Anti-money laundering compliance sorts every customer into one of three AML due diligence tiers: simplified for the lowest-risk relationships, standard as the baseline for most accounts, and enhanced for high-risk clients like foreign officials or correspondent banks. The framework comes from Financial Action Task Force Recommendation 10, which tells countries to allow reduced verification when money-laundering risk is lower, require a baseline for ordinary relationships, and mandate deeper scrutiny when risk is elevated.1FATF. The FATF Recommendations In the United States, the Bank Secrecy Act and its implementing regulations turn those tiers into concrete obligations that financial institutions enforce every day.
The institution itself decides which tier a customer belongs in. U.S. regulators expect each bank to build its own risk assessment by examining its products, customer base, geographic exposure, and transaction volume.2FFIEC Bank Secrecy Act/Anti-Money Laundering InfoBase. BSA/AML Risk Assessment There are no mandated categories. A community bank with mostly local depositors has a very different risk profile than an international wire-transfer platform, and examiners review whether the resulting judgments make sense rather than looking for a fixed checklist.
The Identification Floor Every Customer Meets
Before any tier assignment happens, every customer passes through the Customer Identification Program. Federal regulations at 31 CFR 1020.220 require banks to collect, at minimum, the customer’s full legal name, date of birth (for individuals), a residential or business street address, and an identification number (a taxpayer identification number for U.S. persons, or a passport number, alien ID number, or equivalent government-issued document number for non-U.S. persons).3eCFR. 31 CFR 1020.220 – Customer Identification Program
The institution then verifies that information using documents like a driver’s license or passport, non-documentary methods like a credit bureau check, or a combination. For business entities, verification typically relies on articles of incorporation, partnership agreements, or similar formation documents. CIP is the floor. Every tier builds on top of it.
Simplified Due Diligence
When the risk of money laundering is genuinely low, institutions can scale back how deeply they investigate. Simplified due diligence is not a free pass to skip verification. It means reducing the frequency of identity updates, inferring the purpose of the account from the type of relationship rather than asking detailed questions, and pulling back on ongoing transaction monitoring.1FATF. The FATF Recommendations
Customers who typically qualify include publicly traded companies already subject to strict disclosure rules, government agencies, and entities based in jurisdictions with strong AML enforcement. For a publicly listed company, confirming its stock exchange listing and checking a recent annual report may be enough. There is no need to trace every shareholder or request personal identification from board members when the entity already files audited financials with a securities regulator.
The important constraint: simplified measures are never acceptable when there is any suspicion of money laundering or terrorist financing. If anything looks off during onboarding, the institution must escalate to standard or enhanced procedures regardless of how low-risk the customer category looks on paper.
Standard Customer Due Diligence
Most banking relationships fall here. Standard CDD goes beyond basic identification to answer a harder question: who actually controls the money? For individual accounts, that means documenting the expected purpose of the account, the anticipated types of transactions, and the customer’s source of income. For legal entities, the analysis gets more involved.
Beneficial Ownership
Under 31 CFR 1010.230, banks must identify every individual who directly or indirectly owns 25% or more of a legal entity customer’s equity. The regulation also requires identifying one individual with significant management responsibility, such as a CEO, managing member, or general partner.4eCFR. 31 CFR 1010.230 – Beneficial Ownership Requirements for Legal Entity Customers Compliance teams verify these individuals using government-issued photo ID and, where needed, public databases or credit bureaus. The point is to keep criminals from hiding behind shell companies. If a customer refuses to provide beneficial ownership information, the bank must deny the account or close an existing one. The 25% ownership threshold remains in effect as of early 2026.
A Boundary: The Corporate Transparency Act
Readers sometimes confuse the bank’s beneficial ownership obligation with the Corporate Transparency Act’s filing requirement, and the two are separate. As of March 2025, all U.S.-formed entities are exempt from the FinCEN reporting requirement under the CTA; only foreign entities registered to do business in the United States must now file.5FinCEN. Beneficial Ownership Information Reporting The bank-side CDD rule under 31 CFR 1010.230 is unaffected. Banks still collect beneficial ownership data from customers at account opening regardless of what the company itself files with FinCEN.
Enhanced Due Diligence
When a customer relationship poses elevated risk, standard procedures are not enough. Enhanced due diligence demands deeper investigation, more documentation, senior management approval, and closer ongoing scrutiny. Two categories reliably trigger EDD: politically exposed persons and cross-border correspondent banking.
Politically Exposed Persons
Foreign government officials, their immediate family members, and close associates carry an inherent corruption risk. The FATF framework requires institutions to determine whether a customer or beneficial owner holds a prominent public function, identify the source of their wealth, and obtain senior management approval before establishing the relationship.1FATF. The FATF Recommendations In practice, compliance teams run the customer through PEP databases, review adverse media coverage, and document a clear picture of how the individual accumulated their wealth.
Correspondent Banking
When a U.S. bank maintains an account for a foreign bank, it is effectively giving that foreign institution access to the U.S. financial system. Federal law requires specific enhanced due diligence for these relationships, including identifying the foreign bank’s owners (if it is not publicly traded), conducting heightened scrutiny of transactions through the account, and determining whether the foreign bank itself provides correspondent services to other foreign banks.6Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority Foreign banks operating under offshore licenses or in countries flagged for weak AML controls receive the most intense scrutiny.
Source of Wealth Versus Source of Funds
EDD requires institutions to investigate both, and they are not the same thing. Source of wealth is the big picture: how did this person accumulate their net worth? Answering that question might require reviewing tax returns, inheritance records, or investment account histories. Source of funds is transaction-specific: where did the money for this particular deposit or transfer come from? That answer might be a property sale, business dividends, or the liquidation of an investment. The documentation burden at this tier is substantial, and the institution needs a paper trail that makes sense end to end.
How a Customer Moves Between Tiers
The initial tier assignment is a snapshot. Customer behavior shifts over time in ways that reveal risks invisible at account opening, so due diligence does not end at onboarding. Automated transaction monitoring compares each customer’s activity against their established profile, flagging deviations like unexplained spikes in volume, rapid movement of funds through the account, or patterns inconsistent with the stated business purpose.
Periodic file reviews happen on a schedule tied to risk. Low-risk accounts might be reviewed every few years, while high-risk accounts go through re-certification annually or more often. When monitoring identifies a risk the institution missed initially, the customer’s tier assignment should change to reflect the new reality. A simplified customer whose transactions start to look nothing like a public company’s treasury operations moves to standard. A standard customer whose beneficial owner turns out to be a foreign official moves to enhanced.
Sanctions screening runs alongside the tier framework rather than inside it. Every financial institution must screen customers against the Office of Foreign Assets Control’s Specially Designated Nationals list at onboarding and re-screen whenever OFAC updates the list, which happens without a fixed schedule.7FFIEC Bank Secrecy Act/Anti-Money Laundering InfoBase. Office of Foreign Assets Control8Office of Foreign Assets Control. Frequently Asked Questions A hit on the SDN list is not a tier question; the relationship is blocked or restricted regardless of what tier the customer previously occupied.
Choosing the Right Tier
Three questions drive the tier decision at onboarding and at every subsequent review.
First, what kind of customer is this? A publicly traded company, a government agency, or an entity in a strongly regulated jurisdiction points toward simplified. A private operating business with ordinary banking needs points toward standard. A foreign official, a correspondent bank, or an entity with ownership obscured through multiple layers points toward enhanced.
Second, what does the institution’s own risk assessment say about this type of relationship? The same customer profile can land in different tiers at different institutions depending on the products offered, geographic exposure, and overall risk appetite. A customer who is routine for a global correspondent bank may be an outlier for a community lender.
Third, is there anything about this specific relationship that overrides the category? Suspicion of money laundering disqualifies a customer from simplified treatment no matter how clean the category looks. A politically exposed person pulls the relationship into enhanced regardless of the account size. The tier framework is a starting point, not a verdict, and the facts of the particular relationship always control.