A practical guide to KYC due diligence: the three tiers, the five stages, when enhanced checks apply, and what a compliant customer file needs.
KYC due diligence is the set of checks a regulated business runs to verify who a client is, what the client does, and where the client’s money comes from. It comes in three tiers: simplified due diligence (SDD), customer due diligence (CDD), and enhanced due diligence (EDD). The tier follows the risk the client presents, and a regulator expects the file to show why that tier was chosen.
This guide covers the tiers, the five stages, the triggers for enhanced checks, the evidence a file needs, and how due diligence continues after onboarding.
KYC due diligence is the risk-based work of establishing, and then keeping current, who a customer really is. It goes further than identity verification, which only confirms that a person exists and matches a document.
LegalBison’s wiki entries on know your customer and due diligence cover the basic terms. The standard that most regimes follow is FATF Recommendation 10. It asks a regulated firm to identify the customer and verify the identity, identify the beneficial owner and take reasonable steps to verify that person, understand the purpose and intended nature of the relationship, and carry out ongoing due diligence (FATF Recommendations). Due diligence is one control within the wider framework described in AML explained.
The tier decides how much evidence a file needs. The three tiers differ in scope and in what triggers them:
| Tier | When it applies | What it involves | Typical trigger |
|---|---|---|---|
| Simplified due diligence (SDD) | Where the regime allows it and the risk assessment shows lower risk | Reduced measures, such as lighter verification or less frequent review. Identification is never skipped | Documented low-risk factors, such as a regulated financial institution or a listed company as the customer |
| Customer due diligence (CDD) | The default for a new business relationship | Identify and verify the customer, identify the beneficial owner, understand the purpose of the relationship, monitor it | Establishing a relationship, an occasional transaction above the threshold, suspicion of money laundering or terrorist financing, doubts about earlier data |
| Enhanced due diligence (EDD) | Where the risk is higher, or the rules require it | Everything in CDD plus more information, source of funds and wealth checks, senior management approval, closer monitoring | Politically exposed persons (PEPs), high-risk jurisdictions, complex ownership, unusual transactions, correspondent relationships |
Thresholds differ by activity. FATF’s general threshold for occasional transactions is USD/EUR 15,000, and for virtual asset service providers it is USD/EUR 1,000. A firm should confirm the figure in its own regime.
The five stages are customer identification, verification, beneficial ownership, risk assessment, and ongoing monitoring. This is a working convention that maps onto the elements of FATF Recommendation 10, not a statutory list, and regimes may order the steps differently.
Identification comes first: the firm collects who the customer is. In the United States, a bank’s Customer Identification Program (CIP) must at minimum obtain the name, an address, an identification number, and, for an individual, a date of birth before opening an account (31 CFR 1020.220).
Verification confirms those details against reliable, independent evidence. For individuals, that usually means unexpired government-issued photo identification. For companies, FATF’s interpretive note points to the name, legal form, proof of existence, the powers that bind the entity, senior management, and the registered address.
Next, the firm identifies the beneficial owners, the natural persons who ultimately own or control a legal entity. Under the US customer due diligence rule, that means each individual holding 25 percent or more of the equity, plus one individual with significant control responsibility (31 CFR 1010.230, explained in FinCEN’s CDD FAQs). Other regimes set their own thresholds.
The risk assessment rates the customer on customer, geographic, product, and delivery-channel risk, and records the reasoning. That rating selects the tier.
Ongoing monitoring then runs for the life of the relationship, with the firm watching activity and keeping the file current. It is covered in the section on perpetual due diligence below.
The five stages of KYC due diligence: identification, verification, beneficial ownership, risk assessment, and ongoing monitoring.
Enhanced due diligence is required where the risk is higher, and each regime lists its own triggers. Five of them recur across regimes.
For politically exposed persons, FATF Recommendation 12 requires a system to determine PEP status, senior management approval, reasonable measures to establish source of wealth and source of funds, and enhanced ongoing monitoring for foreign PEPs. Domestic PEPs and people with prominent functions at international organizations fall under the same measures where the relationship is at higher risk. In the UK, regulation 33 of the Money Laundering Regulations 2017 (MLR 2017) names PEPs, their family members, and known close associates (MLR 2017, reg. 33).
High-risk jurisdictions are a recent area of change. On June 30, 2026, the UK narrowed its mandatory trigger to FATF “call for action” countries rather than the wider high-risk list, through the Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621). EDD still applies wherever a firm identifies a high risk itself. In the EU, the Commission keeps the list of high-risk third countries by delegated act.
Unusual or high-value transactions are another trigger. UK regulation 33 requires EDD for transactions that are unusually large or unusually complex, or that follow an unusual pattern with no apparent economic or lawful purpose. The 2026 amendments tightened the wording from “complex” to “unusually complex.”
Complex ownership is a risk factor rather than an automatic trigger. Regulation 33 lists a corporate structure that is unusual or excessively complex for the nature of the business, and it says a risk factor on its own does not prove high risk.
Correspondent relationships are the fifth. FATF Recommendation 13 covers correspondent banking, the EU AMLR’s EDD list includes correspondent relationships, and the UK adds a crypto-specific correspondent duty (regulation 34A) from February 1, 2027.
The EU’s Regulation (EU) 2024/1624 (AMLR) makes EDD mandatory in the cases listed in Articles 29 to 31 and 36 to 46, and in other higher-risk situations the firm identifies in its own risk assessment (Article 34). For relationships involving assets of EUR 5 million or more, or customers with total assets of EUR 50 million or more, Article 34 adds further measures (AMLR on EUR-Lex).
A usable file covers the items below. The list draws on FATF Recommendations 10, 11, and 12, the US CIP and CDD rules, and the UK and EU texts cited above. Items marked EDD apply only at the enhanced tier.
The KYC file checklist. Items marked EDD apply only at the enhanced tier.
Identity and verification:
Ownership and control:
Purpose, funds, and wealth:
Screening:
Governance and records:
The screening items name a task. Firms usually run them with list-screening and identity-verification software.
Due diligence does not end at onboarding. FATF Recommendation 10 requires ongoing due diligence: scrutiny of transactions across the relationship to confirm they match what the firm knows about the customer, the business, and the risk profile, plus keeping documents and data up to date, especially for higher-risk customers.
Four kinds of events usually prompt a refresh: a change in ownership or control, a new jurisdiction or product, a screening hit such as a new sanctions or PEP match, and activity that departs from the expected profile. Periodic reviews run alongside those events. The AMLR sets minimum update intervals, with a shorter one-year interval for customers subject to enhanced due diligence.
Perpetual KYC is an operating model. Instead of reviewing every file on a fixed cycle, the firm updates a file whenever new information or a trigger arrives, and keeps a scheduled review as a backstop. The legal duty is to keep information current, and how a firm meets it is a design choice. LegalBison’s crypto AML and KYC guide covers the stage-by-stage walkthrough for crypto operators.
Each regime builds on FATF Recommendation 10 and differs in the details. One line per regime follows, and none is a deep dive.
How the FATF baseline carries into the EU, US, and UK regimes.
For crypto-specific frameworks and the difference between AML and KYC, see the crypto AML and KYC guide and AML explained.
A license turns due diligence from good practice into a condition of authorization and supervision.
Crypto-asset service providers are obligated entities under the AMLR, so CDD and EDD duties attach to a CASP license and to authorization under the MiCA license regime. Payment institutions and electronic money institutions are covered as financial institutions, which brings the same duties to an EMI license or a payment service provider (PSP) authorization. Applications for these licenses are expected to describe the AML and customer due diligence controls the applicant will run, and supervisors review how those controls work in practice.
For operators, the practical consequence is timing. The tier logic, the evidence standard, and the review cycle should exist before the application is filed, not after approval. LegalBison’s KYC and KYB screening service covers the operating side of that work.
LegalBison is a global boutique legal and business services firm and licensed corporate service provider, with offices across Europe, MENA, Latin America, and Asia and operational reach in 50+ jurisdictions. The firm sets up due diligence programs for license applicants and operating firms, including the risk assessment, tier rules, file standards, and review cycles. Operators that prefer to outsource the running of those checks can use the firm’s KYC and KYB screening under its fractional compliance offering. Where a license is in scope, the due diligence work is built into the application. Regulators decide outcomes, and LegalBison does not guarantee approvals or onboarding results. To discuss a project, contact LegalBison.
KYC due diligence is the set of checks a regulated business runs to verify a client’s identity, understand the client’s activity, and confirm where the client’s funds come from. It runs at one of three tiers and continues after onboarding.
The five stages are customer identification, verification, beneficial ownership, risk assessment, and ongoing monitoring. They follow the elements of FATF Recommendation 10 and are a working convention.
Know your customer is the obligation to know who a customer is, and due diligence is the depth of checking applied to that customer. Together they cover identification, ownership, purpose, source of funds, and monitoring, at a depth set by risk.
CDD is the standard set of checks every new relationship receives, and EDD is the deeper set applied where risk is higher. EDD adds source-of-wealth checks, senior management approval, and closer monitoring. Typical triggers are PEPs, high-risk jurisdictions, and unusual transactions.
Yes, for covered financial institutions. The Bank Secrecy Act framework requires banks and other covered institutions to run a Customer Identification Program and, for legal entity customers, to identify beneficial owners under 31 CFR 1010.230. Other regulated businesses have AML program duties under their own parts of Chapter X. The rules do not apply to every business.
Perpetual KYC is an operating model in which customer files are updated as new information or trigger events arrive, rather than only at fixed review dates. It is not a separate legal requirement. The legal duty is to keep customer information current.
Our team of experts will be glad to provide you with answers and a one-stop-shop solution to all your legal corporate needs.
How a crypto payment moves from checkout to settlement, what the fees look like, and which authorization a processor needs. see more...
Backed or synthetic, direct or indirect ownership: what tokenized stocks really give a holder and where US and EU rules draw the line. see more...
How a DAO works, what happened to The DAO and Ooki DAO, and which legal wrappers and licenses apply once a DAO holds funds. see more...
