Customer due diligence design: what the decision maker looks at
A decision maker reviewing customer due diligence design checks four things: the logic behind the risk rating, the document trail behind each check, the point where onboarding must stop until a gap is closed, and who signs off before funds move. Design is judged by whether every step can be reconstructed later, not by how much paperwork sits in the file.
What "design" means in practice
Customer due diligence is not a single form. It is a sequence of checks that starts before onboarding and continues for as long as the relationship runs. When a decision maker reviews the design of that sequence, they are asking a narrow question: at which point does the file stop being a collection of documents and start being evidence that a decision was made on purpose, by a named person, at a known time.
This page does not cite article numbers or name a regulation. It sets out the order of steps, who owns each step, and where the process typically stalls. The rules behind each step sit in a separate legal reference on this site; this page covers the procedure, not the statute.
Practical consequence for the file
A file with unclear ownership is the most common cause of delay. If nobody is named as having approved the risk rating, the file cannot move to onboarding without redoing that step. The same problem appears further along the chain: if escalation ever reaches a supervisor and a public measure follows, the same who-decides question resurfaces at a higher level — see The supervisor publishes a measure authorisation who decides and.
Designing the procedure correctly the first time removes this rework. It also shortens the time a file sits in "pending review" rather than moving to a decision.
What to do
- The relationship manager collects the identification set and passes it to the compliance function before any onboarding step is confirmed.
- The compliance function applies the risk rating logic and records the reasoning, not only the resulting score.
- The compliance officer names the point at which the file cannot proceed — the point of no return — before the client is told the relationship is active.
- Any missing item is logged as an open item with an owner and a date, not left as a silent gap.
- The sign-off is recorded by name, not by role only, so the file can be reconstructed later.
- The file is reviewed again on the schedule set by the risk rating, not only on request.
Who decides and when
The compliance officer or the person holding that function owns the risk rating and the go/no-go decision. A relationship manager can gather documents but cannot clear a file. Escalation to a partner or senior officer happens when the risk rating is elevated or when a document cannot be verified through the normal channel.
The same ownership question recurs outside this area. In a licensing dispute, the equivalent question is who decides when a limit in the licence is ignored — see When field-of-use limits are ignored.
| Stage | Typical owner | Timing indicator |
|---|---|---|
| Collection of identification documents | Relationship manager | Before any onboarding step is confirmed |
| Risk rating and reasoning | Compliance officer | Before the file is marked active |
| Point of no return | Compliance officer, named individual | Fixed before onboarding starts, not decided mid-process |
| Open items and follow-up | Named owner per item | Logged with a date, reviewed on schedule |
| Periodic review | Compliance function | Set by the risk rating, not fixed for every client alike |
Forks: three common scenarios
- If the client is a straightforward individual with clean documents, the file moves through standard due diligence and the point of no return is rarely reached.
- If the client is a corporate structure with several layers of ownership, the design must show who traced the ownership chain and where it stopped, similar to how ownership questions arise when a distributor is sued over a product it did not design — see When a distributor is sued over your product.
- If a document cannot be verified through the normal channel, the file is held at the point of no return until the compliance officer records an alternative verification step or declines the relationship.
What this page does not decide
This page does not set out the legal basis for any given check, and it does not state a statutory deadline. It also does not cover what happens once a file is escalated into a formal report — that sits in a separate procedure. A comparable boundary question appears when a service contract quietly moves beyond its original scope — see When professional services drift out of scope.
Verified
This page was last checked against current internal procedure standards for obliged entities operating in the EU. It does not cite specific regulatory text; the legal basis for customer due diligence obligations is addressed on a separate page in this section and carries its own source list and check date.
Related publications
For the escalated version of this procedure, where risk indicators require a deeper file, see Enhanced due diligence procedure step by step.
FAQ
How long does the design of a customer due diligence file take in practice?
A straightforward file moves in a few working days once documents are complete. A file with an elevated risk rating or an unverifiable document can take considerably longer, because the point of no return is designed to hold the file rather than let it pass on an assumption.
Which documents are needed to start the process?
At minimum: proof of identity for the individual or the beneficial owners of a corporate client, proof of the entity's registration where relevant, and a source that supports the stated purpose of the relationship. Additional documents follow from the risk rating once it is set.
What happens if the client does not respond to a request for documents?
The file stays at the point of no return. The relationship is not activated, and the open item is logged with a date and an owner. If the client does not respond within the period set by internal procedure, the compliance officer records the decision to decline or suspend the relationship, and that decision is documented by name.