The honest answer to when enhanced due diligence is necessary is that your policy decides, informed by rules that may reach your firm and by categories that almost every model treats as higher risk. That is less satisfying than a list and it is the only answer that survives contact with a regulator, because a list copied from a website is not a model. This page gives the categories and then the part that matters, which is how you write the rule.
The categories that commonly trigger it
Certain relationships are addressed directly in rules that apply to some institutions, including particular correspondent and private banking arrangements. Beyond those, models commonly escalate on the customer being a politically exposed person or connected to one, on jurisdictions the firm treats as higher risk, on opaque or layered ownership, on products that move value quickly or anonymously, and on a mismatch between the customer's stated profile and the activity you expect. Each is a factor, not a verdict.
Why the list is the least important part
Two firms with the same list can behave completely differently, because what matters is the rule that turns factors into a level and the discipline of applying it. A single high factor escalating on its own is one design. A weighted score crossing a threshold is another. Either works. What does not work is a list with no rule, because the level then depends on who is looking, and a book rated by mood cannot be defended even when every individual rating is reasonable.
Write the exception before you need it
Every model produces a customer it gets wrong in both directions, and the useful policy says in advance what happens then: who can override, what reason has to be recorded, and whether an override changes the review interval. Firms that have not written this end up with informal overrides that leave no trace, which is the worst of both, since the decision was made and the record does not show it.
Questions people ask about enhanced due diligence is necessary when
Is enhanced due diligence required for all politically exposed persons?
Most models escalate on that basis, and some rules address particular relationships directly. Whether and how it applies to your firm is a policy and counsel question rather than something a software page should answer for you.
Can a customer be de-escalated?
Yes, at a review, with a recorded reason and a named person. It should be as deliberate as the escalation was, and it should move the review interval back out rather than leaving the shorter clock running by inertia.
What if we get it wrong?
A model applied consistently and reviewed periodically is defensible even when an individual call turns out badly. A book with no model is not defensible even when most of the calls were right.