Enhanced due diligence on a high risk customer: the checklist compliance officers actually use

Enhanced customer due diligence is the part of an AML/CTF program that separates firms who understand their customers from firms who have a folder of PDFs. It is triggered when your risk assessment says a customer is high risk, and the law is deliberately vague about what "enhanced" means, because the point is that you decide what is proportionate and then do it properly.

This is the working checklist we use when a firm asks us to run or review an enhanced due diligence file. It maps to the Australian AML/CTF Rules and to the UK Money Laundering Regulations, but the logic is the same anywhere.

1. Write down why this customer is high risk

Every file should open with one paragraph: what triggered the enhanced process. A foreign politically exposed person. A company whose beneficial owner sits behind two trusts and a nominee. Funds arriving from a jurisdiction on the FATF grey list. A transaction that is large for the customer's apparent means. Auditors look for this first, because it tells them whether the rest of the file was designed around the actual risk or copied from a template.

2. Identify everyone who matters, not only the applicant

For a company or trust the people who matter are the beneficial owners at 25 percent or more, anyone who controls the entity regardless of shareholding, the directors, the trustees and settlor, and the person you actually deal with. Registry extracts in each jurisdiction, reconciled against the structure the customer described. Where the two do not match, that is a finding, not an administrative note.

3. Source of wealth and source of funds are different questions

Source of wealth is how the person came to have money at all: a business built over twenty years, an inheritance, a career in banking. Source of funds is where the specific money for this transaction is coming from: the sale of a property, dividends from a named company, a loan from a named lender. A high risk file needs both, and it needs them evidenced. A signed declaration is a starting point. Company accounts, a completed sale contract, a probate grant or a bank letter are evidence. When the story cannot be evidenced, the file should say so and the senior manager should decide with that in mind.

4. Screen properly, then resolve the matches

Sanctions, PEP and adverse media screening against a current list, with the list version recorded. Then the step most firms skip: resolve each potential match to a yes or a no with reasons. A screening report with twelve unresolved "possible" hits is not a completed check, it is a to do list.

5. Adverse media in the languages that matter

English language media on a Vietnamese manufacturer or a Gulf trading house will miss most of what has been written about them. Local language searches, local court and regulator sites and local business press are where the real findings are. This is the single biggest gap we see in files prepared in Australia and the UK.

6. Verify what can be verified on the ground

For the highest risk matters, desk research has a ceiling. Does the factory exist at the address, at the size claimed? Is the "head office" a serviced office with a nameplate? What do people in that market who have dealt with this person say? Lawful, proportionate on the ground verification through licensed local partners answers those questions, and it is usually far cheaper than the loss it prevents.

7. Understand the purpose and intended nature of the relationship

Why does this customer want this service from you, in this way, now? A wholesale importer opening a facility that its stated turnover cannot support, or a client who insists on a structure that adds cost and opacity for no commercial reason, is telling you something.

8. Senior manager decision, in writing, with conditions

Enhanced due diligence ends with a decision by someone senior enough to be accountable: approve, approve with conditions, or decline. Conditions can include transaction limits, enhanced monitoring, periodic re-verification or specific documents to be provided by a date. The decision, the reasons and the evidence relied on are what an AUSTRAC or FCA reviewer will ask to see.

9. Set the review date before you close the file

High risk customers are reviewed more often. Twelve months is common; six for the riskiest. Put the date in the system when the file closes, not when you remember.

Where firms get caught

• Treating a screening report as the whole check.
• Accepting a source of wealth story without a single document behind it.
• Stopping the beneficial ownership trace at the first company in the chain.
• No adverse media search in the customer's own language and country.
• A risk rating with no written reasons, or reasons written after the fact.

If a file on your desk has one of those gaps and the customer is genuinely high risk, that is the moment to bring in help. Valitros runs the full enhanced due diligence file, including verification in the country concerned, and delivers a report you can attach to the decision. Book a scoping call or read about the service.