify for an individual client and for a company? For an individual, establish and record the first and last name, PESEL number, country of birth, citizenship and, if the person conducts business activity, NIP number, based on an identity card or passport. For a legal entity, such as a company, establish its name, legal form, registered-office address and NIP number. If it has no NIP, record the country, number and date of registration. Verify it using the KRS, the Central Register of Beneficial Owners or other relevant registration documents. You must also identify and verify the beneficial owner and the legal entity’s representative.
Must client identity verification and the PEP statement be completed before cooperation begins? Yes. Identity verification must take place before establishing a business relationship or carrying out an occasional transaction, not afterwards. During verification, obtain a statement from the client about PEP status, meaning politically exposed person status. This applies to clients that are individuals and legal entities.
What should you do if it is difficult to establish or verify a client’s or beneficial owner’s details? Document the difficulty by describing the problem and the steps you took to establish or confirm the information. Increase the client’s risk assessment because verification difficulties generally indicate higher AML risk and therefore a broader scope of customer due diligence measures.
