Client due diligence: what a complete file should contain
Identity, mandate scope, UBOs, screening, risk rating and evidence — the practical CDD baseline.
Executive summary
CDD is a workflow, not a document request.The file should connect identity, mandate, risk and evidence.Repeatability matters as much as completeness.Client due diligence is the operating core of AML: know who the client is, understand what they want you to do, identify the people who control them, screen the relevant parties and record a risk-based decision before acting.
A complete CDD file is not just a copy of a passport. It should connect identification evidence, mandate scope, UBO data, sanctions/PEP/adverse-media screening, source-of-funds questions where relevant and the approval path for the client risk rating.
The standard supervisors look for is repeatability. If two staff members handle similar files, the same controls should happen, the same exceptions should be escalated and the evidence should be easy to reconstruct months or years later.
Who this applies to
This guide is for offices that onboard clients, representatives, beneficial owners or counterparties and need a defensible baseline for ordinary client due diligence.
- New individual or company clients
- Existing clients starting a new in-scope matter
- Representatives acting for the client
- Company directors and UBOs
- Files where the office must evidence why simplified or enhanced measures apply
Legal and supervisory context
CDD is the first control supervisors test because it proves whether the office knew who it was dealing with before acting. The legal duty is risk-based, but risk-based does not mean informal: the file should show why the chosen depth of due diligence was appropriate.
For non-financial obliged entities, CDD also needs to reflect the mandate. A low-risk personal tax query is not the same as a property acquisition through a foreign company, even if the same client is involved.
What the office must actually do
A practical CDD workflow identifies the client, understands the mandate, identifies UBOs, screens relevant parties, assigns a risk rating and records approval before work proceeds where required.
- Capture identity and authority to act.
- Record mandate scope and regulated activity.
- Identify and verify UBOs for legal entities.
- Screen client, representatives, UBOs and counterparties where relevant.
- Assess geography, sector, structure, payment method and source of funds.
- Escalate exceptions and record approval.
- Set review cadence and monitoring triggers.
What good evidence looks like
Good CDD evidence shows the information collected, the checks performed, the risk conclusion, the person who approved it and the version of the rules or lists used.
Common mistakes supervisors find
- Treating CDD as a passport upload only.
- Not linking the CDD depth to the mandate risk.
- Screening the client but not the UBO or representative.
- Letting exceptions sit in email instead of a decision queue.
- Refreshing files without recording what changed.
Practical checklist
- Identify the client.
- Verify authority to act.
- Scope the mandate.
- Collect UBO data.
- Run screening.
- Assign risk rating.
- Record approval and review date.
- Turns CDD into a guided intake flow.
- Connects mandate scope to required controls.
- Stores screening and UBO evidence in the file.
- Routes exceptions to named reviewers.
- Builds the inspection pack as work happens.
FAQ
Is CDD required for every enquiry?
No. Scope depends on the profession, mandate and activity. But the office should record why a matter is out of scope when that decision matters.
Can simplified due diligence be used?
Only where the risk assessment supports it. The file should show why simplified measures were appropriate.
Who approves CDD exceptions?
A designated senior person, AMLCO or responsible professional should approve material exceptions before the office relies on them.
Official references
From knowledge to compliance
Reading is a start. Sceau turns these obligations into a workflow that runs itself and proves itself.
Book a demo