They answer different questions. Source of funds explains where the transaction money came from, while source of wealth explains how the customer built their overall assets. In higher-risk cases, firms need both because a clean transaction can still sit inside a suspicious wider financial profile.
Why source of funds and source of wealth are not the same check
source of funds answers a transaction-level question: where did the money for this payment, deposit, or transfer come from? source of wealth answers a person-level question: how did the customer accumulate the assets they now hold? In EDD, those are complementary because a legitimate recent payment does not, by itself, explain a customer’s broader financial profile.
The distinction matters because different risks sit behind each test. Source of funds is about immediacy and traceability, while source of wealth is about the plausibility of the customer’s overall accumulation story. If firms treat them as interchangeable, they can miss a profile that looks clean at the point of transaction but remains inconsistent with the customer’s stated background, occupation, or known economic activity.
How firms use both checks in an EDD file
EDD usually starts with the risk presented by the customer relationship, then narrows into what needs to be evidenced. Source of funds is typically used to confirm the origin of the specific amount being moved, especially when a payment is large, unusual, cross-border, third-party funded, or not aligned to expected account behaviour. Source of wealth becomes more important when the customer’s total asset base, lifestyle, or accumulated holdings need explanation.
In practice, the two checks answer different control questions. A salary payment, business receipt, or asset sale may explain a particular transfer, yet the wider picture may still require proof that the customer’s overall wealth was built through a credible and lawful path. That is why higher-risk cases often require bank statements, sale agreements, dividend records, inheritance evidence, audited accounts, tax records, or other corroboration that matches the specific risk profile.
Where the customer is a legal entity, the same logic applies to the person controlling it and to the entity itself. Firms often need to understand both the operating cash flow that funds a transaction and the longer-term capital story behind the entity or beneficial owner, especially where the activity does not fit the stated business model. That is also why documentation quality matters more than document volume.
What a weak explanation usually looks like
The most common weakness is mismatch, not absence. The transaction may be internally consistent, yet the story around it may not fit the customer’s declared occupation, geographic footprint, business type, or prior account activity. Another weak pattern is when the customer can show one source of funds event but cannot explain repeated inflows, asset accumulation, or the origin of a much larger wealth base.
Another warning sign is overreliance on self-declaration. EDD is strongest when the firm can corroborate the story with independent records, not when it merely accepts a narrative that sounds plausible. If the explanation changes over time, relies on informal arrangements, or cannot be tied to dates, counterparties, and amounts, the firm should treat the profile as unresolved rather than as cleared.
Risk and Threat Considerations
Source of funds and source of wealth checks reduce exposure to money laundering, sanctions evasion, fraud proceeds, tax crime, and layered obfuscation. A clean-looking payment can still sit inside a suspicious asset base, and a credible wealth story can still hide an individual transaction funded from a high-risk or unexplained origin.
Failure mechanism: Criminal or high-risk funds are often introduced through a legitimate-seeming payment trail while the broader wealth position is built through unrelated assets, third parties, nominee structures, or inconsistent income sources. If the firm only tests one layer, it may validate the transaction while missing the underlying risk profile.
Impact: The result can be poor risk rating, weak ongoing monitoring, missed beneficial-ownership concerns, and delayed detection of laundering patterns or predicate crime. Over time, that increases the chance of onboarding the wrong customer, missing escalation triggers, and filing incomplete or misleading internal case records.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 and GDPR define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-8 — Audit Log Management | EDD decisions need traceable evidence and case records. |
| Recommendation — Retain auditable records showing how source-of-funds and source-of-wealth evidence was assessed. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | EDD relies on reviewable evidence and escalation records for suspicious patterns. |
| AC-2 — Account Management | EDD outcomes affect whether a customer relationship can be opened, limited, or continued. | |
| Recommendation — Review transaction and customer evidence for inconsistencies and document escalation decisions. Link customer risk findings to account restrictions, approvals, or enhanced monitoring. | ||
| ISO/IEC 27001:2022 | A.5.18 — Access rights | Customer due diligence depends on controlling and reviewing who can approve, edit, or override cases. |
| Recommendation — Restrict and review who can change EDD decisions or supporting case evidence. | ||
| GDPR | Art.5 — Principles relating to processing of personal data | EDD processing must remain data-minimised, accurate, and purpose-bound when handling personal financial records. |
| Recommendation — Limit EDD data collection to what is necessary and keep records accurate and current. | ||
Practitioner Guidance
What to verify: Test the explanation against the specific question being asked. For source of funds, verify the immediate provenance of the money used in the transaction; for source of wealth, verify the larger accumulation story and whether it is coherent with the customer profile. Do not accept one as a substitute for the other when the case risk requires both.
Decision rule: If the transaction can be explained but the wider asset position cannot, keep the case open and escalate the wealth question rather than clearing it on the basis of a single clean payment. If the wealth story is credible but the payment trail is not, treat the transaction as unresolved until the funds path is supported.
Practitioner takeaway: EDD is not trying to prove that money exists, it is trying to prove that both the immediate payment and the wider wealth story make sense together. The strongest cases show consistency across both layers, not just one.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org