Most financial crime controls fail not because a firm skipped due diligence, but because it ran the same light checks on everyone, screened names against lists it did not understand, and drowned its analysts in false positives. Customer due diligence (CDD), enhanced due diligence (EDD), politically exposed person (PEP) checks and sanctions screening are separate controls with different legal bases. This guide explains who has to be checked, when each control applies, how beneficial ownership and the sanctions ownership rules work in the UK, US and EU, and how to run screening with fuzzy matching that is tuned rather than guessed. It is for compliance engineers, financial crime teams and identity practitioners who build onboarding. It goes deeper than the Identity Proofing and KYC Guide, which covers verifying that a person is who they claim to be.
Key takeaways
- CDD is more than ID checks. UK, US and EU rules all require you to understand the beneficial owners, the purpose of the relationship and to keep monitoring it, not just to verify a document at sign-up.
- EDD has defined triggers. In the UK, regulation 33 of the Money Laundering Regulations 2017 lists them: high assessed risk, high-risk third countries, correspondent relationships, PEPs, false documents and unusual transactions.
- PEP status is a risk factor, not a verdict. PEPs need senior management approval, source of wealth and source of funds checks, and enhanced monitoring, but UK rules start domestic PEPs at a lower risk than foreign ones.
- The ownership rules differ by regime. OFAC blocks entities 50 percent or more owned in aggregate by blocked persons; UK OFSI uses a "more than 50 percent" or control test and does not simply aggregate separate holdings.
- Thresholds are your decision and your evidence. OFAC states it does not recommend a match score; the regulator expects you to set it from your own risk assessment, document why, and test it.
Four controls, four questions
| Control | Question it answers | When it runs | Typical evidence |
|---|---|---|---|
| Customer due diligence (CDD) | Who is the customer, who owns or controls it, and what is the relationship for? | Before the relationship or occasional transaction, then ongoing | Verified identity, entity registration data, ownership chart, stated purpose, risk rating |
| Enhanced due diligence (EDD) | Why is this higher risk, and is the risk acceptable? | When a defined trigger or high risk rating applies | Additional independent sources, source of funds and wealth, senior approval, tighter monitoring plan |
| PEP screening | Does this person hold or recently hold a prominent public function, or are they a relative or close associate of someone who does? | Onboarding, periodic review, and whenever PEP data changes | Screening result, PEP category, approval record, wealth and funds evidence |
| Sanctions screening | Is this party, or anyone owning or controlling it, a designated person, or is the transaction prohibited? | Onboarding, every list update, and in real time for payments | Match result, disposition rationale, list version, freeze and report records |
The legal consequence is the key difference. CDD, EDD and PEP measures are risk-based: you can justify a proportionate approach to your supervisor. Sanctions are prohibitions: OFSI guidance says assets must be frozen immediately where you know or have reasonable cause to suspect a designated person is involved, and that test is objective.
Customer due diligence: what the rules actually require
The UK Money Laundering Regulations 2017 (MLRs) give the clearest checklist. Regulation 28 requires a relevant person to:
- Identify and verify the customer: using documents or information from a reliable and independent source (28(2) and 28(18)).
- Understand the purpose: assess and, where appropriate, obtain information on the purpose and intended nature of the business relationship or occasional transaction (28(2)(c)).
- Know the entity: for a body corporate, obtain and verify its name, registration number and registered office, and take reasonable measures to understand its constitution, directors and ownership and control structure (28(3) and 28(3A)).
- Find the beneficial owner: identify the beneficial owner and take reasonable measures to verify their identity (28(4)). Information on a public register alone does not satisfy this (28(9)).
- Check who is acting: where someone purports to act on behalf of the customer, verify they are authorised and verify their identity (28(10)).
- Keep monitoring: conduct ongoing monitoring, including scrutiny of transactions and source of funds where necessary, and keep documents and information up to date (28(11)).
Beneficial ownership thresholds compared
| Regime | Ownership test | Control test | Notes for implementers |
|---|---|---|---|
| United States: FinCEN CDD rule, 31 CFR 1010.230 | Each individual owning 25 percent or more of equity interests, directly or indirectly (up to four people) | One individual with significant responsibility to control, manage or direct the entity, such as a CEO, CFO or managing member | Applies when a new account is opened; identification may use the Appendix A certification form; verification is risk-based using at least the CIP elements; records kept five years |
| United Kingdom: MLRs 2017 | Regulation 5(1): an individual who ultimately owns or controls, directly or indirectly, more than 25% of the shares or voting rights (listed companies excluded) | An individual who exercises ultimate control over management or otherwise controls the body corporate (reg 5(1) and 5(2)); if no beneficial owner can be found after exhausting all means, the senior managing official may be treated as such, with records of the steps taken (28(6) to 28(8)) | Register data alone does not satisfy verification (28(9)) |
| European Union: AML Regulation (EU) 2024/1624 | Recital 107: an ownership of 25 percent or more of shares or voting rights; recital 108 applies the same to indirect ownership | Control through other means is also covered in the operative text | Recital 54: central registers should not be the primary source for verification. EUR-Lex shows 10 July 2027 for this regulation; confirm the application date of each provision against the Official Journal text |
US firms may rely on the customer's beneficial ownership information unless they know of facts that reasonably call it into question, so your onboarding flow needs a place to record and act on contradictions. All three regimes look through layers, so store an ownership graph, not a single "UBO" field. See the KYB Guide for business verification sources and document checks.
Enhanced due diligence: triggers and measures
MLRs regulation 33(1) requires EDD and enhanced ongoing monitoring in these cases:
| Trigger (MLRs 33(1)) | Practical detection point | Measures to add |
|---|---|---|
| (a) High risk identified by the firm's risk assessment or supervisor information | Customer risk score above the EDD threshold | Additional independent verification sources; deeper understanding of background and ownership (33(5)) |
| (b) Relationship or transaction with a person established in a high-risk third country | Country of incorporation, residence or counterparty matches the FATF high-risk jurisdictions subject to a call for action | Mandatory set in 33(3A): extra customer and beneficial owner information, source of funds and wealth, reasons for transactions, senior management approval, enhanced monitoring |
| (c) Correspondent relationship with a credit or financial institution | Product type is correspondent banking | The regulation 34 measures |
| (d) PEP, family member or known close associate | PEP screening match confirmed | Regulation 35 measures (see next section) |
| (e) False or stolen identification documents, and the firm proposes to continue | Document fraud signal from proofing | Decide whether to continue at all; if so, full EDD and a recorded decision |
| (f) Unusually complex or large transaction, unusual pattern, or no apparent economic or legal purpose | Transaction monitoring alert | Examine background and purpose as far as reasonably possible and increase monitoring (33(4)) |
| (g) Any other case presenting a higher risk by its nature | Analyst referral, adverse media | Case-specific measures from 33(5) |
The wording of 33(1)(b) and 33(3)(a) was substituted on 30 June 2026 by SI 2026/621, and legislation.gov.uk lists further changes from that instrument (a new regulation 34A) as not yet applied to the published text when checked on 30 October 2026.
Source of funds vs source of wealth: source of funds is where the money for this relationship or transaction comes from; source of wealth is how the customer built their overall net worth.
PEPs: who counts and what to do
FATF Recommendation 12 and its PEP guidance cover foreign, domestic and international organisation PEPs, plus their family members and close associates. The UK implementation in MLRs regulation 35 is specific:
- Definition: an individual entrusted with prominent public functions, other than as a middle-ranking or more junior official (35(12)). Paragraph 14 lists examples such as ministers and senior judges.
- Family and associates: family members include a spouse or civil partner, children and their spouses or partners, and parents. Known close associates include people with joint beneficial ownership of an entity with a PEP or other close business relations.
- Required measures: senior management approval to establish or continue the relationship, adequate measures to establish source of wealth and source of funds, and enhanced ongoing monitoring (35(5)).
- Domestic PEPs: since 10 January 2024 (SI 2023/1371), the starting point for a UK domestic PEP is a lower level of risk than a non-domestic PEP, unless other risk factors are present.
- After leaving office: the measures continue for at least 12 months after the person stops holding the function, longer if the firm judges the risk requires it (35(9)). For family members and associates they end when the PEP leaves office (35(11)).
The EU AMLR follows the same pattern: recital 94 expects risk from former PEPs to be addressed for not less than 12 months after they cease to hold the function.
Data sources: FATF notes that commercial PEP databases can help but are not sufficient on their own, and are not required. A hit starts the work: confirm identity, classify the role and record the risk assessment.
Sanctions screening: lists, ownership and obligations
| Element | United States (OFAC) | United Kingdom (OFSI / FCDO) | European Union |
|---|---|---|---|
| Primary list | SDN List, plus non-SDN lists with non-blocking restrictions (FAQ 91); data files in XML and delimited formats (FAQ 19) | UK Sanctions List published by the FCDO; FCDO also keeps a separate Russia list of entities under specific financial and investment restrictions | EU Financial Sanctions Files (the consolidated list), maintained by the Commission's DG FISMA from acts published in the Official Journal |
| Ownership rule | 50 Percent Rule: entities owned 50 percent or more, directly or indirectly, in aggregate by blocked persons are blocked, even across different programmes (FAQs 398 to 401); the rule covers ownership, not control (FAQ 398) | Owned or controlled if a designated person holds more than 50 percent of shares or voting rights, can appoint or remove a majority of the board, or can be expected to ensure the entity's affairs follow their wishes; separate holdings are not simply aggregated without a joint arrangement or control (s.4.1) | AMLR recital 37 points obliged entities to the Council's guidelines on restrictive measures and related best practices when assessing ownership or control by designated persons; check the regime's legal act |
| Who must comply | All US persons wherever located, including foreign branches of US entities; some programmes reach foreign subsidiaries (FAQ 11) | Persons and firms subject to UK financial sanctions; see OFSI general guidance for scope | Member states implement and enforce; national competent authorities investigate breaches and set penalties |
| On a true match | Block (freeze) property and report to OFAC within 10 business days (FAQ 9) | Freeze immediately, do not deal, report to OFSI as soon as practicable; a SAR does not satisfy the sanctions reporting duty (s.5.9) | Freeze and report to the national competent authority |
| Safe harbour list | OFAC does not publish a safe list or issue non-inclusion certificates (FAQ 469) | Not applicable | Not applicable |
A sanctioned person can be located anywhere (OFAC FAQ 10), so country filters do not replace name screening. See the Ransomware Payments and Sanctions Guide for the incident case.
What to screen
- Customers: the customer, every beneficial owner, directors and authorised signatories, at onboarding and again against every list change (delta screening) and full rescreening when your matching logic changes.
- Payments: originator, beneficiary, intermediary banks, free-text payment details and, for trade, vessels, ports and goods, in real time before release.
Fuzzy matching and false positives
OFAC's own Sanctions List Search shows how a typical engine works: fuzzy logic applies only to the name field and combines character, string and phonetic matching; candidates are filtered on the first letter and at least 50 percent edit-distance similarity, then scored with Jaro-Winkler and Soundex, and a score of 100 is an exact match (FAQs 246 to 252). OFAC does not recommend a minimum score and says users should set their own based on their risk assessment. The tool is for individual searches; automated screening should use the data files.
| Tuning lever | Effect on false positives | Risk if mis-set |
|---|---|---|
| Name match threshold | Higher threshold cuts alerts sharply | Missed transliterations and partial names (false negatives) |
| Secondary identifiers (date of birth, nationality, address, registration number) | Auto-discount hits where strong identifiers conflict | Discounting on weak or missing data; list entries often lack full identifiers |
| Name normalisation (case, diacritics, honorifics, legal suffixes) | Removes noise such as "Ltd" or "Mr" matches | Stripping tokens that are part of a listed name |
| Good-guy (allow) lists of cleared customers | Stops the same false hit recurring | Stale clearance after the list entry or customer data changes; must re-trigger on change |
| List scope (which regimes and lists you load) | Fewer irrelevant lists, fewer hits | Missing a list your firm is subject to, or the Russia-specific list in the UK |
Disposition: name match vs target match
OFSI's general guidance gives the logic analysts should follow. A name match is not necessarily the listed person; if you are satisfied it is not, no further action is needed. Where all the listed information matches, a target match is likely. Its examples: a name match with a different age and place of birth is only a name match, while a close name match with a similar date of birth but a different address is a potential target match and OFSI should be contacted immediately. OFAC FAQ 23 gives similar steps: check how close the name is, whether the party is in the same general area as the entry, and contact the OFAC hotline when there are many similarities.
The Wolfsberg Group's Guidance on Sanctions Screening (January 2019) treats alert generation and handling, reference data, list management, transaction screening and lookbacks as core elements of a screening programme.
How to implement or rebuild the programme
- Write the risk assessment first. Document customer, product, channel and geography risk factors and the scores that lead to simplified, standard and enhanced measures.
- Build the data model. Hold parties, roles (owner, director, signatory) and percentage holdings as a graph so that indirect ownership and the 50 percent and 25 percent tests can be computed, not typed in.
- Map triggers to workflows. One workflow per EDD trigger, with evidence, approver and review date.
- Set screening baselines in a test environment. Run the engine against a labelled test set (list entries with transliterations, swapped name order and typos, plus real customers), record recall and alert volume at several thresholds, and choose one with a written rationale.
- Run in parallel before cutting over. Operate old and new screening side by side for a period and investigate every case the new system misses.
- Cut over with a rollback plan. Keep the previous configuration versioned. If recall drops or volumes spike after a change, revert the configuration and rescreen the affected population. OFAC noted after its own January 2021 algorithm change that users should retest their baseline checks (FAQ 892); apply the same rule to your vendor's upgrades.
- Schedule rescreening and reviews. Screen the customer base against every list update, rescreen fully after any matching change, and set periodic CDD review cycles by risk rating, with event-driven reviews for ownership changes and adverse media.
Decision guidance
- Build vs buy screening: most firms buy list data and a matching engine; what cannot be outsourced is the risk assessment, threshold choice and testing evidence. Small firms can have a person review every hit; large payment volumes need auto-discounting rules, which then need their own testing.
- Real-time vs batch: screen payments before release; customer rescreening can run in batch on each list update if the delay is short and measured.
- PEP self-declaration vs database: use both; each catches what the other misses.
Detection and measurement
- Log: every screening run with list version, every alert with score and disposition rationale, configuration changes with approver, and EDD approvals.
- Screening recall on the test set: share of seeded true matches found after each configuration or list change. This is the metric that proves the engine works.
- False positive rate and alerts per thousand screened: track by list and by customer segment to target tuning.
- List update latency: time from a regulator publishing a designation to your customer base being rescreened. OFSI's guidance says the UK Sanctions List itself is updated within one working day for new UN and UK listings.
- Alert ageing: share of payment alerts cleared within your service level, and customer alerts older than a set number of days.
- Overdue reviews: percentage of high-risk and PEP customers past their periodic review date, and share of EDD files with source of wealth evidenced rather than declared.
See the Fraud Metrics and KPIs Guide.
Common failure patterns
- Screening only the customer name: owners, directors and signatories are not screened, so an entity owned by a designated person passes. Both OFAC and OFSI ownership rules make the unlisted entity a problem.
- Thresholds nobody can explain: a vendor default score was accepted at go-live and never tested. Nobody can show recall or why it fits the risk.
- EDD as a form: source of wealth is a free-text declaration and enhanced monitoring uses the same rules as standard.
- Treating the register as proof: beneficial ownership is copied from a company register, which UK MLRs 28(9) and EU AMLR recital 54 both say is not enough on its own.
- Assuming a SAR covers sanctions: in the UK, reporting to a regulator or filing a suspicious activity report does not satisfy the separate duty to report to OFSI.
Where identity fits
These controls sit on top of identity proofing: a perfect sanctions screen of a synthetic or stolen identity proves nothing. Strong proofing and liveness checks are covered in the Identity Proofing and KYC Guide, and fabricated identities built to pass CDD in the Synthetic Identity Fraud Guide. The screening engine's API keys and the service accounts that load lists and change thresholds are privileged non-human identities: restrict and log every change.
Regulatory and framework mapping
| Topic | FATF | UK | US | EU |
|---|---|---|---|---|
| Risk-based approach | Recommendation 1 (revised February 2025) | MLRs 28(12), 28(16) | AML programme rules | AMLR 2024/1624 |
| Customer due diligence | Recommendation 10 | MLRs reg 28 | CIP rules; 31 CFR 1010.230 for legal entities | AMLR 2024/1624 |
| Beneficial ownership | Recommendations 24 and 25 (revised February 2023) | MLRs 28(4) to 28(9) | 31 CFR 1010.230 (25 percent and control prong) | AMLR recitals 107 and 108 (25 percent) |
| Enhanced due diligence | Risk-based approach | MLRs reg 33 | Risk-based within AML programme | AMLR 2024/1624 |
| PEPs | Recommendations 12 and 22 | MLRs reg 35 | Risk-based within AML programme | AMLR recitals 90 and 94 |
| Targeted financial sanctions | Recommendation 6 | OFSI general guidance; UK Sanctions List | OFAC SDN List; 50 Percent Rule | EU Financial Sanctions Files; AMLR recital 34 |
FATF shows the Recommendations as last updated in June 2026. For mule activity found in monitoring, see the Money Mule Detection Guide.
Practitioner checklist
- Publish a written customer risk assessment that maps risk scores to simplified, standard and enhanced measures.
- Model ownership as a graph and compute the 25 percent (CDD) and 50 percent (sanctions) tests per regime.
- Screen customers, beneficial owners, directors, signatories and payment parties, not just the account holder.
- Create one workflow per EDD trigger with required evidence, approver and review date.
- For PEPs, record senior management approval, evidenced source of wealth and funds, and a review date at least 12 months after they leave office.
- Choose match thresholds from a labelled test set, document the rationale, and retest after every list, engine or vendor change.
- Rescreen the customer base on every list update and measure the latency.
- Train analysts on name match vs target match using OFSI and OFAC examples, and require written rationale for every discount.
- Keep separate sanctions reporting procedures for OFAC (10 business days for blocked property) and OFSI (as soon as practicable).
- Restrict and log changes to screening configuration and the service accounts that perform them.
Standards and references
- legislation.gov.uk: The Money Laundering Regulations 2017, regulation 28 (customer due diligence measures)
- legislation.gov.uk: The Money Laundering Regulations 2017, regulation 33 (enhanced customer due diligence)
- legislation.gov.uk: The Money Laundering Regulations 2017, regulation 35 (politically exposed persons)
- eCFR: 31 CFR 1010.230 Beneficial ownership requirements for legal entity customers
- US Treasury OFAC: Entities owned by blocked persons (50 Percent Rule) FAQs
- US Treasury OFAC: Sanctions List Search FAQs
- HM Treasury OFSI: UK financial sanctions general guidance
- EUR-Lex: Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation)
Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · KYB Guide · Money Mule Detection Guide · Ransomware Payments and Sanctions Guide. This guide summarises CDD, EDD, PEP and sanctions screening obligations in the UK, US and EU as published on official sources checked on 30 October 2026 and is not legal advice.