Enhanced due diligence: proving where it came from.

What enhanced due diligence actually is

Standard due diligence establishes who a customer is and what they say they will do. Enhanced due diligence establishes whether that story holds together — and it is a different kind of work, not simply more of the same.

The distinction matters because of a common failure. Many institutions respond to a high-risk rating by collecting more documents: another address proof, a further certificate of incorporation, a second passport copy. That is more identification, not enhanced diligence. Identity was never the question. Whether this person's money and activity make sense was.

EDD is an evidenced judgement, not a document count. The output is a reasoned view — written down — that the institution understands where this customer's money comes from, why they want this product, and whether what they then do is consistent with both.

What triggers it. Some triggers come from the standards, others from the institution's own assessment:

• A high customer risk rating, however the model arrives at it.
• Politically exposed persons, and in many regimes their family members and close associates.
• Higher-risk countries, where the FATF calls for enhanced measures proportionate to the risk.
• Correspondent banking and similar relationships, where you are relying on another institution's controls.
• Complex or opaque structures — layered ownership, nominee arrangements, jurisdictions chosen for secrecy rather than business.
• Unexplained wealth or activity inconsistent with the profile, including adverse media.
• Event-driven triggers during the relationship, not only at onboarding.

Identity verification does not discharge it. The Wolfsberg Group makes a point worth carrying: even where strong identification and verification methods are used — biometrics, digital identities, anti-impersonation measures — source of wealth collection, and possibly corroboration, should still be considered as the customer's circumstances require. Knowing with certainty who someone is tells you nothing about where their money came from. The two questions are independent, and conflating them is how well-run digital onboarding produces confidently documented files about customers nobody has actually assessed.

Proportion is the governing principle. Enhanced does not mean exhaustive. The standards ask for measures proportionate to the risk, and an institution that applies the same heavy process to every high-risk customer is spending the same effort on a cash-intensive corner shop as on an opaque trust with political exposure. One of those files deserves far more.

Source of wealth and source of funds

These two terms are used interchangeably in practice and they are not the same thing. Getting them apart is most of the skill in this subject.

Source of wealth (SoW) is about the whole. The Wolfsberg Group's FAQs describe a SoW assessment as seeking to identify how a customer accumulated their wealth — the economic history behind the person. Inherited, built through a business sold in a particular year, earned over a career, won, invested, received in settlement.

Source of funds (SoF) is about this money. The FAQs describe SoF information as giving the institution an understanding of how and for what purpose an account is going to be funded — where the specific money arriving came from, and by what route.

Why the distinction decides the evidence. They are answered by different things, and asking for the wrong one wastes everyone's time:

• A customer transfers two million from an account at another bank. That statement evidences source of funds — it shows where the money came from immediately. It says nothing about source of wealth, because the question of how they came to have two million is simply pushed back one step.
• A company sale agreement, tax records across years, or audited accounts speak to source of wealth, because they explain accumulation.
• A property sale completion statement does both: it explains this specific sum and evidences a piece of the wealth story.

What the assessment is actually for. The FAQs set out what documenting SoW and SoF lets an institution do, and the list repays attention because it is operational rather than ceremonial:

• Understand the customer's background and financial history.
• Understand how and where capital was generated.
• Identify whether the customer's transactional activity is in line with what would reasonably be expected from what is recorded about them.
• Assess whether activity and transactions are potentially suspicious.

Read the third and fourth together: the SoW file is the baseline that makes monitoring meaningful. Without it, an alert on a large transfer cannot be assessed at all, because nobody knows what normal looks like for this customer. An institution with weak SoW files has a monitoring problem it will mistake for a tuning problem.

Inconsistency is the signal. The FAQs frame the purpose as allowing institutions to recognise risks and note inconsistencies, which should be addressed and either mitigated or escalated for further review. The wealth story that does not fit the activity, the business that cannot plausibly generate the sums passing through it, the timeline that does not work — these are the product of the exercise. An EDD file that records information but never tests it for coherence has gathered material without doing the work.

Not everything needs both. The Group is explicit that SoW is not always required to be collected or corroborated, and that the same may apply to SoF. Which applies, to whom, is the institution's own risk-based decision — recorded in its policy, not improvised per customer.

How much corroboration is enough

Corroboration is where EDD becomes real, and where most of the argument happens. The honest answer is that there is no fixed standard — and that this is deliberate.

The rule is risk-based, and it covers both quantities. The Wolfsberg FAQs state that institutions should adopt a risk-based approach with respect to the amount of information collected, and the corroboration required, and that this generally depends on the type of customer, their specific circumstances and their risk rating. Note that two separate decisions are being made: how much do we need to know, and how much of it must be independently supported. Many institutions conflate them and ask for documents to prove things they did not need to establish in the first place.

There is no single right method, and the Group says so. The FAQs explicitly do not prescribe how each institution should handle collection and corroboration, acknowledging that different definitions of and approaches to SoW and SoF exist. The strategy must be tailored. What this means in practice is that your policy has to state your own standard — and then be followed, because a documented standard you ignore is worse than none.

The evidence depends on the source. The type of corroboration required follows from the specific origin of the money and the means by which it was transferred. Some broad pairings:

• Employment income — contracts, payslips, tax filings. Simple to evidence and easy to sanity-check against the amounts.
• Business ownership or sale — audited accounts, the sale agreement, completion statements, filings in a company register.
• Inheritance — a will, grant of probate, estate accounts, or correspondence from the executor.
• Investment or asset sale — broker statements, completion documents, a tax computation.
• Gift — evidence from the giver, and the giver's own source of wealth where the sum is material. A gift simply moves the question to another person.
• Settlement, award or prize — the court order, the agreement, the confirmation from the paying body.

Public sources are evidence too. Company registries, land registries, published accounts, court records and credible media can corroborate a wealth story — sometimes better than a customer-supplied document, because the customer did not choose what they say. They also carry the risk of confusing people with similar names, so record what you searched and what you found.

When corroboration is not possible. This is common and it is not automatically a reason to refuse. Records may genuinely not exist — an older customer, a cash economy, a jurisdiction without reliable registries, a business built decades ago. The question is whether the explanation is plausible, internally consistent, and consistent with everything else you know, and whether the gap has been recognised rather than papered over. What is not acceptable is recording an unevidenced assertion as though it were established fact. "The customer stated the funds derive from family business income" is a record of what you were told; it becomes an assessment only when someone writes down whether they believed it and why.

If an inconsistency cannot be cleared. The FAQs are clear that identified inconsistencies should be clarified, and that where they cannot be, the institution moves to its escalation path for material inconsistencies. The decisions available are: accept with the gap documented and the risk rating adjusted; accept with restrictions or heightened monitoring; decline or exit; and — separately and always — consider whether the inconsistency amounts to grounds for a suspicious activity report. That last one is not an alternative to the others. An exit does not discharge a reporting obligation.

PEPs, correspondent banking and the harder cases

Politically exposed persons. A PEP is someone entrusted with a prominent public function. The reason for the attention is specific: the position carries the opportunity for bribery and the misuse of public funds, and both leave a trail through the financial system.

The common error is treating PEP status as a verdict. The Wolfsberg Group's PEP guidance argues for a risk-based approach to all PEPs, whether foreign or domestic, rather than automatically treating every foreign PEP as high risk. What distinguishes one PEP relationship from another includes the nature of the position held, its susceptibility to corruption, and how transparent the source of wealth is. A legislator in a country with published asset declarations and a functioning audit office presents a different problem from an official with discretionary control over procurement in a jurisdiction with neither.

Family members and close associates. These are in scope because the obvious way to hold proceeds of corruption is in someone else's name. The guidance gives a direct instruction that is easy to miss: where due diligence on a relative or close associate shows the funds come from the PEP, the institution should determine and document the PEP's source of funds and wealth. The enquiry follows the money to its origin; it does not stop at the account holder in front of you.

Senior involvement is structural, not ceremonial. The Wolfsberg private banking principles state that the institution should accept clients only where source of wealth and funds can be reasonably established to be legitimate, and that reviews of PEP relationships require senior management involvement. The purpose is to put the decision where the risk appetite is owned, and to make sure someone whose judgement is accountable has actually read the file. An approval applied as a signature on a summary nobody challenged does not achieve this.

Correspondent banking. Here the institution is exposed to customers it has no relationship with, through an institution it does rely on. The diligence is therefore about the respondent itself: its ownership and management, its business and customer base, the quality of its AML controls, its regulatory standing and supervision, and whether it has been subject to action. Industry questionnaires exist to standardise this collection, which helps — provided the answers are read and assessed rather than filed on receipt. Two specific concerns remain central: whether the respondent allows its accounts to be used by third parties with direct access, and whether any part of the arrangement touches a shell bank, which has no physical presence and no meaningful supervision.

Complex structures. Layered ownership, trusts, foundations and nominee arrangements are all legitimate and all useful for concealment. The task is to reach the natural persons who ultimately own or control, and — just as importantly — to form a view on why the structure exists. A plausible commercial or succession reason is an answer. "Tax efficiency" offered without detail, or a structure whose only evident effect is to obscure who benefits, is not an answer; it is the finding.

Decisions, records and keeping it alive

An EDD file is written for a stranger. Assume the reader is an investigator, a regulator or a colleague, three years from now, with no memory of the customer and no access to whoever did the work. That single assumption fixes most file quality problems.

What a good file contains:

• What was asked, and why — the trigger for EDD, and the specific questions that followed from it.
• What was obtained — information and documents, with dates and provenance recorded. Where the evidence came from matters: a customer-supplied statement and a registry extract are not equivalent.
• What was searched — public sources consulted, search terms, dates, and what was found including nil results. An unrecorded search did not happen.
• The assessment — whether the story is plausible and internally consistent, stated as a conclusion in sentences. This is the part most often missing, and it is the only part that is actually enhanced due diligence.
• Inconsistencies, and how each was resolved — or that it was not resolved, and what was done instead.
• The decision, who took it, and on what authority.

Write the assessment so a disagreement is possible. "SoW established" is not an assessment; nobody can agree or disagree with it. "Customer states wealth derives from the 2009 sale of a logistics business; sale agreement and buyer's filings obtained and consistent with the amount; no adverse media; stated funding of 1.4m is consistent with the documented proceeds" is an assessment, and a reviewer can test every clause of it.

Coherence with the risk rating. The Wolfsberg FAQs require that once SoW and SoF diligence has been carried out, the customer's risk assessment and rating should reflect those enquiries in a coherent, consistent and plausible manner. In plain terms: if the EDD found something, the rating should show it. A file full of unresolved questions attached to a customer rated medium risk is an internal contradiction, and it is exactly the thing an examiner will pull.

EDD is not an onboarding event. The file describes the customer at the moment it was written, and the whole purpose is to give monitoring a baseline. That baseline has to be revisited when the business changes, when ownership or control changes, when activity stops matching the documented picture, when adverse media appears, and when a periodic review falls due. The most valuable trigger is the simplest: activity inconsistent with the documented source of wealth. If a customer documented as deriving income from a small professional practice begins receiving large international transfers, the EDD file is the thing that makes that visible — and the thing that must now be redone.

The honest standard. You will not always establish source of wealth to a certainty, and nobody expects you to. What is expected is that you asked the right questions, sought evidence proportionate to the risk, noticed what did not fit, did something about it, and wrote down what you concluded and why. A file that shows all five is defensible even where the answer was incomplete. A file of collected documents with no reasoning is not defensible even where everything turned out to be true.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.