What is customer due diligence?

Customer due diligence (CDD) is the set of checks a regulated firm runs to identify a customer, verify that identity, understand who owns and controls them, and understand the purpose of the relationship, then keep that picture current. It underpins anti-money laundering controls. AI agents can gather and check most of the evidence; accepting the customer stays with a person.

Why does customer due diligence matter once agents act?

CDD decides who a firm does business with. Every later control, from transaction monitoring to suspicious activity reporting, relies on the profile built here. A weak file at onboarding means alerts later have nothing to be measured against.

An agent can collect documents, read company registry extracts, check that names and dates agree across sources and draft the customer profile in minutes. The question is not whether an AI agent can perform customer due diligence tasks, but which decisions it may take. Approving a customer, accepting a gap in evidence or waiving a requirement are judgements that belong with accountable staff, as our guide to compliance agents in the second line explains.

What does CDD involve in practice?

The FATF Recommendations set out four core elements, which national laws turn into detailed rules:

1. Identify and verify the customer using reliable, independent sources.
2. Identify the beneficial owners and take reasonable steps to verify them.
3. Understand the purpose and intended nature of the relationship.
4. Monitor the relationship on an ongoing basis, keeping information up to date.

The depth of each check follows risk. Our piece on FATF customer due diligence with AI agents maps each element to what an agent can safely do.

An example from business onboarding

Take a business bank onboarding a small manufacturer. The agent pulls the registry extract, reads the shareholder register supplied by the customer, and notices that a 40-share holding is listed under a holding company the customer did not mention. It requests the holding company's documents, checks the directors against screening lists and drafts a profile with one open point: the holding company's own owners are not yet identified.

The onboarding analyst reads the profile, chases the missing ownership details and decides. Our guide on running business customer due diligence with an AI agent walks through the full sequence.

How is CDD different from KYC?

The terms are often used interchangeably, but they are not the same size. KYC, know your customer, usually means establishing and verifying who the customer is: name, date of birth, address, identity documents. It is the first element of CDD.

CDD is wider. It adds ownership and control, the purpose of the relationship, the expected activity and the duty to keep all of it current. A firm can complete KYC perfectly and still fail CDD if it never asked why a customer wanted an account that now receives large overseas payments.

Which terms sit next to CDD?

• Enhanced due diligence is the deeper set of checks applied when risk is higher.
• Simplified due diligence is a lighter set of checks permitted in some markets for demonstrably low-risk cases.
• Ultimate beneficial owner: the natural person who ultimately owns or controls the customer.

Where Pryme fits

In Pryme, documents arrive with their provenance stamped. A registry extract or a verified issuer's credential counts as signed; a customer's own statement is declared. The CDD agent can draft from all of them, but its profile shows which facts rest on declared evidence alone, so the analyst can see what still needs verifying before approving.