Understanding Customer Due Diligence Under Tranche 2

Customer due diligence (CDD) is the foundation of any AML/CTF compliance program. Under Tranche 2, DNFBPs must identify and verify the identity of their customers before providing designated services.

What is CDD?

CDD is the process of understanding who your customer is, what they do, and whether they pose a money laundering or terrorism financing risk. It involves three key elements:

1. Customer identification — collecting identity information
2. Customer verification — verifying that information against reliable sources
3. Ongoing monitoring — keeping information up to date and monitoring for changes in risk

When must you perform CDD?

Under Tranche 2, you must perform CDD:

• Before establishing a business relationship for the provision of designated services
• Before carrying out an occasional transaction above the applicable threshold
• When you have suspicions of money laundering or terrorism financing
• When you doubt the adequacy of previously obtained customer information

The three levels of CDD

Standard CDD

Applies to most customers. Requires collecting and verifying identity information for individuals (full name, date of birth, residential address) and entities (name, registration details, beneficial owners).

Simplified CDD

May be applied to lower-risk customers where the risk assessment supports it. This might include established businesses with transparent ownership structures in low-risk jurisdictions.

Enhanced CDD

Required for higher-risk customers. This includes politically exposed persons (PEPs), customers from high-risk jurisdictions, complex ownership structures, and situations where there are grounds for suspicion. Enhanced CDD involves deeper investigation into source of funds, source of wealth, and the purpose of the business relationship.

Beneficial ownership

For entity customers (companies, trusts, partnerships), you must identify the beneficial owners — the natural persons who ultimately own or control the entity. This typically means anyone holding 25% or more of the entity, though the threshold may vary.

How AMLify handles CDD

AMLify provides guided CDD workflows that walk you through the entire process. Ami AI determines the appropriate level of CDD based on the customer's risk profile, prompts you for the required information, and runs sanctions and PEP screening automatically. All records are stored securely for the required 7-year retention period.