Topic starter
06/11/2026 6:40 pm
TL;DR: AML is the overarching financial crime framework, KYC is the customer identification process inside it, and CDD is the ongoing information gathering that keeps both effective, according to Daon. Misunderstanding those boundaries can push firms toward the wrong controls, weaken monitoring, and increase exposure to enforcement, reputational damage, and operational inefficiency.
Editorial analysis by NHI Mgmt Group, based on content published by Daon: “AML vs KYC vs CDD 101”.
Key questions
A: AML and KYC serve different but connected purposes.
Q: What is the difference between customer identification and customer due diligence in AML compliance?
A: Customer identification establishes who the customer is, usually by confirming core identity details and supporting documents.
Q: How do AML programmes use customer risk scoring?
A: AML programmes use customer risk scoring to rank customers by their likelihood of money laundering or sanctions exposure, then apply proportionate controls.
Practitioner guidance
- Clarify the control boundary between AML, KYC and CDD Document which team owns identity verification, which owns risk scoring, and which owns ongoing review so the programme does not collapse distinct obligations into one workflow.
- Separate onboarding evidence from ongoing monitoring evidence Keep identity documents, source-of-funds records, relationship purpose notes, and alert history in distinct evidence sets so reviewers can see what changed and when.
- Tune due diligence by customer risk tier Apply enhanced due diligence, senior review, and more frequent refresh cycles to higher-risk customers instead of forcing one review cadence across the whole book.
Bottom line: AML, KYC and CDD are related but distinct control layers, and confusing them weakens both compliance design and operational accountability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Identity governance fails when AML, KYC and CDD are treated as the same control. They sit at different layers of the compliance stack, and each answers a different question: who the customer is, what level of risk the relationship carries, and how the institution detects suspicious movement over time. When those layers collapse into one another, teams either over-collect information at onboarding or under-monitor after activation. The result is not just inefficiency but blind spots in the evidence chain that regulators expect to see.
A question worth separating out:
Q: How do AML programmes use customer risk scoring?
A: AML programmes use customer risk scoring to rank customers by their likelihood of money laundering or sanctions exposure, then apply proportionate controls. Typical inputs include customer type, geography, ownership structure, products used and transaction behaviour. The score drives enhanced due diligence, monitoring thresholds, review frequency and escalation for suspicious activity.
👉 Read our full editorial: AML, KYC and CDD are distinct controls in financial crime prevention