TL;DR: Customer due diligence under the Money Laundering Regulations 2017 requires firms to identify, verify and monitor customers, then apply simplified, standard or enhanced checks based on risk, according to OneID. The core problem is not the rule itself but getting the tier right fast enough to avoid either onboarding drag or regulatory exposure.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on OneID's blog post: Customer due diligence is a risk-based onboarding and monitoring control that fails when firms over-check low-risk customers or under-check higher-risk ones.
Why it matters: IAM and identity leaders can use this framing to separate identity proofing from broader due diligence, and to design onboarding flows that adapt to customer risk without weakening regulatory control.
Context
Customer due diligence is a regulated identity control, not a single verification step. It combines identification, verification from an independent reliable source, relationship understanding and ongoing monitoring, all of which have to track the customer's risk profile.
The governance gap appears when firms treat every case the same. Low-risk customers experience avoidable friction, while higher-risk customers can pass through with insufficient scrutiny, which turns onboarding design into a compliance and revenue issue rather than a purely operational one.
Key questions
A: Simplified due diligence is appropriate only when preliminary screening shows a genuinely low money laundering risk. Institutions should base the decision on customer type, product, payment channel, jurisdiction, transaction size, and regulatory context, then document the rationale. If later information changes the risk picture, the customer should move to standard or enhanced due diligence without delay.
Q: Why do reliable identity checks not replace customer due diligence?
A: Because CDD covers more than proving identity. A reliable-source match answers who the customer is, but CDD also requires understanding the relationship, verifying beneficial ownership where relevant, and monitoring the account over time. Identity proofing supports CDD, but it does not complete the legal duty on its own.
Q: What breaks when ongoing monitoring is treated as optional?
A: The firm loses sight of changes that make a once-acceptable customer relationship higher risk. Without monitoring, transaction patterns, ownership changes and documentation issues can move unnoticed, which means the original due diligence tier becomes outdated and the compliance position weakens.
Q: What is the difference between customer due diligence and know your customer?
A: Know your customer is the identity and customer-knowledge component. Customer due diligence is the broader legal obligation that contains verification, relationship understanding and ongoing monitoring. KYC sits inside CDD, so a useful identity check does not by itself satisfy the wider AML requirement.
Technical breakdown
How risk-based customer due diligence is tiered
Customer due diligence is not one control but a set of measures adjusted to risk. Simplified due diligence lowers the extent, timing or type of checks where the relationship is genuinely low risk, standard CDD is the default baseline, and enhanced due diligence adds scrutiny when risk is higher. The important mechanism is that the tier decision is itself a governance decision, because it changes what evidence must exist before the relationship can proceed. If the organisation cannot classify risk quickly, it either over-applies friction or under-applies scrutiny. See the IAM and IGA Basics.
Practical implication: build onboarding logic that routes customers to the right tier before verification work starts.
Why reliable-source verification is only one part of CDD
The identity step in CDD is to verify the customer from a reliable source independent of them. That sounds narrow, but it is only one component of the wider duty. The same control set also covers the purpose of the relationship, beneficial ownership where relevant, and ongoing monitoring after onboarding. A strong electronic match can answer who the customer is, but it cannot by itself prove the relationship is low risk or that the account remains consistent over time. That is why CDD is a lifecycle control, not just an onboarding check. See the NHI Lifecycle Management Guide.
Practical implication: separate identity verification evidence from the monitoring and risk-assessment evidence that must continue after account creation.
How ongoing monitoring changes the meaning of onboarding
Ongoing monitoring means the firm keeps scrutinising transactions and refreshes identity information as the relationship changes. This matters because CDD is not discharged at signup. A customer who was low risk at enrolment can move into a different risk state through behaviour, geography, ownership or transaction pattern. The control therefore depends on record quality and periodic review, not on one-time capture. In practice, onboarding is only the first checkpoint in a longer governance chain. See the Joiner-Mover-Leaver (JML) Guide.
Practical implication: tie onboarding outcomes to periodic review triggers so the original risk decision does not go stale.
Threat narrative
Attacker objective: The objective is to move through onboarding with a level of scrutiny that is lower than the risk requires, or to cause the firm to over-control low-risk customers and lose business.
- Entry occurs when a regulated firm accepts a customer relationship before it has correctly established the appropriate due diligence tier.
- Escalation follows when the firm applies simplified checks to a customer whose risk profile actually requires standard or enhanced CDD.
- Impact appears as regulatory exposure, weak monitoring, or avoidable onboarding friction that either misses risk or drives customers away.
Breaches seen in the wild
- Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Risk tiering is the real control, not the identity check alone: CDD succeeds or fails on whether the firm classifies the relationship correctly before deciding which evidence standard to apply. A good identity match does not repair a wrong risk tier, and a cautious tier does not excuse poor verification. The practitioner conclusion is that tiering logic belongs in governance design, not in an after-the-fact review.
CDD is a lifecycle control disguised as onboarding: The article is clear that monitoring continues after initial verification, which means CDD cannot be treated as a front-door event. That makes the control closer to identity lifecycle management than to a one-time KYC gate. The practitioner conclusion is that review triggers, evidence freshness and escalation paths matter as much as the initial match.
The commercial trade-off is structural, not cosmetic: Over-checking low-risk customers slows conversion and raises cost, while under-checking higher-risk customers shifts the organisation into regulatory exposure. That tension is why customer due diligence is one of the few identity controls that directly changes both compliance posture and revenue performance. The practitioner conclusion is that onboarding design has to optimise for risk accuracy, not just completion speed.
Identity proofing is necessary but not sufficient for AML governance: A reliable-source match answers one question, but CDD also requires relationship purpose, beneficial ownership assessment and ongoing monitoring. The source's example of multi-source matching shows why a narrow proofing control can improve coverage without replacing the wider governance stack. The practitioner conclusion is to keep proofing, screening and monitoring as distinct control layers.
What this signals
CDD programmes fail when teams confuse evidence quality with control completeness: a multi-source identity match can strengthen the front end of onboarding, but the governance outcome still depends on screening, purpose-of-relationship analysis and event-driven review. The practical signal is that firms should design CDD as an operating model, not as a single verification tool.
The next maturity step is conditional onboarding: firms should move away from static checklists and toward tiered decisions that change what evidence is collected, when it is collected, and how often it is refreshed. That is the difference between a compliance formality and a living risk control.
For practitioners
- Separate risk tiering from verification workflow Define clear decision rules for simplified, standard and enhanced due diligence before identity capture begins, so the onboarding path reflects actual risk rather than default friction.
- Treat identity verification as one CDD control, not the whole control set Keep relationship purpose, beneficial ownership, sanctions and ongoing monitoring outside the proofing step so the firm does not mistake a match result for full compliance.
- Set review triggers for post-onboarding change Reassess customers when transaction patterns, geography, ownership or documentation risk changes, because the original CDD tier can become stale quickly.
- Measure onboarding loss against false low-risk classification Track both customer drop-off and cases where later review forces escalation, because a healthy CDD programme reduces friction without suppressing necessary scrutiny.
Key takeaways
- Customer due diligence is a tiered identity-and-monitoring control, and the wrong tier creates either friction or regulatory exposure.
- The source shows that identity verification is only one part of the duty, because ongoing monitoring and relationship context remain mandatory.
- Practitioners should design onboarding so evidence collection, risk tiering and review triggers stay linked across the customer lifecycle.
Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · IAM and IGA Basics · Joiner-Mover-Leaver (JML) Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | CDD relies on independent-source identity verification, which maps directly to enrollment assurance. |
| Recommendation — Align customer verification to SP 800-63A when the control objective is identity proofing from reliable sources. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | CDD tiering determines who should receive access and under what assurance level. |
| ID.RA-01 — Asset vulnerabilities are identified and documented | CDD risk tiering depends on identifying relationship and customer risk factors before onboarding. | |
| Recommendation — Use PR.AA-05 to ensure access decisions follow the verified risk tier and identity evidence available. Document customer-risk factors early so due diligence tiering is based on explicit risk identification. | ||
| NIST Zero Trust (SP 800-207) | Section 2.3 — Continuous Verification | Ongoing monitoring is a continuous verification problem, not a one-time onboarding event. |
| Recommendation — Apply continuous verification so customer risk state stays current after initial enrolment. | ||
Key terms
- Customer Due Diligence: Customer due diligence is the regulated process of identifying, verifying and monitoring a customer throughout the relationship. It is risk-based, so the depth of checking changes with the assessed money laundering or terrorist financing risk, but the obligation to know who the customer is never disappears.
- Simplified Due Diligence: Simplified Due Diligence is the lowest-intensity form of customer due diligence used for customers or transactions assessed as low risk. It allows institutions to reduce some verification and monitoring steps while still meeting AML obligations. The purpose is to preserve compliance while improving speed and operational efficiency.
- Enhanced Due Diligence: Enhanced due diligence is the higher-intensity review applied when a customer or related party presents elevated risk. It usually means deeper source-of-funds checks, closer monitoring, stronger approval requirements, and clearer evidence retention so the institution can justify why the relationship is acceptable.
- Ongoing Monitoring: Ongoing monitoring is the continuous review of identities, systems, and activity to detect risk, misuse, and policy drift after access is granted. In IAM and NHI governance, it tracks behavior, privilege changes, secret use, and anomalous actions so security teams can spot compromise, enforce least privilege, and support timely response.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 27, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org