FCA CDD review shows policies fail when execution lags

At a glance

What this is: The FCA’s multi-firm review found that customer due diligence failures were often about poor execution, weak documentation and missing oversight rather than absent policies.

Why it matters: For identity and AML practitioners, the finding shows that customer risk decisions only hold up when verification, review triggers and approval paths are operationally testable.

Context

Customer due diligence only works when the written control matches the actual casework. The FCA’s review shows a familiar governance gap in AML and identity verification programmes: firms can have policies, but still fail to evidence how they decide, review and escalate customer risk in practice.

The article also highlights the identity-side boundary that matters for practitioners. When firms rely too narrowly on standard documents or generic review steps, they create both inclusion gaps and assurance gaps, because analysts cannot consistently verify customers, justify decisions or demonstrate that ongoing monitoring is genuinely risk-based.

Key questions

Q: What breaks when customer due diligence is too weak in non face to face business relationships?

A: Weak due diligence creates gaps in identity assurance, recordkeeping, and fraud detection. Organisations can end up onboarding bad actors, missing beneficial ownership or source of funds risks, and failing to spot inconsistencies across documents and data sources. In practice, that leads to higher AML exposure, more false trust in the customer record, and greater difficulty defending decisions to regulators.

Q: Why do trigger-based reviews matter in ongoing customer monitoring?

A: Because customer risk changes outside the calendar. A new director, ownership change or name change can be more material than a periodic review date, so programmes that ignore triggers either miss important change or duplicate work. Trigger-based monitoring keeps the review lifecycle aligned to the actual customer relationship.

Q: What are the most common failure signals in EDD documentation?

A: The biggest signal is when analysts can describe why they escalated a case but cannot prove it in the file. Missing rationale, missing evidence of what was checked, and unclear approval records all indicate that EDD is being performed informally. If the file cannot stand alone, the control is not defensible.

Q: How should firms govern senior manager approvals for high-risk customers?

A: They should define who can approve which risk tier, document that delegation, and quality-assure it with sample testing. The practical goal is to reserve senior escalation for the cases that truly require it while keeping lower-tier decisions consistent, reviewable and attributable to the right authority.

Technical breakdown

Where CDD ends and EDD begins

Customer due diligence and enhanced due diligence are not interchangeable labels. CDD establishes baseline identity confidence, while EDD is supposed to respond to elevated risk factors such as complex ownership, PEP exposure or unusual transaction patterns. If firms do not define the handoff clearly, analysts improvise, cases become inconsistent, and supervisors cannot see that the higher-risk path is materially different from the baseline path.

Practical implication: document the decision boundary between CDD and EDD so analysts apply the right workflow every time.

Trigger-based monitoring versus periodic review

Ongoing monitoring is not just a calendar task. Effective programmes combine scheduled reviews with event-driven triggers such as director changes, ownership changes, industry-code updates and name changes. The technical problem is lifecycle management: if a trigger review already covered the relevant change, the periodic cycle should be reset or suppressed rather than duplicated, otherwise teams either overwork low-risk files or miss meaningful change.

Practical implication: design monitoring logic that links trigger events to the review record and due-date calculation.

Why documentation and delegation controls matter

EDD and senior approval controls fail when the decision exists only in the analyst’s head. A proper case record needs the rationale, the evidence used, who approved the decision and whether the approver had authority for that risk tier. This is especially important in high-volume environments, where delegation hierarchies and quality checks replace ad hoc manager involvement and prevent approval bottlenecks from becoming control failures.

Practical implication: embed approval authority, rationale capture and second-line review into the case management workflow.

NHI Mgmt Group analysis

CDD governance fails when control intent is separated from casework reality. The FCA review shows that policy quality is not the same as control effectiveness. Firms that cannot evidence how CDD, EDD and monitoring actually operate have a governance problem, not a drafting problem. For identity and AML programmes, the operational truth is what matters: if the file does not prove the decision, the control did not really happen.

Trigger-led monitoring is the missing lifecycle discipline in many programmes. The review makes clear that ongoing monitoring must respond to change events, not just review dates. That is an identity governance issue as much as an AML one, because customer risk is dynamic and the control must follow the change. Practitioners should treat trigger handling as a lifecycle control, not a queue management convenience.

Delegation of authority is a control, not an admin detail. The FCA’s concern about unclear senior approvals points to a common failure mode: firms assume high-risk judgment can be scaled informally. It cannot. A documented approval hierarchy, with quality assurance over the delegated path, is what keeps risk thresholds consistent and auditable.

Version control is a hidden assurance dependency in regulated identity programmes. If the policy record no longer matches how analysts work, the organisation loses its ability to defend decisions under scrutiny. That is especially true where non-standard identity evidence, enhanced due diligence and senior approvals all rely on human judgment. Practitioners should treat document governance as part of the control set, not as a back-office chore.

Specialist identity verification frameworks matter when standard documents are insufficient. The article’s inclusion point for non-standard documentation shows that financial inclusion and assurance need to be balanced deliberately. That pushes firms toward governed alternative verification paths, not informal exceptions. The lesson for practitioners is to make the alternative route explicit, testable and supervised.

What this signals

Identity verification and AML governance now depend on file-level evidence, not policy statements. For practitioners, the important shift is from saying a control exists to proving that it was applied in the right case, at the right time and by the right authority. That means monitoring the quality of the case record as closely as the quality of the underlying decision.

Alternative verification paths need to be designed, not improvised. When standard identity documents are unavailable, firms need a governed route for non-standard evidence that is clear enough for analysts and auditable enough for supervisors. Otherwise inclusion goals and compliance goals start working against each other.

Version control is becoming a frontline assurance issue in regulated identity programmes. If the policy says one thing and the queue does another, the organisation loses both consistency and defence. Practitioners should watch for drift between documented process, analyst behaviour and approval thresholds.

For practitioners

• Define the CDD-to-EDD decision boundary Write explicit criteria for when baseline customer due diligence ends and enhanced due diligence begins, then test those criteria against real cases so analysts do not improvise the escalation path.
• Operationalise trigger-based reviews Link ownership changes, director changes, name changes and similar events to the case workflow so a triggered review updates the record, resets due dates where appropriate and leaves a clear audit trail.
• Capture EDD rationale in the case record Require analysts to record the risk factor, the evidence reviewed, the decision made and the approver before a file can close, rather than relying on memory or email.
• Document delegated approval thresholds Set out which customer types or risk bands require MLRO, senior manager or delegated approval, then quality-assure that hierarchy with sampled file checks.
• Test policy version control against live practice Review whether the current policy version matches what analysts actually do, and confirm staff have read the latest version before the next audit cycle.

Key takeaways

• The FCA’s review shows that customer due diligence often fails because firms cannot execute or evidence their own controls consistently.
• Trigger-based monitoring, tailored EDD and documented delegation are the controls that separate a usable AML programme from a paper one.
• Identity verification and AML teams should treat case records, approval hierarchies and policy version control as part of the control environment.

Key terms

• Customer Due Diligence: Customer due diligence is the process of verifying a customer’s identity and understanding the risk attached to that relationship. Wallet-based presentations can streamline it, but the institution remains accountable for deciding which attributes are trusted and how exceptions are handled.
• Enhanced Due Diligence: Enhanced due diligence is the higher-intensity review applied when a customer or related party presents elevated risk. It usually means deeper source-of-funds checks, closer monitoring, stronger approval requirements, and clearer evidence retention so the institution can justify why the relationship is acceptable.
• Trigger-Based Monitoring: Trigger-based monitoring is an event-driven review model that responds to material changes in a customer’s profile, such as ownership, control or classification updates. It complements periodic review by making sure the monitoring cycle follows the customer’s actual risk state rather than only the calendar.
• Delegation authority: Delegation authority is the right for one identity to act on behalf of another within a defined scope. For agents, it must be explicit, time-bound, and auditable because the system may initiate actions independently once granted access.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect identity governance discipline to real-world control design and assurance.