Enhanced Due Diligence (EDD) applies stronger verification and monitoring when a customer, ownership structure, transaction, or relationship presents elevated financial crime risk. It should not be a generic request for more documents or an automatic rejection process.

An effective EDD workflow identifies the specific risk, requests evidence capable of addressing it, verifies that evidence, and records why the customer was approved, restricted, monitored, or declined. FinAuth supports this process by combining identity, document, biometric, device, behavioral, and external compliance signals within one risk-based workflow.

1. What Is Enhanced Due Diligence?

EDD is an extension of Customer Due Diligence for higher-risk situations. The depth of review should reflect the nature and severity of the identified risk.

The FATF risk-based approach calls for enhanced measures where risks are higher and proportionate measures where risks are lower. This helps institutions concentrate resources on material risks instead of applying maximum friction to every customer.

Depending on applicable regulation and internal policy, EDD may include:

  • Additional identity or business evidence.
  • Verification of beneficial owners and controlling persons.
  • Source-of-funds or source-of-wealth assessment.
  • Clarification of account purpose and expected activity.
  • Senior or specialist approval.
  • More frequent screening and transaction monitoring.

EDD requirements must be adapted to the institution’s products, markets, regulatory obligations, and documented risk assessment.

2. Define Clear EDD Triggers

An EDD workflow should begin with explainable triggers rather than an undefined “high-risk” label.

Common triggers include:

  • A significant sanctions, PEP, or adverse media match.
  • Complex, opaque, or unusual ownership structures.
  • Geographic exposure relevant to the institution’s risk assessment.
  • Activity inconsistent with the customer’s stated purpose.
  • Unclear source of funds or source of wealth.
  • High-value or unusual transactions.
  • Document manipulation or identity inconsistencies.
  • Deepfake, injection, or liveness concerns.
  • Devices connected to multiple suspicious identities or accounts.
  • Material changes after onboarding.

No individual trigger should automatically establish wrongdoing. A possible PEP match, new device, or unusual transaction becomes more meaningful when supported by verified identity attributes and additional risk evidence.

FATF also distinguishes jurisdictions under increased monitoring from jurisdictions subject to enhanced measures. Inclusion on a monitoring list should inform risk analysis rather than automatically cause blanket customer rejection.

3. Build an Evidence Plan Around the Risk

EDD should request information that can resolve the identified concern. Asking every high-risk customer for the same document package creates unnecessary work and may still fail to answer the core question.

A structured evidence plan can cover:

Identity: Confirm that the customer is a real person and that submitted identity attributes are consistent.

Document authenticity: Examine document type, layout, security features, OCR fields, machine-readable data, and manipulation indicators.

Face and liveness: Confirm that the applicant matches the trusted identity portrait and is genuinely present during remote verification.

Ownership and control: Identify the natural persons who ultimately own or control a legal entity or arrangement. FATF guidance emphasizes looking beyond formal legal ownership to actual ultimate ownership and effective control.

Funds and wealth: Assess whether the origin of funds or accumulated wealth is plausible for the customer’s profile and intended activity.

Business purpose: Understand expected products, counterparties, transaction values, jurisdictions, and account usage.

FinAuth can orchestrate Document Verification, Face Verification, Edge or Cloud Liveness Detection, and structured evidence collection while preserving the results for downstream compliance review.

4. Verify Evidence Instead of Merely Collecting It

More documents do not necessarily create greater assurance. Evidence must be checked for authenticity, relevance, consistency, and recency.

For example, an EDD workflow should determine whether:

  • Names and identity attributes agree across available sources.
  • Corporate records align with the declared ownership structure.
  • The identified beneficial owner is consistent across documents.
  • Source-of-funds evidence relates to the transaction under review.
  • Dates, values, employers, counterparties, and account activity are plausible.
  • Documents show signs of editing, recapture, or digital composition.
  • The person submitting the evidence matches the verified customer.

Unavailable information should not automatically be treated as conflicting information. The workflow should distinguish missing, unreadable, inconsistent, and suspicious evidence because each condition requires a different response.

5. Combine Customer, Identity, and Activity Risk

EDD decisions should reflect combined evidence rather than a single document, screening alert, or risk score.

FinAuth’s Risk Engine can combine:

  • Verified identity and document results.
  • Face-match and liveness confidence.
  • Device integrity and session context.
  • Behavioral changes and account relationships.
  • Screening and adverse media outcomes.
  • Ownership complexity.
  • Transaction value, velocity, and counterparties.
  • Previous EDD and investigation results.

The workflow can then apply proportionate actions:

  • Approve: Evidence sufficiently addresses the identified risk.
  • Monitor: The relationship is acceptable but requires closer observation.
  • Request More: A material question remains unresolved.
  • Enhanced Review: Multiple or significant risks require specialist assessment.
  • Restrict or Decline: Risk cannot be adequately mitigated under applicable policy.

The decision record should show which signals triggered EDD, what evidence was reviewed, how discrepancies were resolved, and who approved the outcome.

6. Design Efficient Review Queues

Not every EDD case requires the same reviewer or priority. Cases can be segmented by risk severity, evidence completeness, transaction urgency, and required expertise.

Automation can resolve routine tasks such as data extraction, cross-field validation, duplicate detection, document classification, and low-risk discrepancy checks. Reviewers can then focus on ownership interpretation, source-of-wealth plausibility, material inconsistencies, and complex screening results.

FinAuth provides structured outputs and configurable decision rules, helping compliance teams route cases with stronger combined-risk evidence into priority queues while avoiding unnecessary manual review.

7. Continue Monitoring After Approval

EDD is not complete when onboarding ends. Customer ownership, political exposure, geography, device relationships, and transaction behavior can change.

Ongoing controls may include:

  • Periodic and event-driven rescreening.
  • Transaction monitoring against expected activity.
  • Ownership and profile-change reviews.
  • Identity reverification for sensitive changes.
  • Device and linked-account risk analysis.
  • Scheduled EDD refreshes based on risk level.

FATF guidance notes that ongoing monitoring can change the customer’s risk profile and determine whether additional CDD or EDD is needed.

8. EDD Workflow Q&A

What triggers Enhanced Due Diligence?

EDD may be triggered by elevated screening, ownership, geographic, transaction, identity, device, or behavioral risk. The trigger should be documented and evaluated in context.

What documents are required for EDD?

There is no universal package. Required evidence depends on the risk being investigated and applicable regulation. It may include identity, ownership, business-purpose, source-of-funds, or source-of-wealth evidence.

Can an EDD workflow be automated?

Parts of it can. FinAuth can automate evidence capture, OCR, document authentication, Face Verification, Liveness Detection, device analysis, and risk routing. Material judgments and unresolved high-risk cases may still require specialist review.

Does a high-risk classification mean the customer must be rejected?

No. High risk generally requires stronger evidence and proportionate controls. Rejection or restriction becomes appropriate when the risk cannot be understood or adequately mitigated under the institution’s policy and legal obligations.

9. Conclusion

A strong EDD workflow connects each risk trigger to relevant evidence, verification, documented assessment, and ongoing monitoring. Its objective is not to maximize friction but to obtain sufficient confidence for a defensible decision.

By combining identity, document, biometric, device, behavioral, ownership, and transaction signals, FinAuth helps organizations automate evidence processing, prioritize meaningful risk, and apply enhanced verification where it is genuinely required.