Two readers arrive here. One ran the standard checks on a counterparty, got nothing back, and is still uneasy: the numbers do not fit the company, and the ownership stops at a holding entity in a jurisdiction nobody can explain. The other has been told by a bank or an auditor that a relationship requires enhanced due diligence, without being told what that means. Both have the same problem: the standard file answered its own question and left the real one untouched.
The insight generic checklists never make: EDD is not a longer version of what you already did, it is a different question. Standard due diligence asks whether this is who they say they are. Enhanced due diligence asks whether what you now know explains what they are doing. That file closes when the risk is explained or the relationship is declined, not when a form is full.
Enhanced due diligence is a different question, not a longer checklist
Standard due diligence is an identity and existence exercise: does the entity exist, is it in good standing, is the signatory authorised to bind it, does the name hit a screening list. Those are verifiable facts with defined sources, and a competent corporate KYC file resolves them. EDD has no such end point, because it begins from a risk the standard file surfaced but could not explain: the counterparty exists, is registered and screens clean, yet the volume is inconsistent with a company that has three employees and a virtual address. The question has changed from «who is this» to «does this make sense».
Where is EDD actually mandated? Two provisions say so directly, both inside the financial sector. 31 CFR 1010.610 requires due diligence programs for correspondent accounts maintained for foreign financial institutions, with enhanced due diligence for accounts held for certain foreign banks: those under offshore banking licences, or licensed in jurisdictions designated as of primary money laundering concern or non-cooperative. 31 CFR 1010.620 covers private banking accounts — a minimum aggregate deposit of not less than $1,000,000, assigned to a liaison, held for one or more non-U.S. persons — and requires enhanced scrutiny where a senior foreign political figure, a politically exposed person, is a nominal or beneficial owner, aimed at detecting the proceeds of foreign corruption.
Outside those cases there is no federal EDD checklist. It is a risk-based standard: what your own risk assessment requires when the standard checks do not resolve the risk. That is why a generic enhanced due diligence checklist misleads — a list built for a correspondent banking desk maps badly onto a distributor onboarding a supplier. The federal banking agencies’ April 2026 proposals on AML/CFT programs point the same way: the risk assessment defines adequate diligence.
| Dimension | Standard due diligence | Enhanced due diligence |
|---|---|---|
| Question asked | Is this who they say they are? | Does this explain what they are doing? |
| Ownership | Registered owners as filed | Traced through to natural persons |
| Money | Not examined | Source of funds and source of wealth |
| Screening | Lists run, result recorded | Every hit resolved, ownership included |
| Closes when | Identity verified | Risk explained, or relationship declined |
One category error is worth correcting. The CDD Rule at 31 CFR 1010.230 binds covered financial institutions — banks, brokers or dealers in securities, mutual funds, futures commission merchants and introducing brokers — not ordinary operating businesses, a distinction we set out with the customer due diligence requirements for covered institutions. Sanctions are separate, and being outside the CDD Rule exempts nobody.
What pushes a file into EDD compliance, and what EDD adds
A file escalates when something in it will not reconcile. The recurring triggers:
- Layered or opaque ownership across jurisdictions that never reaches a person.
- Nominee shareholders or directors recurring across unrelated companies.
- High-risk or sanctioned jurisdictions in the ownership chain, payment route or operations.
- PEP involvement — a senior foreign political figure, associate or family member as owner or beneficiary.
- Cash-intensive activity inconsistent with the stated business model.
- Unexplained source of funds or wealth — money larger or faster than the business could generate.
- Adverse media the counterparty did not disclose and cannot account for.
- Shell-company indicators — no employees, virtual address, entity formed shortly before a large transaction.
- Refusal to answer ownership questions, the most predictive signal on this list.
None of these proves anything; each is a reason the standard file cannot close. What EDD adds is not paperwork but harder questions routine onboarding never asks.
- Source of funds and source of wealth as separate questions — the money behind this transaction, and how the underlying assets were accumulated.
- Ownership traced to natural persons, not to another entity, until it reaches people or is documented as untraceable — itself a finding. This is the substance of establishing the real beneficial owner behind a legal entity.
- Sanctions analysis including the 50 Percent Rule, applied to the ownership chain, not the name alone.
- PEP and adverse media review with real disambiguation, in the relevant languages, resolved to a conclusion.
- Site or operational verification — that premises, staffing and activity exist at the scale claimed.
- A documented decision recording the risk, what resolved it, and why the relationship was accepted or declined.
The sanctions point is where companies that believe they sit outside the regulatory perimeter get hurt. OFAC screening is a strict-liability obligation applying to every U.S. person and business, not only to financial institutions. The SDN list is the primary list, but the exposure that catches people is the 50 Percent Rule: an entity owned 50 percent or more, directly or indirectly, in the aggregate, by blocked persons is itself blocked, though named on no list.
If you have not established who ultimately owns your counterparty, you cannot know whether it is blocked. Ownership tracing is a sanctions question, not a KYC formality. Nor is the answer in a government database: under FinCEN’s final rule of 11 August 2026, U.S. companies and persons are permanently exempt from beneficial ownership reporting under the Corporate Transparency Act, and FinCEN must delete information relating to U.S. persons. There is no usable federal registry of who owns a U.S. company; that answer is built from state filings, corporate records and direct verification.
What the official guidance does not tell you
The regulations describe obligations, not where files break. These are the failure points we see repeatedly.
Screening hits are almost always name collisions, and the work is the disambiguation, not the alert. Any tool will match a common surname, a transliterated name, or a trading name resembling a listed entity. Generating the alert is trivial; deciding whether it is your counterparty is the job, and it turns on date of birth, jurisdiction of formation, registration numbers and the transliteration conventions of the source language. A file with forty unresolved hits is worse than one with none: it shows you were told and did nothing.
Adverse media in another language is where the real finding usually is. English searches on a Latin American, Eastern European or Middle Eastern counterparty routinely return nothing while the regional press or a prosecutor’s bulletin carries the item that changes the analysis. Names transliterate several ways, corporate names differ from trading names, and local reporting rarely reaches English aggregators. Adverse media screening run only in English produces a clean result by construction.
«Business income» is not an answer to source of funds. It restates the question. A real answer identifies specific money, from a specific account, generated by a specific activity, and corroborates it. Source of wealth explains how the underlying assets accumulated — a business sale, inheritance, professional earnings — coherently with documented history. Files fail here more than anywhere else, because whoever asked accepted the first plausible sentence.
EDD without a written conclusion is worthless. Two years later nobody asks whether you gathered documents. They ask why you accepted the relationship. If the file holds reports and search results but no reasoned decision — what the risk was, what evidence addressed it, what residual risk remained, who decided and when — then in practice no diligence was performed. This is the defect we most often find when reviewing a file after an examiner has raised a question.
EDD that never ends is also a failure. Perpetual escalation — another report, another request, another round of questions — is a decision by default, and usually the worst one available. It burns the commercial relationship, produces no defensible record, and leaves the risk where it started. A properly run file closes: accept, accept with conditions and monitoring, or decline. Knowing when the risk is explained well enough to close is judgment, and no checklist transfers it.
The most common mistakes and what they cost
The costliest mistake is treating a clean standard check as an answer to a question it never asked. A report saying «no matches» confirms that a name did not collide with a list on a given date. It does not say who owns the entity, where the money originates, or whether the business exists. Deals get signed on that basis, and the discovery arrives when a payment is stopped or a bank asks a question the file cannot answer.
The second is stopping the ownership chain at an entity. Where the registered owner is another company and the file records that company as the beneficial owner, the analysis was never performed. This is the direct route to the 50 Percent Rule problem: a counterparty blocked through aggregate indirect ownership while named on no list. The consequence is a blocked and reportable transaction, funds that cannot be released, and strict liability in which good faith is no defence.
Third, screening once at onboarding and never again. Lists change, ownership changes, and a counterparty clean at signing may not be at the third shipment — a point that applies equally to third-party and vendor due diligence across a supply chain. Fourth, mistaking a database subscription for diligence: the platform produces candidates, a person resolves them, and someone with authority decides and records why.
The cost is measurable. Onboarding stalls for weeks while the file is rebuilt. A banking relationship is terminated because the institution cannot get comfortable and exits rather than investigates. An examiner or auditor issues a finding on program adequacy that must be remediated across every file. Or the diligence is paid for twice: once inadequately, and again when a bank, an acquirer or opposing counsel requires it done properly under time pressure.
How Compliance Officers resolves enhanced due diligence for you
We run these files continuously, and end to end. The client does not chase Secretaries of State for formation documents, reconcile ownership across jurisdictions, sit in front of a screening platform working out whether a hit is their counterparty, or commission translations of regional press. We do that work and deliver the part that matters: a resolved position on the risk, the evidence behind it, and a conclusion someone can rely on.
That is the standard we hold ourselves to — zero paperwork for you, zero errors, zero unnecessary delays. Zero paperwork because the retrieval and source work sit with us. Zero errors because ownership is traced to natural persons or documented as untraceable, every alert is resolved rather than listed, and source of funds and source of wealth are treated as separate questions. Zero unnecessary delays because we know which records exist in which jurisdiction, and where to stop pulling a thread that leads nowhere.
Our coverage spans domestic and cross-border files: entity and ownership verification through state records, UCC and court research, sanctions and PEP analysis including ownership-based exposure, adverse media review in the languages that matter, operational verification, and a written conclusion that holds up when a bank, an acquirer or a regulator reads it years later. If you have a counterparty you cannot get comfortable with, contact us to evaluate your case.
Frequently Asked Questions
Is enhanced due diligence required by law for my company?
Directly, only in defined financial-sector cases: correspondent accounts for certain foreign banks under 31 CFR 1010.610, and private banking accounts under 31 CFR 1010.620. For everyone else it is a risk-based standard set by your own risk assessment, with no federal checklist. Sanctions compliance binds every U.S. business regardless, and resolving that exposure through an ownership chain is EDD by another name. We assess which applies to you.
What is the difference between source of funds and source of wealth?
Source of funds is the money behind a specific transaction: which account it came from and what activity generated it. Source of wealth is how the person or entity accumulated assets over time — a business sale, inheritance, professional earnings. A counterparty can answer one convincingly while the other makes no sense, which is why they are asked separately. Establishing both with corroboration is part of every EDD file we run.
How long does an enhanced due diligence file take?
It depends on the jurisdictions in the ownership chain and how the counterparty responds. Files confined to U.S. state records move quickly. Files with layered offshore ownership, non-English adverse media or a politically exposed person in the structure take longer, because disambiguation and translation cannot be rushed without producing an unreliable conclusion. We scope realistically and tell you what is achievable before you commit to a timeline.
Can enhanced due diligence be done remotely?
Most of it, yes. Corporate records, ownership tracing, sanctions and PEP analysis, adverse media review and litigation research are conducted remotely. What sometimes cannot be is operational verification — confirming that premises, staffing and activity exist at the scale claimed — which may require a physical check in the relevant jurisdiction. We coordinate both and say clearly when a file needs on-the-ground confirmation.
Our screening returned a possible sanctions or PEP match. Is that a problem?
Usually it is a name collision, and the work is proving that. Common surnames, transliterated names and similar corporate names generate matches constantly. What matters is that each hit is resolved to a documented conclusion using identifiers such as date of birth, jurisdiction and registration numbers, and that ownership is checked separately, since the 50 Percent Rule can block an entity named on no list. We resolve hits rather than forwarding them.
What does enhanced due diligence cost?
It depends on scope: the number of jurisdictions, how deep the ownership chain runs, the languages involved, and whether operational verification is needed. A domestic file with a clean structure is a different exercise from a multi-jurisdictional structure with a high risk customer and nominee layers. We scope the file after understanding the structure. Contact us to evaluate your case and we will tell you what it requires.
Do you have a counterparty your standard checks could not explain?
Compliance Officers runs the verification end to end: zero paperwork for you, zero errors, zero unnecessary delays.
Phone and WhatsApp: +1 305 647 3000
