Topic starter
24/10/2026 8:49 pm
TL;DR: Customer due diligence often fails in execution, documentation and oversight, Alloy reports from the FCA’s April 2026 multi-firm review. Case records, approval chains and version control have to work together or CDD becomes hard to defend.
Editorial analysis by NHI Mgmt Group, based on content published by Alloy: “The FCA's CDD review: Good intentions aren't enough”.
Key questions
Q: Why do trigger-based reviews matter in ongoing customer monitoring?
A: Because customer risk changes outside the calendar.
Q: What are the most common failure signals in EDD documentation?
A: The biggest signal is when analysts can describe why they escalated a case but cannot prove it in the file.
Q: What breaks when customer due diligence is too weak in non face to face business relationships?
A: Weak due diligence creates gaps in identity assurance, recordkeeping, and fraud detection.
Practitioner guidance
- Define the CDD-to-EDD decision boundary Write explicit criteria for when baseline customer due diligence ends and enhanced due diligence begins, then test those criteria against real cases so analysts do not improvise the escalation path.
- Operationalise trigger-based reviews Link ownership changes, director changes, name changes and similar events to the case workflow so a triggered review updates the record, resets due dates where appropriate and leaves a clear audit trail.
- Capture EDD rationale in the case record Require analysts to record the risk factor, the evidence reviewed, the decision made and the approver before a file can close, rather than relying on memory or email.
Bottom line: The FCA’s review shows that customer due diligence often fails because firms cannot execute or evidence their own controls consistently.
Glossary terms: Customer Due Diligence, Enhanced Due Diligence, Trigger-Based Monitoring, Delegation authority
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:12 am
CDD governance fails when control intent is separated from casework reality. The FCA review shows that policy quality is not the same as control effectiveness. Firms that cannot evidence how CDD, EDD and monitoring actually operate have a governance problem, not a drafting problem. For identity and AML programmes, the operational truth is what matters: if the file does not prove the decision, the control did not really happen.
A question worth separating out:
Q: How should firms govern senior manager approvals for high-risk customers?
A: They should define who can approve which risk tier, document that delegation, and quality-assure it with sample testing. The practical goal is to reserve senior escalation for the cases that truly require it while keeping lower-tier decisions consistent, reviewable and attributable to the right authority.
👉 Read our full editorial: FCA CDD review shows policies fail when execution lags
This post was modified 7 days ago by NHI Mgmt Group