Who is accountable for EDD decisions in a higher-risk case?

How accountability is split in higher-risk EDD cases

Higher-risk EDD should not blur decision rights. The accountable approver is the senior manager or equivalent delegated authority named in the governance model, while the compliance team typically owns evidence gathering, risk analysis, and ongoing monitoring. That split matters because it keeps approval authority separate from investigation and record-keeping, which reduces ambiguity when the case is challenged later.

The practical question is not just who signs off, but who can defend the decision. In a higher-risk case, the approver must be able to show that they reviewed the full file, understood the residual risk, and accepted it on behalf of the firm. The compliance function should maintain the underlying rationale, source material, screening results, and review history so the decision remains explainable over time.

Where the case involves a PEP relationship or a high-risk third-country relationship, the file should make the approval path explicit. That means the investigator, reviewer, and approver are clearly named, the escalation path is documented, and the monitoring cadence is defined before the relationship is activated or continued.

What the governance model needs to make explicit

A good EDD model distinguishes authority from execution. Approval authority sits with a senior manager or other designated accountable person; investigation sits with the compliance or financial crime function; and file maintenance sits with the team responsible for monitoring and refresh. If those roles are not separated, organisations tend to create gaps where everyone assumes someone else owns the final decision.

The model should also define what triggers escalation, what evidence must be present before approval, and what happens when the case cannot be resolved quickly. In practice, this is less about a formal hierarchy and more about making sure the firm can prove that higher-risk decisions were deliberate, risk-based, and taken at the right level.

For firms operating under stronger control expectations, a documented approval chain also helps when audit or regulatory review asks why a case was accepted despite elevated risk. The governance record should show the risk factors considered, the compensating controls applied, and the conditions for continued review.

How to keep higher-risk EDD decisions defensible

Defensibility depends on three things: the evidence file, the approval record, and the monitoring trail. The evidence file should support the risk view. The approval record should show who accepted the case and when. The monitoring trail should show that the relationship is being revisited when risk changes, not just filed away after onboarding.

That becomes especially important when a higher-risk customer or counterparty changes behaviour, ownership, geography, or transaction pattern. If the case was approved on a narrow fact pattern, the file must make it obvious which facts were decisive and which changes would require reopening the review.

For teams building a process, the right standard is not “someone looked at it”, but “the organisation can reproduce the basis for approval and prove that the monitoring obligations did not stop at onboarding.”

Risk and Threat Considerations

Higher-risk EDD creates exposure when approval authority is vague, because elevated-risk relationships can be accepted without a clear challenge point or documented accountability. That weakens the firm’s ability to show that the decision was intentional rather than procedural.

Failure mechanism: If investigators and approvers are not separated, the same person or team may both build the case and implicitly approve it, which can hide weak evidence, missed red flags, or unchallenged assumptions. The result is an incomplete governance trail and a higher chance of unmanaged exposure persisting in the relationship.

Impact: The firm may be unable to demonstrate who accepted the risk, why the case was approved, or whether ongoing monitoring was adequate, which increases regulatory, control, and remediation risk if the relationship later proves problematic.

Practitioner Guidance

What to verify: Confirm that every higher-risk EDD file names the approver, the investigator, and the monitoring owner, and that those roles are not collapsed into one vague “owner” field. For PEP and high-risk third-country cases, the approval authority should be explicit enough that a reviewer can trace the decision without relying on tribal knowledge.

Decision rule: If the evidence is incomplete or the residual risk cannot be clearly explained, do not treat the case as approvable by default. Escalate it, reopen the supporting evidence, or require a fresh approval rather than allowing the file to drift on an outdated sign-off.

Practitioner takeaway: The control objective is not just to approve high-risk cases, but to preserve a clear line from evidence to escalation to accountable approval, so the decision remains defensible after the relationship starts changing.

Related resources from NHI Mgmt Group

• When do service accounts become a higher risk than ordinary user accounts?
• Why do non-human identities create more audit risk than human accounts?
• Why do non-human identities create audit risk in modern environments?
• Why do non-human identities create compliance risk even when policies exist?