Customer Due Diligence (CDD)

Quick answer

Customer due diligence (CDD) is the process a bank or other regulated entity uses to identify and verify a customer and the customer's beneficial owner from reliable, independent sources, understand the purpose of the relationship, and keep checking the account over time. In India, the current rule for commercial banks is the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, which replaced the 2016 KYC Master Direction for these banks. CDD comes in three levels. Simplified due diligence (SDD) is a lighter version for limited, low-risk cases. Standard CDD is the normal check. Enhanced due diligence (EDD) is the deeper check for high-risk customers such as politically exposed persons.

Key takeaways

1. Customer due diligence at a glance

Short answer: CDD answers four questions about every customer: who are you, who really owns or controls you, why do you want this account, and does your activity keep matching what we know about you?

Use this table as your one-screen summary. Each row is explained in detail later in the guide.

2. What is customer due diligence?

Short answer: Customer due diligence is the set of checks a regulated entity runs to know who its customer really is and whether that customer poses a money laundering or terrorist financing risk.

RBI's KYC Directions for commercial banks, dated 28 November 2025, define CDD as identifying and verifying the customer and the beneficial owner using reliable and independent sources of identification (RBI KYC Directions, 2025, updated October 2026). In simple terms, you do not just take the customer's word. You check it against documents and databases that the customer does not control. Separate RBI KYC Directions cover other entity types, such as NBFCs and co-operative banks, so this guide uses the commercial bank rules as the main example.

If you are new to anti-money laundering (AML), our pillar guide on what anti-money laundering is covers the basics, the stages of money laundering and India's legal framework in brief. Here we go deep on CDD only.

A few terms you will see throughout this guide:

KYC vs CDD in one line

KYC is the whole framework: the customer acceptance policy, risk management, identification and monitoring. CDD is the working process inside it that collects and verifies the facts. Our guide on KYC and AML explains how KYC sits inside the wider AML process, so we will not repeat it here.

3. When is customer due diligence required?

Short answer: A bank must do CDD when it starts an account-based relationship, when a walk-in or occasional customer makes a transaction of ₹50,000 or more (single or connected), and whenever it suspects structuring below that limit.

According to RBI's 2025 Directions (October 2026), CDD applies in these situations:

The legal backbone

CDD in India rests on the Prevention of Money-laundering Act, 2002 (PMLA) and the rules under it. Section 12 of the PMLA requires reporting entities such as banks to keep records of transactions and identity, and section 12AA is titled "Enhanced due diligence" (PMLA bare Act, consolidated copy). FIU-IND's FAQs explain that transaction records must be kept for 5 years from the date of the transaction, and identity records for 5 years after the relationship ends or the account closes, whichever is later (FIU-IND FAQs, October 2026). Our guide to the PMLA Act 2002 explains these sections in full.

This guide is education, not legal advice. Always check the current Act, RBI notification or a lawyer for your specific case.

4. CDD vs SDD vs EDD: the three levels compared

Short answer: SDD is a lighter check allowed only in cases the rules name, CDD is the standard check for most customers, and EDD is a deeper check with extra documents, source-of-funds questions, senior approval and closer monitoring for high-risk customers.

This is the comparison most searchers want. It is based on RBI's 2025 KYC Directions as read in October 2026.

SDD in practice

RBI's Directions list specific situations where simplified norms apply. Two clear examples:

SDD is never a shortcut for convenience. You can use it only where the rules allow it, and never where you suspect money laundering.

EDD in practice

The Directions call for enhanced measures in two main cases:

5. Documents for CDD of an individual

Short answer: For an individual, a bank collects an officially valid document (OVD) or its digital equivalent, PAN or Form 60, and where permitted an Aadhaar number or proof of Aadhaar possession, or retrieves the customer's records from CKYCR using the KYC Identifier.

RBI's 2025 Directions list these as officially valid documents (OVDs):

If the OVD does not show the current address, certain "deemed OVDs" can be used for address only, such as a utility bill not more than two months old, a property or municipal tax receipt, a pension payment order, or an employer's accommodation allotment letter. The customer must then submit an OVD with the current address within three months (RBI, October 2026).

Along with the OVD, the bank collects PAN or its equivalent e-document, or Form No. 60 if the customer has no PAN. One point many freshers get wrong: the Directions state that an Aadhaar number is not mandatory for KYC. Aadhaar is used only in the specific cases the rules allow.

6. Beneficial ownership: who is the real owner?

Short answer: A beneficial owner is the natural person who ultimately owns or controls a customer; for a company it is anyone with more than 10 percent of shares, capital or profits, or control, and if nobody meets the test, the senior managing official.

Criminals rarely open accounts in their own names. They hide behind companies, partnerships and trusts. That is why CDD must reach the human being at the top of the chain. RBI's 2025 Directions set these thresholds (October 2026):

How to trace ownership in layers

Ownership is often indirect. Suppose Company A opens an account. Company B owns 60 percent of A, and Mr Rao owns 30 percent of B. Mr Rao indirectly holds 18 percent of A (30 percent of 60 percent), which crosses 10 percent, so he is a beneficial owner. Analysts draw an ownership chart, multiply each layer, and list every person who crosses the threshold or controls the entity by other means. Then they run full CDD on each of those people.

7. Politically exposed persons (PEPs)

Short answer: PEPs are people who hold or have held prominent public functions in a foreign country, such as heads of state, senior politicians, senior officials, judges, military officers, senior executives of state-owned companies and important party officials; their accounts always need EDD.

RBI's Directions describe PEPs as individuals who are or have been entrusted with prominent public functions by a foreign country. Banks may open PEP accounts only when they have:

These rules extend to family members and close associates of PEPs. In practice, analysts screen every new customer and beneficial owner against PEP and adverse media databases (news about crime or fraud) during onboarding, and again during periodic reviews.

Being a PEP is not a crime. It simply means the risk of bribery and corruption proceeds is higher, so the bank must look harder.

8. Risk categorisation and periodic KYC updation

Short answer: Banks rate every customer as low, medium or high risk, and must update KYC at least once every 2 years for high-risk, every 8 years for medium-risk and every 10 years for low-risk customers.

RBI requires banks to follow a risk-based approach. Customers are categorised as low, medium or high risk based on the bank's own assessment of factors such as identity, social and financial status, nature of business, location, products used and delivery channel.

The middle column is illustrative; each bank's board-approved policy sets its own parameters. The timelines run from account opening or the last KYC update.

What does updation involve? If nothing has changed, the customer can give a self-declaration through registered email, mobile number, ATM or digital channels, or by letter. If only the address has changed, the customer declares the new address and the bank confirms it within two months (RBI, October 2026).

A customer's risk rating is not fixed. A low-risk salaried customer who suddenly receives large foreign remittances may be moved to high risk, which brings EDD and a shorter updation cycle.

9. V-CIP: video-based customer identification

Short answer: V-CIP is a live, consent-based video call in which a trained bank official identifies the customer with facial recognition and completes CDD remotely, with strict security rules.

RBI's Directions describe V-CIP (Video based Customer Identification Process) as an alternative method where an authorised bank official identifies the customer through a seamless, secure, live, informed-consent audio-visual interaction. Key conditions in the 2025 Directions (October 2026):

10. CKYCR and the KYC Identifier

Short answer: CKYCR is India's Central KYC Records Registry; banks upload KYC records to it, it issues each customer a KYC Identifier, and other banks can fetch those records instead of asking the customer for fresh documents.

The Central KYC Records Registry (CKYCR) receives, stores, safeguards and retrieves KYC records in digital form. The KYC Identifier is the unique number it assigns to each customer. Under RBI's 2025 Directions (October 2026):

11. Step-by-step CDD process for an individual

Short answer: For an individual, CDD runs in eight steps: collect, verify, screen, understand purpose, rate risk, approve, record and upload, then monitor.

12. Step-by-step CDD process for a company

Short answer: For a company, you verify the entity through its incorporation documents and PAN, check who can act for it, trace every beneficial owner, run CDD on each of them, screen all parties, understand the business, rate risk and approve.

Documents for other entity types

13. Ongoing due diligence: CDD after onboarding

Short answer: Ongoing due diligence means regularly checking that a customer's transactions match what the bank knows about their business, risk profile and source of funds, and acting when they do not.

RBI defines ongoing due diligence as regular monitoring of transactions to make sure they are consistent with the bank's knowledge of the customer, their business and risk profile, and the source of funds or wealth. The 2025 Directions (October 2026) point to transactions that need special attention:

Banks use software that raises an alert when a transaction does not fit the customer's risk category. An alert is a system flag that a person must review. Many alerts turn out to be false positives, meaning the activity looks unusual but has a genuine reason. Analysts work in levels: L1 reviews and clears or escalates alerts, L2 investigates escalated cases in depth, and L3 or a senior team decides on filing. Our guide to transaction monitoring explains this alert workflow step by step.

If the review gives reasonable grounds for suspicion, the bank files an STR with FIU-IND not later than seven working days after the Principal Officer is satisfied the transaction is suspicious (FIU-IND FAQs, October 2026). The Directions also say the bank must keep the fact of reporting confidential, which means never tipping off the customer. Filing an STR is also not, by itself, a reason to restrict the customer's account operations.

14. Red flags during customer due diligence

Short answer: Red flags are warning signs that a customer may be hiding something, such as refusing to share ownership details, using documents that do not match, or expecting activity that does not fit their profile.

A typology is a known pattern or method of money laundering. Red flags are the visible signs of those typologies at the CDD stage. Watch for these:

One red flag does not prove crime. It tells you to ask more questions, gather evidence and, if needed, apply EDD or escalate.

15. Worked case: CDD for a Hyderabad trading company (fictional)

Short answer: This fictional case follows a company account from documents to beneficial owners to EDD and a final decision, so you can see how each CDD step works in real life.

The names, companies and figures below are invented for learning only.

The request. Deccan Agro Exports Private Limited, a Hyderabad company, applies for a current account at a private bank. It says it exports spices and expects monthly credits of about ₹40 lakh from overseas buyers.

Step 1: Entity documents. The analyst collects the certificate of incorporation, Memorandum and Articles of Association, PAN, a board resolution naming two directors as signatories, and the registered office address. The registry check confirms the company is active.

Step 2: Ownership map. The shareholding shows:

Step 3: Find the beneficial owners. Mr Reddy holds 45 percent, so he qualifies. Ms Menon holds 8 percent and has no control rights, so she does not cross the 10 percent test. Mr Varma holds 50 percent of 47 percent, which is 23.5 percent indirectly, so he qualifies. The trust also holds 23.5 percent indirectly, so the analyst asks for the trust deed and the names of its trustees, settlor and beneficiaries.

Step 4: Screening. Sanctions screening is clear for everyone. PEP screening shows Mr Varma's brother is a senior government official in a foreign country. That makes Mr Varma a close family member of a PEP.

Step 5: Risk rating and EDD. An overseas holding company, a trust layer and a PEP link push the file to high risk. The analyst applies EDD: asks for Mr Varma's source of wealth, the trust's details, two years of export invoices and shipping records, and buyer details.

Step 6: Decision. The documents show a genuine export trade, the trust beneficiaries are Mr Varma's children, and his wealth comes from a family business with filed tax returns. Senior management approves the account because of the PEP link. The account is rated high risk, so KYC must be updated at least every 2 years, and the monitoring team gets the expected-activity profile: about ₹40 lakh a month in export receipts from named buyers.

Step 7: Ongoing due diligence. Six months later, the account receives large credits from a country that has no link to the stated buyers, followed by fast transfers to new domestic accounts. The monitoring system raises an alert. The L2 analyst compares the activity with the CDD profile, finds no business reason, and escalates. The Principal Officer reviews the case and decides an STR is needed, which must be filed within seven working days of that decision.

The lesson: good CDD at onboarding gave the investigator a clear baseline. Without the expected-activity profile, the unusual pattern would have been much harder to spot.

16. CDD as a career: what CDD and EDD analysts do

Short answer: CDD and EDD analysts review customer files, trace beneficial owners, screen names, write risk summaries and make onboarding or periodic review recommendations, mostly for banks and GCCs serving global clients.

In India, CDD work sits inside KYC operations teams at banks, global capability centres and consulting firms. Common titles include KYC analyst, CDD analyst, EDD analyst, client onboarding analyst and periodic review analyst. A typical day involves picking files from a queue, checking documents, building ownership charts, running screening on tools such as LSEG World-Check, writing a short risk narrative and passing the file to a checker.

Job descriptions show what employers expect. For example, a State Street AML Senior Associate listing in Hyderabad, seen in October 2026, asked for KYC reviews across all entity types, use of World-Check, analysis of complex ownership structures and a quality score of at least 99 percent, with an ACAMS or ICA certificate listed as good to have rather than required (State Street listing on LinkedIn, October 2026).

To see how CDD fits into the wider analyst role, including the L1 to L3 ladder and daily routine, read our guide to the AML analyst role.

17. Common CDD mistakes to avoid

Short answer: The most common CDD mistakes are stopping at the first layer of ownership, treating CKYCR data as the end of the check, skipping the purpose of the account, and not updating risk ratings when the customer's activity changes.

18. How Brolly Academy helps

Frequently asked questions