When can simplified due diligence be used?

SDD adjustments include the following. The firm can change the timing, for example completing verification during onboarding. EU guidance also lists waiting until account activity reaches a defined amount, but only where national law does not require verification at the outset, and in Cyprus Article 62 does. It can reduce the quantity of evidence, verifying identity from a single reliable, independent source. It can accept a different quality or source of evidence, such as verifying the beneficial owner's identity from information the customer supplies instead of an independent source, or, where the overall risk is very low, treating funds arriving from an account held in the customer's own name at a regulated EEA firm as meeting part of its CDD. And it can review the relationship less often, for instance only when the customer asks for a new product.

Transaction monitoring can be scaled too, for example by concentrating on payments above a set amount. What the firm may not do is drop any of the four CDD measures altogether.

The information gathered must still be enough for the firm to be reasonably satisfied that its low-risk rating is justified, and to understand the relationship well enough to notice when something unusual happens. Monitoring continues, and suspicious transactions are still reported to MOKAS; SDD changes none of that.

The law lists factors a firm must at least consider, grouped by customer, product and geography. Customer factors: companies listed on a stock exchange whose disclosure rules make their beneficial ownership transparent, public administrations and public enterprises, and residents of lower-risk areas.

Product and service factors: life insurance with a low premium; pension insurance that cannot be surrendered early or used as collateral; employee retirement schemes funded from wages whose rules do not let members assign their interest; narrowly defined products designed to widen access to financial services; and products whose risk is contained by other features, such as limits on amounts or stored value, or transparent ownership, as with some electronic money.

Geographic factors: EU member states, and third countries that credible sources, such as mutual evaluations, show to have effective AML/CFT systems, low levels of corruption and crime, or requirements consistent with the FATF Recommendations that they apply effectively. The list is not exhaustive, and a single lower-risk factor does not make a relationship low risk on its own; the firm weighs everything it knows.

SDD stops as soon as the grounds for low risk are in doubt. It cannot be used where the firm suspects money laundering or terrorist financing, where it doubts that information it has received is true, or where a situation calls for enhanced due diligence, such as a politically exposed person or a high-risk third country.

Some sectors do not suit it at all: SDD is not appropriate in wealth management, and national rules may exclude it for particular products or services. See How does CDD differ by sector?