TL;DR: AML is the overarching financial crime framework, KYC is the customer identification process inside it, and CDD is the ongoing information gathering that keeps both effective, according to Daon. Misunderstanding those boundaries can push firms toward the wrong controls, weaken monitoring, and increase exposure to enforcement, reputational damage, and operational inefficiency.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Daon's blog post: AML, KYC and CDD serve different roles in financial crime prevention, and confusing them leads to weaker controls and misdirected compliance investment.
Why it matters: IAM, fraud, and compliance teams need the same clarity when they govern identity verification, ongoing due diligence, and monitoring across human and non-human access paths.
Context
AML, KYC and CDD are often discussed together, but they are not interchangeable control layers. AML is the umbrella legal and operational framework, KYC is the identity verification and risk assessment process inside that framework, and CDD is the ongoing information gathering that keeps the relationship current.
The governance problem is not just terminology. When institutions blur these layers, they tend to overbuild in one place, underinvest in another, and create compliance workflows that satisfy form but miss risk. That matters in financial services because identity verification, transaction monitoring, and customer risk review all depend on the same evidentiary base.
Key questions
A: AML and KYC serve different but connected purposes. AML is the broader control framework for detecting and preventing money laundering and related financial crime. KYC is the customer onboarding and verification process that confirms identity, assesses risk, and supports ongoing monitoring. In practice, institutions need both: KYC establishes who they are dealing with, while AML watches for suspicious behavior and regulatory breaches over time.
Q: What is the difference between customer identification and customer due diligence in AML compliance?
A: Customer identification establishes who the customer is, usually by confirming core identity details and supporting documents. Customer due diligence goes further by assessing risk, understanding the purpose of the relationship, and applying enhanced checks where needed. Identification answers whether the customer is real, while due diligence answers whether the relationship is acceptable and under what conditions.
Q: How do AML programmes use customer risk scoring?
A: AML programmes use customer risk scoring to rank customers by their likelihood of money laundering or sanctions exposure, then apply proportionate controls. Typical inputs include customer type, geography, ownership structure, products used and transaction behaviour. The score drives enhanced due diligence, monitoring thresholds, review frequency and escalation for suspicious activity.
Technical breakdown
AML as the governing framework, not a single control
AML is the broad set of laws, obligations, procedures, and operating practices intended to prevent illicit funds from being placed, layered, and integrated through the financial system. It is not one check at onboarding. It spans monitoring, reporting, training, governance, and escalation, which is why firms that treat AML as only a customer-screening exercise miss the larger control model. The practical consequence is that AML effectiveness depends on the quality of the upstream identity and relationship data that KYC and CDD produce.
Practical implication: Map AML ownership across onboarding, monitoring, investigations, and reporting so the control is run as a programme, not a point solution.
How KYC underpins customer risk decisions
KYC is the structured process of identifying a customer, validating that identity, and assessing the relationship's risk profile before and during the account lifecycle. In practice, KYC provides the baseline against which later behaviour is judged. If the baseline is weak, transaction monitoring and alert review become noisy and less defensible. KYC therefore sits between identity proofing and financial crime monitoring, linking who the customer claims to be with how the institution should treat the relationship. See the Identity Proofing and KYC Guide.
Practical implication: Treat customer identification as a decision input for risk scoring, not as a one-time onboarding formality.
CDD as the ongoing evidence layer
CDD is the continuous collection and analysis of customer information that tests whether the original risk assessment still holds. It includes understanding the purpose of the relationship, reviewing beneficial ownership and source-of-funds signals, and refreshing data when behaviour changes. That is why CDD is more than periodic paperwork. It is the mechanism that keeps KYC current and gives AML monitoring context, especially when higher-risk relationships require enhanced due diligence and tighter review cycles. Read CDD, EDD, PEP and sanctions screening.
Practical implication: Use CDD to refresh customer risk assumptions on a schedule tied to actual behavioural and relationship changes.
Breaches seen in the wild
- Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity governance fails when AML, KYC and CDD are treated as the same control. They sit at different layers of the compliance stack, and each answers a different question: who the customer is, what level of risk the relationship carries, and how the institution detects suspicious movement over time. When those layers collapse into one another, teams either over-collect information at onboarding or under-monitor after activation. The result is not just inefficiency but blind spots in the evidence chain that regulators expect to see.
CDD is the control most organisations understate. KYC creates the initial confidence boundary, but CDD is what keeps that boundary honest when customer behaviour, ownership, geography, or transaction patterns change. Without an explicit ongoing-review model, firms end up relying on stale risk assumptions and cannot justify why a relationship remained low, medium, or high risk. Practitioners should treat CDD as the living record that makes the original KYC decision defensible.
Financial crime programmes fail when technology is deployed before governance is clarified. Automation can improve document checking, analytics, and case handling, but it cannot correct a model that confuses onboarding identity proofing with ongoing due diligence. The strategic issue is allocation: if the control objective is wrong, the platform will simply produce faster wrong decisions. Teams need to align data, workflow, and escalation logic to the actual regulatory function each layer serves.
The strongest programmes separate regulatory language from operating design. AML, KYC and CDD are regulatory concepts, but implementation lives in processes, evidence, and accountability. Institutions that preserve that separation can tune risk-based controls more precisely, assign ownership cleanly, and explain decisions to auditors and regulators without improvising after the fact. The practical test is whether the programme can show which layer failed when a customer file, monitoring alert, or review decision is challenged.
What this signals
Control separation is the real maturity test: mature financial crime programmes can show where identity verification ends, where due diligence begins, and how the monitoring layer consumes both without blending them into one undefined process.
The next pressure point is lifecycle discipline. As customer relationships change faster and data sources multiply, institutions need clearer refresh triggers and stronger evidence lineage so reviewers can explain why a profile stayed current.
Risk-based operations are only credible when the institution can prove that higher-risk relationships receive deeper review than low-risk ones, and that the review logic is visible to both auditors and investigators.
For practitioners
- Clarify the control boundary between AML, KYC and CDD Document which team owns identity verification, which owns risk scoring, and which owns ongoing review so the programme does not collapse distinct obligations into one workflow.
- Separate onboarding evidence from ongoing monitoring evidence Keep identity documents, source-of-funds records, relationship purpose notes, and alert history in distinct evidence sets so reviewers can see what changed and when.
- Tune due diligence by customer risk tier Apply enhanced due diligence, senior review, and more frequent refresh cycles to higher-risk customers instead of forcing one review cadence across the whole book.
- Align transaction monitoring to the KYC baseline Make sure monitoring rules reference the customer profile, expected activity, and jurisdictional risk captured during onboarding and refreshed through the relationship lifecycle.
Key takeaways
- AML, KYC and CDD are related but distinct control layers, and confusing them weakens both compliance design and operational accountability.
- The strongest financial crime programmes use KYC to set the baseline and CDD to keep that baseline current as risk changes over time.
- Institutions should separate ownership, evidence, and review cadence for each layer so they can defend decisions under regulatory scrutiny.
Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · CDD, EDD, PEP and sanctions screening · Fraud and Cyber Convergence Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Customer identity and relationship decisions depend on correct entitlement and risk classification. |
| GV.RM-01 — Risk Management Strategy | AML, KYC and CDD are governed as a risk-based compliance programme. | |
| PR.DS-01 — Data-at-Rest Managed | CDD relies on accurate, retained customer evidence and review records. | |
| Recommendation — Align access and approval decisions to verified customer risk and entitlement evidence. Define risk appetite and governance so AML, KYC and CDD are applied consistently by risk tier. Protect customer evidence and due diligence records so reviewers can trust the underlying data. | ||
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | KYC begins with identity proofing, which maps to enrollment and proofing guidance. |
| Recommendation — Use enrollment and identity proofing controls to validate customer identity before account activation. | ||
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | Customer onboarding depends on authenticating external users and establishing identity assurance. |
| Recommendation — Apply external-user identity assurance controls before permitting customer account creation. | ||
Key terms
- Anti-Money Laundering: Anti-Money Laundering is the set of controls used to detect and prevent financial crime by identifying suspicious activity and prohibited parties. In practice it depends on reliable identity data, screening quality and governance over how decisions are made and reviewed.
- Know Your Customer (KYC): KYC is the process of verifying a customer’s identity and assessing whether the relationship is acceptable to the business. In AML/CFT programmes, it includes identity evidence, risk checks, and ongoing review, not just a one-time signup step.
- Customer Due Diligence: Customer due diligence is the process of verifying a customer’s identity and understanding the risk attached to that relationship. Wallet-based presentations can streamline it, but the institution remains accountable for deciding which attributes are trusted and how exceptions are handled.
- Enhanced Due Diligence: Enhanced due diligence is the higher-intensity review applied when a customer or related party presents elevated risk. It usually means deeper source-of-funds checks, closer monitoring, stronger approval requirements, and clearer evidence retention so the institution can justify why the relationship is acceptable.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org