What enhanced due diligence means
Enhanced due diligence is the additional, risk-based work a bank performs when a customer relationship presents heightened risk.
The review should reflect the customer, the relationship, and the specific concerns involved. A defensible EDD process gathers sufficient information, resolves gaps or conflicts, documents the analysis, routes exceptions, and preserves human ownership of material judgments.
Scope the review around the facts
Federal banking agencies emphasize that customers within the same category can present different levels of risk. The scope of EDD should respond to the relationship and the facts identified by the bank.
Four questions help define the work:
- What specific risk or change triggered additional diligence?
- What information would confirm, explain, or challenge that risk?
- Which conclusions require analyst judgment or escalation?
- What evidence must remain in the file so another reviewer can follow the decision?
Sources: OCC joint statement and FFIEC guidance.
A seven-stage EDD workflow
The process should be consistent enough to test and govern while remaining flexible enough to reflect the facts of each relationship.
EDD workflow
Stage 1 of 7
Trigger and scope
Identify the policy trigger, customer-specific risk, review objective, and decision the work must support.
FinCEN explains that customer-information updates are risk-based and may be triggered when monitoring reveals information relevant to the customer risk profile. Read the CDD Rule FAQs →
Build a case file that shows its work
A second reviewer should be able to follow the decision without repeating the investigation. A review-ready file should explain:
Checklist completion
38%
3 of 8 items selected
Learning checklist only. Selections do not assess evidence quality, compliance, or approval readiness.
Set clear boundaries for automation
Automation works well for retrieving records, extracting document facts, resolving entities, searching defined public sources, organizing evidence, checking procedure completion, and drafting a sourced case summary.
Human reviewers can retain responsibility for approving the risk profile, resolving material exceptions, deciding whether the evidence is sufficient, and owning the final disposition where policy requires it.
Before production, test the workflow on representative historical cases. Compare outputs with prior analyst work, document disagreements, measure reviewer corrections, and expand when the evidence supports it.
Measure quality and capacity together
Faster reviews have limited value when they create rework, weaken evidence, or hide exceptions. Track operating speed alongside review quality.
- Time per completed review
- Backlog age and queue size
- Straight-through preparation rate
- Exception and escalation rate
- Reviewer correction rate
- Quality-control pass rate
- Missing-evidence rate
- Reopened or reworked files
- Time from trigger to approved disposition
Reported customer outcomes
Grasshopper Bank reported a 70% reduction in EDD time. First Internet Bank reported an 87% reduction in compliance review time. These results are specific to the cited implementations.
Common questions
What is enhanced due diligence in banking?
Enhanced due diligence is additional, risk-based information gathering and analysis for a customer relationship that presents heightened risk. The scope should reflect the specific customer, relationship, and risk factors.
When should a bank perform enhanced due diligence?
A bank should follow its risk-based policies and applicable legal or regulatory requirements. EDD may be appropriate when the customer risk profile, ownership, geography, products, activity, or other facts indicate that additional information and review are needed.
Is there a standard enhanced due diligence checklist?
There is no single universal checklist for every customer. A bank’s procedures should define what additional information is required for the specific risk and how missing or inaccurate information will be handled.
How can AI support enhanced due diligence?
Governed AI agents can gather records, extract facts, conduct defined research, organize evidence, execute documented procedures, and draft a sourced case file. Banks can retain human approval for risk judgments, exceptions, and final dispositions.
How should banks measure EDD automation?
Measure capacity and control together: time per review, backlog age, exception rate, reviewer corrections, missing evidence, quality-control pass rate, and rework. Expansion should depend on demonstrated quality as well as speed.
Sources
See how Bretton supports governed EDD operations.
Request a demo →