Customer due diligence design: documents to prepare
Customer due diligence design is the internal project that builds your CDD process: risk criteria, document checklists, verification steps and escalation triggers. The output is a written procedure, not a decision on a single customer. Expect a working draft within two to six weeks, depending on the number of customer types and data sources involved.
What changes once design starts
Before design, onboarding decisions are made case by case, often by whoever is available that day. Once a design project opens, every open file is measured against the draft procedure, even before it is finished. This creates a point of no return: files opened after the first draft circulates are expected to follow it, and reverting to informal practice becomes hard to justify to a supervisor later.
The same deadline logic appears outside AML design work. If a related authorisation deadline is running elsewhere in the group, the design timeline can compress sharply — see how Own funds fall below the threshold authorisation the deadline forces a similar acceleration.
In practice, the design stops being a draft the moment onboarding staff start using it to reject or accept customers. That moment, not the sign-off date, is what a supervisor will ask about later.
Stages and documents to prepare
| Stage | Typical duration | Documents produced |
|---|---|---|
| Risk mapping | 3–5 working days | Customer and product risk matrix |
| Document checklist drafting | 5–7 working days | Standard, enhanced and simplified checklists |
| Pilot testing on sample files | 5–10 working days | Test log, exception list |
| Sign-off and rollout | 2–3 working days | Approved procedure, training note |
- Collect existing onboarding forms and mark where they already ask for identity, source of funds or beneficial ownership.
- Draft a risk matrix separating standard, enhanced and simplified customer categories.
- Build a document checklist for each category, naming who collects what and by when.
- Run the checklist against five to ten real files before rollout, not against hypothetical ones.
- Record every exception found during the pilot; unresolved exceptions become the first amendment.
- Circulate the approved procedure and confirm receipt from every person who onboards customers.
Ownership documents are often the slowest to collect, because the chain runs through several entities. Similar tracing problems appear when a customer wants ownership of improvements: the paper trail, not the claim, decides who is recorded as owner.
Who decides
The compliance function drafts the procedure. Senior management, or the person designated to approve AML policy, signs it off before rollout. Onboarding staff apply it once approved; they do not have authority to skip a step because a customer is in a hurry.
Decision authority questions of this kind surface in other files too, for example when a licence is granted by a non-owner: the person who signs is not always the person with authority to sign, and the design procedure should name both.
If the sign-off authority is unclear internally, the pilot stage is the point to fix it. Naming an unclear approver in the final procedure only moves the problem to the first difficult customer.
If your situation differs
If you already run a CDD procedure and only need enhanced steps for higher-risk customers, the design work is narrower. Read Enhanced due diligence procedure step by step before starting a full rebuild.
If a counterparty approaches you directly with an unsolicited offer rather than through standard onboarding, verification follows a different rhythm. The pattern is close to what happens when a patent is offered to you for sale: the approach itself is a risk signal, and the checklist should treat it as one.
If your customer base is entirely retail with no corporate structures, the ownership-tracing steps can be shortened, but the identity and source-of-funds steps stay in full.
What this page does not cover
This page does not set document retention periods, does not name a supervisor, and does not state a filing deadline for the finished procedure. Those depend on the entity's licence type and are handled in a separate file. It also does not cover the wording of a suspicious activity report; that is a distinct procedure with its own timing.
Verified
Reviewed for internal consistency against current onboarding templates and pilot logs used across obliged-entity files. Last reviewed: 4 March 2025. No external register or regulator source is cited on this page; the steps above describe internal file practice, not a statutory procedure.
Related reading
For the enhanced-risk branch of the same design work, see Enhanced due diligence procedure step by step.
FAQ
How long does customer due diligence design take in practice?
A working draft usually takes two to six weeks, depending on the number of customer categories and how many existing forms can be reused. Pilot testing adds one to two weeks before sign-off.
Which documents are needed to start?
You need existing onboarding forms, a list of current customer categories, and any prior exception logs. Without these three, the risk matrix has nothing to test against.
What happens if the other side does not respond?
If a sample customer does not respond during pilot testing, the file is logged as an exception, not discarded. A repeated non-response pattern usually points to a gap in the checklist rather than a problem with the customer.
Questions on where your current onboarding file sits against this design work reach a first answer within minutes during working hours; the scope and price of the design project follow within one working day.