A payment arrives from a third-country supplier, but the invoice doesn't match the contract. The ownership structure behind the supplier runs through several companies, the customer gives vague answers about the money, and your finance team can't explain why the transaction was approved. By the time the issue reaches the board, you may face an unexplained loss, a fraud investigation, a disputed insurance claim, regulatory scrutiny, or evidence that won't withstand litigation.
Many UK businesses hesitate to apply enhanced due diligence because they expect a slow, expensive and highly technical process. Others aren't sure when the law requires it, particularly where the risk comes from a politically exposed person, a remote customer, an unusual transaction or a complex corporate structure. A proportionate process addresses those concerns. It concentrates effort where risk justifies it, records why decisions were made, and gives directors, insurers, lawyers and investigators a reliable evidence trail.
Introducing Enhanced Due Diligence for High Risk Clients
A manufacturing SME receives a request to pay a new vendor through an account in a different jurisdiction from the vendor's registered office. The customer explains that the arrangement reflects “group efficiency”, but provides no clear ownership chart. A quick identity check confirms the company exists. It doesn't answer the more important questions: who controls it, why does the payment route differ, where did the money originate, and does the transaction make commercial sense?
Standard customer due diligence may identify the legal entity. Enhanced due diligence asks whether the whole relationship makes sense. That distinction matters when a business faces fraud, money laundering concerns, a shareholder dispute or an insurance claim involving allegedly dishonest conduct. A forensic accountant can connect the compliance file to the financial evidence, including invoices, bank statements, ledgers, contracts and management explanations.
Practical rule: Treat unexplained financial activity as an evidence problem, not merely an administration problem.
A business that skips appropriate checks can struggle to defend its actions later. An insurer may question whether the policyholder understood its counterparty risk. A solicitor may find that the client file doesn't support the firm's AML decisions. A board may discover that staff relied on a risk score without documenting the reasoning behind it. Those weaknesses can affect negotiations, disciplinary proceedings, regulatory engagement and expert evidence.
Common objections usually have practical answers:
- “We haven't got a large compliance team.” Use a risk-based workflow, a standard evidence request and clear approval points. Higher-risk files should receive deeper attention, while lower-risk relationships shouldn't carry the same burden.
- “The legal trigger isn't obvious.” Start with the customer's risk, the transaction's purpose, ownership, geography and behaviour. The UK politically exposed person screening resource can support one part of that assessment, but screening alone doesn't complete EDD.
- “This will delay a commercial opportunity.” A documented decision can protect the opportunity more effectively than an undocumented approval. It also lets management identify what remains unresolved before money moves.
- “Our existing KYC file should be enough.” A static file won't explain new ownership, changed transaction patterns or unexplained wealth. EDD creates a process for revisiting the relationship.
The strongest programmes combine compliance discipline with forensic accounting. They gather evidence, test explanations, quantify exposure and preserve a clear record of who decided what, and why.
Understanding Enhanced Due Diligence Concepts
Think of standard KYC as entering a building through the main reception desk. The receptionist checks your identity and records the purpose of your visit. EDD is the layered security checkpoint used when the visitor, destination or circumstances create greater concern. Security staff may inspect additional identification, confirm who invited the visitor, examine what they intend to do, and continue watching activity after admission.
The UK places EDD inside a risk-based AML framework. Under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017, a relevant person must apply EDD measures and enhanced ongoing monitoring where higher risk requires them. The rules identify practical measures, including obtaining more information about the customer and beneficial owner, understanding the intended nature of the relationship, collecting source-of-funds and source-of-wealth information, and increasing the number and timing of transaction controls.
That makes EDD different from a larger document pile. The firm should connect each additional check to a defined risk. If ownership is opaque, investigate control. If wealth appears inconsistent with the customer's profile, test its origin. If transactions differ from the expected pattern, record the explanation and monitor whether later activity supports it.
The difference between CDD and EDD
CDD establishes who the customer is, who owns or controls the entity, and what relationship the firm expects to have. EDD goes further where the risk assessment identifies a need for deeper scrutiny. It may involve wider background research, more rigorous verification, detailed financial evidence, senior approval and closer monitoring.
The UK customer due diligence guidance provides a useful foundation, but teams must avoid treating either CDD or EDD as a one-off onboarding exercise. A customer can become higher risk after a change in ownership, a new jurisdiction, adverse information or unusual financial activity.
EDD should explain the money, the people, the purpose and the behaviour. If one of those remains unclear, the file needs a reasoned decision, not a silent assumption.
For a forensic accountant, that reasoning resembles an investigation. Each document supports or undermines a proposition. Each explanation should reconcile with the accounting records, commercial purpose and observed transaction flow.
Enhanced Due Diligence Legal Requirements in the UK
A customer may pass ordinary onboarding, then present a new ownership structure, unfamiliar jurisdiction or unexplained payment. At that point, the file needs a fresh legal and evidential assessment. The starting point is the UK's Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017. Regulation 33 requires a relevant person to apply enhanced customer due diligence and enhanced ongoing monitoring where the firm identifies a higher risk of money laundering or terrorist financing. The statutory wording in Regulation 33 makes EDD a required control, rather than an optional addition to a sound KYC process.
The practical test is whether the evidence still supports the risk assessment. An old identity document may be inadequate after new information changes the risk. The firm may need further identity and ownership information, source-of-funds and source-of-wealth evidence, a clearer explanation of the relationship's purpose, and tighter transaction controls. The framework also recognises risks associated with politically exposed persons, non-face-to-face relationships and high-risk third-country relationships.
What changes after 30 June 2026
Geographic requirements are subject to a significant change. HM Treasury states that, after 30 June 2026, mandatory EDD and enhanced ongoing monitoring for the relevant geographic category will focus on FATF “High-Risk Jurisdictions subject to a Call for Action”, replacing the broader earlier focus on high-risk third countries. The HM Treasury advisory notice on high-risk third countries sets out that direction.
The narrower category does not settle the whole risk assessment. A country outside it may still create material exposure through the customer, product, ownership structure, transaction or unusual complexity. Firms should update procedures for the legal change while continuing to assess the complete fact pattern.
Forensic accountants can make this practical by treating each EDD document as evidence supporting or challenging a proposition. Does the stated wealth reconcile with accounts? Does the payment serve a credible commercial purpose? Does later activity match the expected relationship? Those questions help create a defensible audit trail and an expert witness file if a decision is later scrutinised.
PEP decisions need more judgement
The FCA's 2025 PEP guidance also affects UK firms. It says UK PEPs should begin from a lower-risk position than foreign PEPs unless other risk factors exist, and senior-management approval no longer has to come specifically from the MLRO. The discussion of the FCA's PEP guidance explains why older, uniform checklists can produce weak decisions.
The response is a documented, fact-based assessment. Record the person's role, connections, wealth, funds, business activity and transaction behaviour, then explain why the relationship does or does not present heightened risk.
Firms aligning AML responsibilities with wider corporate processes can also consult guidance on the Economic Crime and Corporate Transparency Act.
Risk Triggers That Require Enhanced Due Diligence
EDD begins with a trigger, but a trigger isn't the same as a conclusion. It tells the compliance team to investigate further. The team still needs to understand the facts, assess the combined risk and decide what controls will manage it.
The 2017 Regulations name several situations requiring EDD. They include a customer in a FATF call-for-action country, a PEP or PEP associate, false or stolen identification, and a transaction that is unusually complex, unusually large or lacks an apparent economic or legal purpose. The relevant UK regulations provide the statutory reference.
| Risk Trigger | Example |
|---|---|
| FATF call-for-action country | A customer or transaction has a direct connection to a jurisdiction subject to the relevant FATF call for action. |
| PEP or PEP associate | A customer holds a prominent public role, or has a relevant close association that requires further assessment. |
| False or stolen identification | An identity document fails verification or appears connected to another person. |
| Unusually complex transaction | Several entities, accounts and contractual steps obscure a straightforward commercial payment. |
| Unusually large transaction | The amount is inconsistent with the customer's known business or expected activity. |
| No apparent economic or legal purpose | The payment has no credible commercial explanation after the customer has been asked to clarify it. |
| Non-face-to-face relationship | The firm cannot meet the customer in person and must compensate with stronger verification and monitoring. |
| Opaque ownership | The customer provides incomplete information about control, shareholders or beneficial owners. |
How to triage borderline cases
A transaction doesn't need to look criminal before the team escalates it. A family-owned business may use a holding company for a legitimate reason. A cross-border payment may reflect a genuine supply chain. The question is whether the explanation is consistent with independent evidence, the business model and the expected activity.
HMRC guidance says firms must consider high-risk factors identified in their initial risk assessment, as well as relevant risks in published HMRC risk assessments and sector guidance. The HMRC economic crime supervision guidance supports that broader approach.
Use a simple decision sequence:
- Identify the trigger. Record the specific fact that caused concern.
- Test the explanation. Ask for evidence, not only a verbal assurance.
- Assess combined risk. Consider geography, customer, ownership, product and behaviour together.
- Set controls. Choose additional checks and monitoring that address the identified risk.
- Escalate unresolved issues. Don't approve activity merely because the file contains more documents.
Step by Step Enhanced Due Diligence Process
A defensible EDD file should allow an independent reviewer to reconstruct the decision. That means the record must show the initial concern, the evidence requested, the evidence received, the analysis performed, the approval route and the monitoring plan.
Step 1, record the initial risk assessment
Start with a concise risk memorandum. Identify the customer, product, jurisdictions, ownership, expected activity and trigger. Explain why standard CDD isn't sufficient and define the questions EDD must answer.
A useful file note might state:
- Customer profile: Legal name, trading activity, directors and stated purpose.
- Risk signal: The specific event, person, jurisdiction or transaction causing escalation.
- Expected behaviour: Anticipated counterparties, payment routes and commercial purpose.
- Outstanding questions: The facts that remain uncertain.
- Owner and deadline: The person responsible for resolving each question.
Don't use a score without narrative. A number can't replace professional judgement when the risk involves unusual complexity or conflicting evidence.
Step 2, verify identity and control
Obtain additional information about the customer and beneficial owners. Compare official identity evidence with corporate registry records, constitutional documents, ownership charts, director information and the customer's own disclosures.
Test the structure rather than accepting the first named shareholder. Trace control through intermediate entities and record how the evidence supports the ultimate beneficial ownership conclusion. If documents conflict, preserve both versions, explain the discrepancy and escalate before approval.
Step 3, understand purpose and financial background
Ask what the relationship is meant to achieve and how the customer expects to use the service. Then compare the answer with contracts, invoices, management accounts, bank statements, tax information and transaction histories where relevant.
UK guidance requires firms to establish the source of wealth and source of funds involved in the relationship. The JMLSG guidance on source of wealth and source of funds shows why EDD must verify the origin of money, not merely collect another identity document.
Step 4, investigate and approve
Conduct proportionate background checks, including adverse information and relevant screening. Keep a search log that records the date, search terms, sources reviewed, results and the analyst's interpretation. Separate facts from assumptions.
Senior management should approve the relationship where policy or risk requires it. The approval should identify residual risk, conditions, restrictions, monitoring arrangements and the circumstances that would cause a fresh review.
Step 5, monitor and refresh
Set a baseline for expected activity. Monitor transactions against the customer's stated business, counterparties, jurisdictions and payment purpose. When behaviour changes, reopen the risk assessment rather than allowing the original approval to carry forward automatically.
Store transaction review logs, alerts, explanations, decisions and escalation records together. A forensic accountant reviewing a later dispute needs to see the timeline, not just the final risk rating.
This video provides a visual introduction to the workflow:
Applying Enhanced Due Diligence in SMEs Insurers and Law Firms
An SME often needs a process that staff can follow without turning every onboarding decision into an investigation. A pre-built EDD pack can include an ownership declaration, source-of-funds request, purpose questionnaire, document checklist, discrepancy log and approval record. The finance manager then knows what to request, while the compliance lead can see what remains unresolved.
Consider a business interruption insurance claim after a suspected fraud. The insurer needs more than a loss figure. It may need to understand the policyholder's control environment, the counterparty relationship, the timing of payments and whether records support the claimed loss. A forensic accountant can reconcile bank activity to the general ledger, test claimed losses and link EDD findings to the claim chronology.
Sector-specific applications
For a mid-market corporate, the critical document may be a group ownership map tied to contracts and payment flows. That map helps the board distinguish a legitimate restructuring from an arrangement designed to conceal control.
For an insurance broker, an onboarding agenda can prompt questions about beneficial owners, delegated authority, claims history and unusual payment instructions. The broker can then preserve the answers and supporting documents instead of relying on informal conversations.
For a law firm, EDD supports AML compliance and professional risk management. The file should show who the client is, who controls an entity, the purpose of the instruction, the source of funds where relevant and the reason for accepting or declining residual risk.
Connect compliance evidence to disputes
The same evidence can serve several functions. An ownership document may support AML analysis, a shareholder dispute and an expert report. A bank statement may help establish source of funds, trace diverted money and quantify a loss.
Lighthouse Consultants offers due diligence and financial analysis, including forensic review, operational and compliance audits, integrity checks and financial analysis. It can be one option for SMEs, professional firms, insurers and legal teams that need an independent analysis connecting compliance records to financial evidence.
A template creates consistency. An accountant's analysis creates meaning from the documents the template collects.
Identifying Enhanced Due Diligence Red Flags and Escalation Paths
A client file can appear complete until one document conflicts with the rest. The reviewer then needs more than a policy statement. They need a clear route from the first warning sign to an evidence-based decision. The FCA's 2025 guidance discussion supports proportionate PEP decisions, rather than treating every UK PEP as carrying the same level of risk. The FCA PEP guidance discussion provides useful context for that approach.
Red flags that deserve an immediate review
Look for connected patterns, not isolated curiosities:
- Missing ownership disclosures: The customer avoids naming controllers, changes its ownership explanation or supplies documents that do not reconcile.
- Inconsistent transaction patterns: Payments differ from the stated business, pass through unrelated accounts or change in frequency or value without explanation.
- Complex structures: Multiple entities, trusts or intermediaries make control difficult to trace without a clear commercial purpose.
- Adverse information: Credible negative information raises questions about integrity, fraud, bribery, corruption or financial conduct.
- Unreliable identification: Documents appear false, stolen, altered or inconsistent with the person presenting them.
A red flag does not prove misconduct. It means the existing evidence cannot support ordinary approval without further examination.
A practical escalation route
The first reviewer should pause the relevant activity where the firm's policy permits and record the concern. They should ask focused questions, preserve original documents, list the missing evidence and notify the compliance officer or MLRO through the stated escalation procedure.
If the customer gives a credible explanation, verify it independently and update the risk assessment. If the explanation remains unsupported, senior management should decide whether to impose conditions, decline or exit the relationship, or seek advice from internal audit, external counsel or a forensic accountant.
For a forensic accountant, this record is also the foundation of a later expert review. It shows whether the firm identified a warning sign, tested the explanation and made a decision that another reviewer can follow.
The file should show:
- The trigger and date.
- The person who identified it.
- The evidence requested and received.
- The analysis of contradictions.
- The approval or escalation decision.
- The monitoring or remediation action.
A UK PEP label should not determine the outcome by itself. Assess the actual risk and record the factors supporting stronger controls. This avoids both complacency and blanket de-risking, while giving SMEs and professional firms an audit trail that can withstand regulatory, legal or expert scrutiny.
Next Steps for Strengthening Enhanced Due Diligence
A compliance framework can look complete while failing at the point of use. Test yours with a sample of closed and active files. Can a reviewer identify the trigger, see the evidence trail, understand the source-of-funds reasoning, follow the approval route and confirm that monitoring continued after onboarding?
Audit the controls that matter
Ask your team to work through these questions:
- Does the policy identify statutory triggers and internal risk factors?
- Does the risk assessment explain why EDD is proportionate?
- Does the file identify beneficial ownership clearly?
- Does the source-of-wealth analysis match the customer's profile?
- Do transaction reviews compare activity with an expected baseline?
- Can staff show how they escalated discrepancies?
- Does an independent person test onboarding and monitoring quality?
- Do PEP procedures reflect the FCA's current risk-based position?
Where the answer is no, create a remediation plan with an owner, evidence requirement and review date. Prioritise gaps that affect active customers, unexplained payments, significant claims, litigation or board decisions.
A focused project often works better than a wholesale policy rewrite. Start with a discovery meeting, map the current workflow, review representative files, identify control failures and produce a scoped action plan. Then report results in language directors, insurers, lawyers and operational teams can use.
The objective isn't to collect documents for their own sake. It is to make sound decisions, explain them later and detect when a relationship no longer fits its original risk assessment. That discipline supports regulatory compliance, fraud response, disputes, insolvency work, investment decisions and expert witness assignments.
Review your EDD process before the next unexplained payment, client complaint or regulatory request exposes its weaknesses. A short gap analysis can show whether your procedures work in practice, not only whether they read well in a policy manual.
Lighthouse Consultants can review your enhanced due diligence controls, connect compliance findings with forensic financial analysis, and prepare practical templates and escalation records for your team. Visit Lighthouse Consultants to arrange a focused discussion about your UK EDD, fraud, dispute, insurance or expert witness requirements.
