Enhanced Due Diligence (EDD): Triggers, Documents, and Monitoring

Enhanced due diligence is the deeper investigation a bank runs on customers whose profile, business, or geography raises the risk of money laundering, terrorist financing, or sanctions evasion. Where standard customer due diligence covers basic identity checks for a routine account, enhanced due diligence demands more documentation, more verification, and ongoing monitoring for as long as the account stays open. The Bank Secrecy Act and its implementing rules require banks and other covered institutions to build risk-based programs that catch these higher-risk relationships early and manage them continuously.¹ The goal is a documented, defensible understanding of who you are, where your money came from, and why you need the account.

Who Gets Flagged for Enhanced Review

Not every customer gets this level of scrutiny. It kicks in when something about the customer, the business, or the money raises the probability that the account could be used for illicit purposes.²

Politically Exposed Persons

Politically exposed persons, or PEPs, are individuals entrusted with prominent public functions, including heads of state, senior government officials, military leaders, and executives of state-owned enterprises. The FATF extends the same heightened scrutiny to their family members and close associates, because those relationships are frequently used to move or disguise illicit funds.³ If you are a PEP, or married to one, or in business with one, expect the extra questions.

Ties to High-Risk Countries

The Financial Action Task Force keeps two public lists that drive jurisdictional risk assessment worldwide. The “black list” names countries with such severe anti-money-laundering deficiencies that the FATF calls on all member nations to apply countermeasures; as of February 2026 that list includes North Korea, Iran, and Myanmar. The “grey list” covers jurisdictions under increased monitoring that have committed to resolving strategic deficiencies, and currently includes 22 countries, among them Lebanon, Syria, Venezuela, and Kenya.⁴ Any customer or counterparty with significant ties to a listed jurisdiction will almost certainly face enhanced review, and in the worst cases the bank may decline the relationship outright.

High-Risk Industries and Nonprofits

Certain business types carry inherent vulnerability to money laundering. Money services businesses, gambling operations, cash-intensive retailers, and cryptocurrency-related entities all attract closer attention, and the FFIEC manual specifically identifies money services businesses as a category warranting enhanced procedures.²

Nonprofits are not automatically high-risk, but ones that operate abroad or move money to regions where terrorist organizations are active get treated differently. Federal examiners expect banks to look at where a charity operates, how it distributes funds, and whether it has affiliations with organizations in conflict zones.⁵ A domestic food bank with local donors rarely triggers enhanced review. A humanitarian organization wiring money to South Sudan is a different story.

Suspicious Transaction Patterns

Transaction behavior is often the loudest alarm. Banks must file a Currency Transaction Report for every cash transaction over $10,000, and anyone who breaks up deposits or withdrawals to stay below that threshold is engaging in structuring, which is a federal crime in its own right.⁶ Other red flags include rapid movement of funds through accounts with no apparent business purpose, wire transfers to or from high-risk jurisdictions, and patterns where the stated nature of the account does not match the activity flowing through it. When a bank spots suspected structuring, it must file a Suspicious Activity Report.⁷

A separate recordkeeping rule applies to fund transfers of $3,000 or more. The sending institution must collect identifying information about the originator and pass it to the receiving institution, creating a paper trail law enforcement can follow if the transfer turns out to be suspicious.⁸ So even transfers well below the $10,000 cash reporting threshold generate compliance obligations, and a high-risk customer sending frequent transfers near that $3,000 floor will draw attention.

Documents the Bank Will Ask For

The paperwork required during enhanced review goes far beyond what a typical customer provides when opening a savings account. The bank is trying to build a complete picture of who controls the entity, where the money came from historically, and what specific funds are being used for the transaction at hand.

Beneficial Ownership

Under the federal Customer Due Diligence rule, banks must identify two categories of beneficial owners when a legal entity opens an account. The first is any individual who directly or indirectly owns 25% or more of the entity’s equity interests. The second, called the control prong, is a single individual with significant responsibility to manage or direct the entity, such as a CEO, CFO, or managing member.⁹ The control prong matters most when ownership is spread so widely that no single person crosses the 25% threshold. Even then, the bank still needs to identify at least one natural person who controls the entity. Without the control prong, anyone could hide behind a dispersed ownership structure.¹⁰

Source of Wealth and Source of Funds

These two concepts sound similar but serve different purposes. Source of wealth looks at the big picture: how did you accumulate your total net worth? Banks typically collect several years of tax returns, audited financial statements, and documentation of major financial events like inheritances, business sales, or investment returns. The goal is to confirm your overall financial profile is consistent with legitimate activity.

Source of funds is narrower. It asks where the specific money for a particular transaction or account opening came from. That might mean bank statements from the originating institution, payroll records, dividend statements, or closing documents from a real estate sale. Corporate customers also provide business registry filings to verify legal standing. Banks generally expect these documents to be recent so the information reflects your current position. Incomplete or inconsistent documentation at this stage can delay onboarding significantly or lead the bank to decline the relationship.

How Banks Verify and Score the Information

Collecting documents is only half the job. The compliance team then validates what you provided against independent sources, looking for inconsistencies that might indicate you are not who you claim to be or that the money has a less legitimate origin than the paperwork suggests.

Adverse Media and Database Screening

Adverse media screening searches public records for news reports, court filings, regulatory enforcement actions, and government publications that suggest involvement in criminal conduct, fraud, corruption, or sanctions violations. Credible, risk-relevant reporting from a major outlet is weighed very differently from an anonymous blog post. INTERPOL’s I-Checkit program lets financial institutions screen customer identity documents against its databases of stolen and lost travel documents and Red Notices, adding an international law enforcement layer to the process.¹¹

Risk Scoring and the Decision

Analysts cross-reference your documentation against third-party databases and assign a risk score based on factors like geographic exposure, ownership complexity, the transparency of your financial records, and any adverse media hits. A high score generates a formal report that moves from the analyst to a compliance officer with authority to approve, condition, or reject the relationship. If the institution decides to reject the application, it must document its reasons in internal records to satisfy audits, and those records must be kept for at least five years.¹² You will be told the final decision. You almost never get to see the risk score itself.

For some business customers the process includes on-site visits to confirm the entity has a physical presence and actual operations at its stated address. This is where a lot of shell company schemes fall apart. An analyst who shows up to find an empty office suite or a mail drop has a very different conversation with the compliance officer than one who walks through a working warehouse.

Foreign Correspondent Accounts

Correspondent banking, where a domestic bank maintains an account on behalf of a foreign bank to facilitate cross-border transactions, carries elevated risk because the domestic institution is processing transactions for customers it has never met. Under 31 CFR 1010.610, banks must establish a due diligence program for these accounts that assesses the foreign bank’s own anti-money-laundering controls and monitors transactions flowing through the account for suspicious activity.¹³

For certain higher-risk foreign banks, the regulation requires enhanced procedures. The domestic bank must determine whether the foreign bank maintains correspondent accounts for other foreign banks that use the same account as a gateway into the U.S. financial system, essentially checking for nested layers of access. If the foreign bank’s shares are not publicly traded, the domestic institution must identify every owner holding 10% or more of any class of securities.¹⁴ Section 312 of the USA PATRIOT Act, which the regulation implements, exists to keep foreign banks from using U.S. correspondent accounts as a conduit for laundering money into the domestic financial system.¹⁵

Virtual Assets and Cryptocurrency

Digital assets introduce challenges traditional banking never had to consider. The Treasury Department has identified several risk factors specific to virtual assets that warrant heightened scrutiny. Anonymity-enhancing tools like mixers and tumblers, which pool and redistribute cryptocurrency to obscure its origin, are near-automatic red flags. So are transactions involving privacy-focused cryptocurrencies designed to resist blockchain analysis.¹⁶

Other triggers include customers who use unhosted wallets, where no intermediary holds the private keys; transactions routed through decentralized finance protocols that lack any customer identification process; and chain hopping, where someone converts one cryptocurrency into another before transferring it elsewhere to break the audit trail. Virtual asset service providers operating in jurisdictions with weak or nonexistent AML programs also raise the risk profile, because illicit actors deliberately seek out regulatory gaps.¹⁶ The BSA’s travel rule applies to cryptocurrency transfers as well: in the United States, any transmittal at or above $3,000 requires the sending institution to collect and transmit identifying information about the originator.⁸

Ongoing Monitoring After the Account Opens

Getting through the initial review does not end the process. Federal regulators expect continuous oversight for as long as the high-risk relationship exists, with intensity matching the risk level. Higher-risk accounts typically get reviewed annually or semi-annually, with your file updated to reflect current financial information, ownership changes, and any shifts in business activity.

Real-time or near-real-time monitoring systems screen every transaction against your established profile. A sudden spike in wire transfer volume, a new destination country, or activity that does not match the stated business purpose all generate alerts for manual review. Federal regulators expect banks to periodically test their monitoring thresholds and independently validate that the system is catching suspicious patterns, not just generating noise.¹⁷ Banks using third-party or AI-driven monitoring tools remain ultimately responsible for BSA compliance. They cannot outsource that accountability.

Beyond scheduled periodic reviews, specific events force an immediate reassessment. An adverse media hit during daily screening, a new PEP alert, a Suspicious Activity Report filing, or out-of-pattern transactions all justify pulling the file and running a fresh evaluation. A customer who was medium-risk in January can warrant immediate escalation if a fraud investigation surfaces in March.

Suspicious Activity Reports and the No-Tipping Rule

When monitoring or a review turns up activity that looks like money laundering, fraud, or other criminal conduct, the bank has a legal obligation to file a Suspicious Activity Report. The authority comes from 31 U.S.C. § 5318(g), which empowers the Treasury Secretary to require financial institutions to report suspicious transactions relevant to possible violations of law.¹⁸ The implementing regulation sets the clock: a bank must file within 30 calendar days of first detecting the suspicious activity. If the bank cannot identify a suspect at that point, it gets an additional 30 days, but filing cannot be delayed beyond 60 days from initial detection.¹⁹

Here is where it gets uncomfortable for customers: banks are legally prohibited from telling you a SAR has been filed. The no-tipping rule bars any bank director, officer, employee, or agent from notifying anyone involved in the transaction that it has been reported. The existence of a SAR, or even the fact that no SAR was filed, is confidential. If a bank receives a subpoena for SAR information from anyone other than FinCEN or an authorized law enforcement agency, it must refuse to produce it.²⁰ A customer whose account gets frozen or closed after suspicious activity is flagged may never learn the specific reason.

What Happens If the Bank Says No

If a bank decides the risk is unmanageable, the most common outcome is account closure, sometimes called de-risking. The bank may freeze the account during its investigation, and there is no standardized federal timeline for how long that freeze lasts. Consumer advocacy groups have documented cases where customers lost access to their funds for 60 days or more while a review was pending, with little information about the cause or expected resolution. You might be told only that the institution has decided to end the relationship.

De-risking affects entire categories of customers, not just individuals. Banks that decide a particular business type, such as money services businesses or cannabis-related enterprises, carries too much compliance cost may exit the sector entirely, leaving legitimate businesses scrambling for banking access. The same requirements meant to protect against illicit finance can push legal businesses out of the regulated banking system and into less regulated channels.

How Your Data Is Protected

The volume of sensitive financial and personal information gathered during this process creates its own set of obligations for the bank. Under the Gramm-Leach-Bliley Act, financial institutions must develop and maintain an information security program with administrative, technical, and physical safeguards to protect customer data. They must also notify you about what information they collect, who they share it with, how they protect it, and your right to opt out of certain third-party information sharing.²¹ Enhanced due diligence files may contain tax returns, government identification images, financial statements, and ownership details for multiple individuals, which puts them among the most sensitive records a bank holds. The five-year retention requirement under BSA regulations means that data sits in the institution’s systems long after the account may have closed.¹²

1
Financial Crimes Enforcement Network. Customer Due Diligence (CDD) Final Rule
2
FFIEC BSA/AML Examination Manual. Assessing Compliance with BSA Regulatory Requirements
3
Financial Action Task Force. Guidance on Politically Exposed Persons (Recommendations 12 and 22)
4
Financial Action Task Force. High-Risk and Other Monitored Jurisdictions
5
FFIEC BSA/AML Examination Manual. Risks Associated with Money Laundering and Terrorist Financing – Charities and Nonprofit Organizations
6
FFIEC BSA/AML Examination Manual. Currency Transaction Reporting
7
FFIEC BSA/AML Examination Manual. Appendix G – Structuring
8
eCFR. 31 CFR 1010.410 – Records To Be Made and Retained by Financial Institutions
9
Federal Register. Customer Due Diligence Requirements for Financial Institutions
10
Financial Crimes Enforcement Network. FinCEN Guidance on CDD FAQ
11
INTERPOL. I-Checkit
12
eCFR. 31 CFR 1010.430 – Nature of Records and Retention Period
13
eCFR. 31 CFR 1010.610 – Due Diligence Programs for Correspondent Accounts for Foreign Financial Institutions
14
eCFR. 31 CFR 1010.610 – Due Diligence Programs for Correspondent Accounts for Foreign Financial Institutions
15
FFIEC BSA/AML Examination Manual. Due Diligence Programs for Correspondent Accounts for Foreign Financial Institutions
16
U.S. Department of the Treasury. Action Plan to Address Illicit Financing Risks of Digital Assets
17
Office of the Comptroller of the Currency. Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance
18
Office of the Law Revision Counsel. 31 USC 5318 – Compliance, Exemptions, and Summons Authority
19
eCFR. 31 CFR 1020.320 – Reports by Banks of Suspicious Transactions
20
FFIEC BSA/AML Examination Manual. Suspicious Activity Reporting
21
Federal Trade Commission. Gramm-Leach-Bliley Act