When is customer due diligence (CDD) required?

The first question is always what kind of contact the firm has with the customer. A business relationship is a professional or commercial relationship that the firm expects, when contact begins, to last for some time: an investment account, a fund subscription, an ongoing mandate. An occasional transaction is a one-off carried out outside any such relationship.

That distinction decides whether amounts matter at all. A business relationship requires CDD from day one, even if the first deposit is small. For an occasional transaction, the amount and the type of business decide.

Splitting a payment is the simplest way to stay under a threshold, so the law looks at the total of operations that appear connected rather than at each payment on its own. A customer who pays €8,000 today and another €8,000 next week for the same purchase has made a €16,000 transaction, which crosses the €15,000 line. The same adding-up applies to the gambling and crypto thresholds, and to the cash limit described below.

Two situations override every figure in the table. The first is suspicion: once a firm suspects money laundering or terrorist financing, it must apply CDD even for a small sum, and no exemption or minimum amount can be used to avoid it. The second is doubt about information the firm already holds, for example when an identity document on file turns out to be expired, inaccurate or inconsistent. That doubt re-opens CDD for an existing customer.

Existing customers are also brought back into CDD at suitable, risk-based moments, such as when their circumstances change. That is covered in When must CDD be completed?

Until 31 December 2024, traders in goods had to apply CDD to occasional cash transactions of €10,000 or more, single or linked, and older study material still shows that rule. An amendment in force from that date removed the trigger and replaced it with an outright limit: anyone trading in goods or providing services, including buying and selling property, may now receive or make cash payments of no more than €10,000, whether in one operation or several linked ones.

The limit has narrow exceptions, such as payments between private individuals not acting in a professional capacity, and payments made at the premises of banks, e-money institutions or payment service providers. Breaking it is a criminal offence.