Enhanced due diligence procedure: documents to prepare
Enhanced due diligence starts once a standard check flags elevated risk. Prepare beneficial ownership evidence, source-of-funds documentation, adverse media checks and a written risk narrative before the file reaches your compliance officer. Missing documents extend the review; a complete file usually closes within the deadline your internal policy sets. The point of no return is the onboarding or decline decision — reached only once every document has been reviewed and signed off.
What triggers the enhanced review
A standard check moves to enhanced due diligence when a risk score crosses your policy threshold. Common triggers include a client based in a higher-risk jurisdiction, a layered ownership structure, transaction volumes inconsistent with the declared business profile, or a hit on a screening list that needs manual clearance. The trigger itself does not decide the outcome. It only decides which documents you must collect before anyone can decide.
Once triggered, the file is locked from routine processing. No transaction tied to the client proceeds past the threshold set in your policy until the enhanced file is closed with a recorded decision.
Documents to prepare
The table below lists what an enhanced file typically needs, who prepares each item, and what usually triggers the requirement. Not every row applies to every client; the risk narrative should state which items were skipped and why.
| Stage | Documents required | Prepared by | Typical trigger |
|---|---|---|---|
| Trigger review | Risk-scoring notes, transaction pattern summary | Compliance analyst | Standard check flags elevated risk |
| Identity verification | Certified identity document, proof of address, corporate registry extract | Onboarding team | New elevated-risk client or trigger event on an existing one |
| Beneficial ownership | Ownership chart, shareholder register, signed ownership declarations | Compliance officer | Layered or multi-jurisdiction ownership structure |
| Source of funds | Bank statements, underlying contracts, invoices, audited accounts | Client, verified by compliance | Volume inconsistent with declared profile |
| Adverse media and sanctions | Dated screening report, search results archive | Compliance analyst | Any elevated-risk trigger |
| Written risk narrative | Case memo with findings, gaps and a recommendation | Compliance officer | Before the file is submitted for decision |
| Decision record | Approval or decline memo, escalation trail if disputed internally | Senior compliance officer or the designated MLRO function | Point of no return for this client |
Keep every document dated. A source-of-funds letter without a date is treated as incomplete, and the file stays open until it is replaced.
Practical consequence for timing and risk
An incomplete file does not fail. It stalls. Each missing document adds a queue position rather than a rejection, and the client relationship stays frozen at whatever stage the trigger occurred. If the client cannot produce source-of-funds evidence within the window your policy allows, the file moves to decline by default rather than staying open indefinitely.
The risk exposure during this stalled period sits with the obliged entity, not the client. Regulators assess whether the enhanced review was proportionate and timely, not whether the client was cooperative. A slow file with good documentation is defensible. A slow file with thin documentation is not.
What to do
- Confirm the trigger with the compliance analyst before requesting documents — this fixes what you are actually checking.
- Request beneficial ownership evidence directly from the client, not through an intermediary, unless your policy names an exception.
- Screen for adverse media and sanctions on the same day the trigger is confirmed, and date the search result immediately.
- Verify source of funds against underlying contracts, not against a client statement alone.
- Draft the risk narrative before the decision meeting, listing every gap by name.
- Route the completed file to the compliance officer for a recorded decision within your internal deadline.
Who decides and when
The compliance officer, or the designated MLRO function where one is appointed, decides whether the client is onboarded, declined, or escalated for a second review. The decision is recorded in writing regardless of outcome. If your entity's key function holder changes mid-file, the file does not restart, but the handover must be logged before the new holder signs off — see A key function holder resigns authorisation the deadline that for how that handover deadline is treated elsewhere in the compliance function.
Escalation, where your policy allows it, goes to a senior committee or a second reviewer outside the original analyst's line. This step exists for disputed files, not routine ones, and should not become the default path for every enhanced review.
Common branches
If a beneficial owner refuses to countersign the ownership declaration, the file cannot close on the standard track. Treat the refusal itself as a risk indicator and document it in the narrative rather than waiting for cooperation that may not arrive — the same logic applies when When a co-owner refuses to sign a joint decision elsewhere in a corporate structure.
If the client's income depends on licensing revenue and the underlying right is contested, note the dispute status as part of source-of-funds evidence rather than treating the revenue as settled. This applies directly when When a standard body claims your patent is essential and the royalty stream tied to that claim is what the client presents as its funding source.
If the client relies on an outsourced technology provider for a service that underpins its business model, check whether the underlying arrangement is still active before you accept it as evidence of ongoing operations. The distinction matters in the same way it matters When support ends but the licence continues — a licence surviving on paper is not the same as a functioning relationship.
What this procedure does not cover
This page sets out the internal workflow: what to collect, who signs off, and where the process branches. It does not set jurisdiction-specific document lists, statutory retention periods, or the exact wording a regulator expects in a decision record. Those depend on the national regime your entity operates under and should be confirmed against your own compliance policy before the file is closed.
Verified
This procedure reflects internal compliance workflow design as commonly applied by obliged entities handling digital assets. It was last reviewed for accuracy on the publication date shown on this page. It does not cite specific statutory provisions; where a decision depends on a named legal requirement, confirm the current wording with your compliance function before acting.
Frequently asked questions
How long does enhanced due diligence procedure take in practice?
Timing depends on how quickly the client produces source-of-funds evidence and how many ownership layers need tracing. A file with clean documentation from the start typically closes faster than a file where documents arrive piecemeal, since each late document restarts the review queue rather than the whole process.
Which documents are needed to start?
Start with identity verification and a beneficial ownership chart. These two items determine what else the file will need, since ownership structure often dictates whether source-of-funds evidence must cover one entity or several linked ones.
What happens if the other side does not respond?
A non-responsive client does not pause the deadline your policy sets. If the required documents do not arrive within that window, the file typically moves to decline by default, and the decision record should state that the outcome followed from non-response rather than from adverse findings.
Related publications
For how the underlying client category is defined before any review begins, see Obliged entity AML compliance explained.
If your enhanced due diligence file concerns a token issuer facing a separate operational dispute, the next step is often unrelated to documentation and closer to an active incident — see When a stablecoin peg is challenged for what to do first.