Key to reducing the risk of a financial firm being used for money laundering is understanding who your clients are, where their money has come from, and what type of transaction they may carry out with the financial services firm. In order to understand who your client is, firms are required to carry out customer due diligence or CDD to understand everything they need to about the client. CDD is broader than just knowing your customer or KYC. Think of KYC as a subset of CDD, the component that involves verifying customer identity and establishing the purpose of the account. Customer due diligence, on the other hand, extends these inquiries into the customer's sources of wealth, the source of funds for the customer's, deposits, business or occupation, and the products and services the customer wishes to avail themselves of with the financial services firm. For commercial customers, CDD includes determining the identities of the ultimate beneficial owners, the UBOs of the company, and conducting due diligence on the UBOs as well. When their ownership of the company exceeds a certain percentage. Commonly starting from 25% ownership for low and medium risk customers, and starting from 10% ownership for high risk customers. CDD also includes obtaining the names of the customer's major counterparties, so the financial service provider will know in advance which parties are likely to remit money into the account and who the account will be making payments to once opened.

High risk customers require further checks to be carried out since they're an increased risk of carrying out money laundering. This is referred to as enhanced due diligence EDD. EDD differs from CDD only by degree and frequency. The higher financial crime risk demands more comprehensive inquiries by the financial institution and more frequent periodic reviews of the due diligence to stay abreast of potential changes to that client's risk profile. For example, a bank's policy may demand documentary proof of a politically exposed person's source of wealth. While this would not be required for low and medium risk customers. In addition, the firm's AML policy may demand periodic due diligence reviews on high risk clients annually. While for medium and low risk customers, the review frequency is only required once every three or five years, respectively.