Customer due diligence is the work of knowing who you are dealing with, holding the evidence for it, and keeping that judgement current. It is often explained as a list of documents, which is the least interesting part of it, because the documents are easy and the currency is not. What follows is what the file actually holds, how the risk rating changes it, and where the practice comes apart in firms that are otherwise doing it well.
CDD is a judgement with evidence attached, not a folder
The output of due diligence is a rating and a reason, supported by evidence. That ordering matters. A folder full of documents with no rating on it is a filing cabinet, and it answers none of the questions anybody will ask you. The rating is what turns collected paper into a decision: this customer is standard, on this basis, approved by this person, and it comes back in this many months. Everything else in the file exists to support that sentence.
The rating drives the evidence set, and the clock
Standard-risk customers get the basic set. Customers rated up for product, geography, channel or ownership get more, and usually an approver. The customers at the top get enhanced due diligence, which means understanding where the money comes from rather than just who is sending it. The same rating sets the review interval, so a customer rated up in March is on the shorter clock from March, not from the next annual sweep. Firms that rate customers but let every file review on the same annual cycle have half a system.
KYC and CDD are the same work under two names
In everyday use inside a firm, know your customer is the practice and customer due diligence is the specific work of doing it on a given customer, and nobody outside a policy document is careful about the distinction. It is not worth arguing over. What is worth being precise about is the difference between the two things people actually confuse: the check you run on a customer, and the record you keep of having run it. The first can be bought from a vendor. The second is yours to hold.
Questions people ask about customer due diligence
What is customer due diligence, in one sentence?
Knowing who your customer is, deciding how much risk they represent, holding the evidence for both, and looking again before the answer goes stale.
How is CDD different from enhanced due diligence?
Enhanced due diligence is the same work carried further for the customers who warrant it: more evidence, and specifically evidence about where wealth and funds come from, usually with an approval and a shorter review interval. It is a level, not a separate exercise.
How long do we have to keep a customer file?
The identifying information a customer identification program obtains has to be retained for five years after the account is closed. Your own retention policy may be longer and may cover more than the identifying information, which is one reason a file that lives in somebody's mailbox is a problem well before anyone asks to see it.