FRM Exam Part II · Sound Management of Risks Related to Money Laundering and Financing of Terrorism

Customer Acceptance, Due Diligence and Ongoing Monitoring in AML

Updated 11 October 2026 · Fact-checked

Customer due diligence (CDD) means a bank accepts a customer only after identifying and verifying them and any beneficial owner, understanding the relationship's purpose, and rating its risk. Higher-risk customers, such as PEPs, get enhanced due diligence. The bank then monitors transactions and reports suspicious activity to the authorities.

Understand Customer Acceptance, Due Diligence and Ongoing Monitoring

Money laundering and terrorist financing (ML/FT) risk enters a bank through its customers. The Basel Committee's guidelines on sound management of ML/FT risks therefore start at the door: who is the bank letting in, and can it manage the risk they bring?

A customer acceptance policy sets out, in writing, which customers the bank will take on, which need senior approval and which it will refuse. It is built on the bank's own ML/FT risk assessment. It should not be so strict that it shuts out ordinary people, such as those with limited access to banking. Financial inclusion matters too.

Customer due diligence (CDD) has four parts. First, identify the customer and verify identity using reliable, independent sources. Second, identify the beneficial owner and take reasonable steps to verify them. The beneficial owner is the natural person who ultimately owns or controls the customer, or on whose behalf a transaction is made. For a company, the bank looks through layers of ownership to the real people. Third, understand the purpose and intended nature of the relationship. Fourth, conduct ongoing due diligence. The intensity is risk-based: low-risk customers may get simplified measures, standard customers get normal CDD, and high-risk customers get enhanced due diligence (EDD).

EDD applies where risk is higher. Typical triggers are politically exposed persons (PEPs), high-risk countries, complex ownership structures, private banking, cash-intensive businesses and correspondent relationships. For PEPs, the bank should have risk-management systems to identify them, obtain senior management approval to start or continue the relationship, establish source of wealth and source of funds, and apply enhanced ongoing monitoring. Family members and close associates of a PEP are treated as higher risk too. EDD means more information, more scrutiny and more senior sign-off. It does not automatically mean refusal.

Ongoing monitoring keeps the customer profile current. The bank reviews records and scrutinises transactions to check they match what it knows about the customer, their business and risk profile, including source of funds. Monitoring can be manual or automated, and more complex banks need automated systems. Unusual or suspicious activity is escalated internally, investigated, and, if suspicion remains, reported to the financial intelligence unit (FIU) as a suspicious transaction report (STR). Staff must not tip off the customer. If the bank cannot complete CDD, it should not open the account or carry out the transaction, and should consider filing an STR.

Key formulas to remember

Four elements of CDD: Identify and verify customer + identify and verify beneficial owner + understand purpose and nature + ongoing due diligence; Use this as a checklist when an option claims CDD is complete.
Risk-based approach: Higher ML/FT risk → enhanced measures; lower risk → simplified measures; Simplified CDD is never an exemption from monitoring and reporting of suspicion.
EDD for PEPs: Identify PEP + senior management approval + source of wealth and funds + enhanced ongoing monitoring; Applies to family members and close associates as well.
Beneficial owner: Natural person who ultimately owns or controls the customer, or on whose behalf a transaction is conducted; A legal entity or nominee shareholder is not a beneficial owner.
Failure to complete CDD: CDD incomplete → do not open account or transact; consider filing an STR; Exam answers favour refusal plus escalation, not proceeding with a promise to verify later.
Suspicious transaction reporting: Alert → internal review → escalate to compliance/MLRO → STR to FIU if suspicion remains; Reporting is triggered by suspicion, not proof, and no tipping off.

How to solve Customer Acceptance, Due Diligence and Ongoing Monitoring questions

Use this sequence on any scenario question about customers, due diligence or monitoring.

1Identify the stage: acceptance, identification and verification, risk rating, EDD, ongoing monitoring or reporting.
2List the risk factors in the scenario: customer type, PEP status, country, product, delivery channel, ownership structure, cash intensity.
3Decide the risk level and the matching measures: simplified, standard CDD or EDD.
4Check the beneficial owner: has a natural person at the top of the ownership chain been identified and verified?
5Check for gaps: missing source of wealth or funds, no senior approval, stale customer profile, unexplained activity.
6Choose the action: proceed with normal controls, proceed with EDD and senior approval, escalate for investigation, file an STR, or decline.
7Eliminate options that tip off the customer, skip verification, or treat a PEP as automatically barred.

Quickest way: Risk, owner, approval, report

When to use it: For short scenario MCQs where you must pick the correct next step in under a minute.

Ask: is the risk higher than normal? If yes, EDD is needed.
Ask: is a real person behind any entity identified and verified?
Ask: is this a PEP or similar? If yes, senior approval and source of wealth and funds.
Ask: is there suspicion? If yes, escalate and report, never tip off.
Pick the option that is risk-proportionate, not extreme in either direction.

Common mistakes in Customer Acceptance, Due Diligence and Ongoing Monitoring

Treating a PEP as a customer the bank must refuse.
PEP sounds like a prohibition.
Fix: PEPs are higher risk, not banned. The answer is EDD, senior management approval, source of wealth and funds, and enhanced monitoring.
Accepting a company's name as the end of beneficial ownership checks.
Verifying the legal entity feels like enough.
Fix: Look through to the natural persons who own or control it. Legal entities and nominees are not beneficial owners.
Thinking simplified due diligence means no monitoring.
Confusing lower intensity with exemption.
Fix: Low-risk customers still get ongoing monitoring, and suspicion always overrides simplified treatment.
Telling the customer an STR has been filed.
Wanting to be transparent or to ask for explanations.
Fix: Tipping off is prohibited. Ask routine questions without revealing the report.
Believing CDD is a one-time onboarding step.
Focus on account opening.
Fix: CDD includes ongoing due diligence: keep customer information current and scrutinise transactions against the profile.
Requiring proof of crime before filing an STR.
Mixing up suspicion with evidence.
Fix: Reporting is triggered by suspicion or reasonable grounds to suspect. Investigation is for the authorities.

Worked examples

Example 1

A bank is onboarding a trading company whose shares are held by a holding company, which in turn is owned 60% by Ms A and 40% by Mr B, both natural persons. The bank has verified the trading company and the holding company's registration documents. Which is the best next step?
A. Treat the holding company as the beneficial owner and proceed
B. Identify Ms A and Mr B as beneficial owners and take reasonable steps to verify them
C. Verify only Ms A because she holds the majority
D. Defer beneficial ownership checks until the first suspicious transaction

Show the solution

The beneficial owner is the natural person who ultimately owns or controls the customer.
The holding company is a legal entity, so it cannot be the beneficial owner. That rules out A.
The ownership chain ends with Ms A and Mr B, both natural persons, so both must be identified and reasonable steps taken to verify them. Verifying only Ms A leaves a gap, so C is out.
Beneficial ownership is part of CDD at onboarding, not a later trigger, so D is wrong.

Answer: B

Example 2

A private bank's client is the spouse of a senior government minister in a foreign country. The client asks to open an account and transfer USD 5 million from an overseas company. Which action best reflects the Basel guidance?
A. Decline, because family members of PEPs cannot be customers
B. Open the account under standard CDD since the client holds no public office
C. Treat as higher risk: obtain senior management approval, establish source of wealth and funds, and apply enhanced ongoing monitoring
D. Open the account and file an STR immediately regardless of any findings

Show the solution

A close family member of a PEP is treated as higher risk, so standard CDD alone is insufficient. That rules out B.
PEP status is not a bar to banking, so A is wrong.
Filing an STR with no suspicion basis and no review is not the prescribed process. STRs follow suspicion. D is out.
The correct response is EDD: senior management approval, source of wealth and source of funds for the USD 5 million, and enhanced ongoing monitoring.

Answer: C

Exam tips

Expect scenario questions where one option is too lax (skip EDD) and one too harsh (refuse all PEPs). The middle, risk-proportionate answer is usually correct.
Use exact vocabulary: beneficial owner, source of wealth, source of funds, senior management approval, tipping off, FIU.
When CDD cannot be completed, pick the option that stops the account opening or transaction and considers an STR.
Remember monitoring compares activity with the customer profile. Questions often give a mismatch, such as a low-income customer receiving large wires.
Do not select options that claim simplified due diligence removes reporting duties.

Practice questions from Sound Management of Risks Related to Money Laundering and Financing of Terrorism

Customer Acceptance, Due Diligence and Ongoing Monitoring in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Customer Acceptance, Due Diligence and Ongoing Monitoring: frequently asked questions

What is the difference between CDD and EDD?

CDD is the standard process of identifying and verifying the customer and beneficial owner, understanding the relationship and monitoring it. EDD adds more information, deeper scrutiny and senior sign-off for higher-risk cases such as PEPs. Both are applied on a risk basis.

Who is a beneficial owner?

A beneficial owner is the natural person who ultimately owns or controls a customer, or on whose behalf a transaction is carried out. Banks must look through corporate layers to find that person and take reasonable steps to verify them.

What extra steps apply to politically exposed persons?

The bank should have systems to identify PEPs, obtain senior management approval for the relationship, establish source of wealth and source of funds, and monitor the account more closely. The same applies to family members and close associates.

How does ongoing monitoring work in practice?

The bank keeps customer information current and compares transactions with the customer's profile and expected activity. Unusual activity creates alerts that are reviewed, escalated and, if suspicion remains, reported to the FIU.

Can a bank tell the customer it filed a suspicious transaction report?

No. Tipping off the customer is prohibited and can compromise investigations. Staff should follow internal escalation procedures and avoid revealing the report.