Working through a CDD case

A Customer Due Diligence (CDD) case is a checklist split into sections A to H. This article walks through each section and explains how the risk rating is worked out.

Why it's structured this way

• Risk comes first. The rating you set in section A decides which sections and questions appear next, so low risk clients get a lighter process.

• Nothing gets skipped. The Complete button only appears on the last section, so every section is seen before sign-off.

• Progress is saved as you go. Use Save draft at any time and come back later.

Moving around a case

• Use Next step and Previous at the bottom of each section, or click a section to jump to it.

• Click Save draft to save without completing.

• Click Preview PDF to see the case as a PDF at any point.

At first only section A is shown. The rest appear once you've set an initial risk rating:

• Sections D to H always appear.

• Section C. Ownership and control appears for companies, partnerships, associations and trusts.

• Section B. Delayed CDD appears only for medium and high risk clients.

A. Risk assessment

A1. Risk assessment lists risk factors in four groups:

• Designated service risks

• Client risks

• Delivery channel risks

• Country risks

Answer Yes or No to each one. Each factor carries a medium or high risk level.

A2. Client risk rating shows the score and the suggested rating, then lets you choose Low, Medium or High. Add a rationale to explain the rating.

How the suggested rating is worked out

Each Yes adds points based on its risk level: low 1, medium 2, high 3. The total is compared to your thresholds (by default, medium from 5 and high from 10).

The suggested rating is the higher of:

1. the rating from the score, and

2. the highest risk factor you answered Yes to.

For example, if you answer Yes to one high risk factor, the suggestion is High even if the total score is low.

You can choose a different rating from the suggestion. OnboardMe shows that you changed it and offers Use suggested rating to switch back. Record your reasons in the rationale.

Note: Answering Yes to a high risk factor shows an Escalation reminder. Follow your AML program for escalating to your compliance officer.

B. Delayed CDD

Shown for medium and high risk clients only. B1. Delayed verification of customer information lists criteria for starting the designated service before you finish verifying beneficial owners and PEP status. If you rely on it, record:

• why it's essential and the associated ML/TF risks

• the steps you'll take to verify the information as soon as practicable, and no later than 20 days

Important: OnboardMe records your delayed CDD decision but doesn't set a reminder for the 20 days. Track the follow-up in your own workflow. Sanctions screening can't be delayed.

Note: The 20-day window reflects the Australian rules, and the wording is the same in every country. In New Zealand, the UK and South Africa, the rules on delaying verification are different and narrower. Use this section only if your local rules and AML program allow it. Record the timeframe that applies to you in the completion plan. See CDD by country.

C. Ownership and control

For companies, partnerships, associations and trusts:

• C1. Identifying low risk ownership structures, for example government bodies

• C2. Beneficial owners, with each person's ownership or control percentage

• C3. Controllers. Use Copy from beneficial owners (C2) if they're the same people

• Ownership and control evidence, such as a company register extract or trust deed

See Beneficial owners, controllers and representatives.

D. Identity

D1. Client identity records how you verified the client:

• a description of the identity evidence

• Identity evidence files

• checks such as "Do the documents match the information in the onboarding form?" and "Do you have any concerns about the validity of documents provided?"

• the steps taken to resolve any differences

For individuals and sole traders, D1 also shows the ID verification on file for the client. Click Set verification or Edit verification to record it. You can also request an ID verification to go out with the proposal.

For businesses, the top of D1 depends on your country:

These are filled in from the client record where possible. The ABN lookup is a supporting check only. In every country, attach an extract from the company register as the main evidence: ASIC in Australia, the Companies Office in New Zealand, Companies House in the UK, or CIPC in South Africa. The help text on D1 tells you what to collect for your country and client type.

D2. Client representative and D3. Beneficial owners and controllers record identity for each person acting for or owning the client. A person who is both an owner and a controller appears once in D3.

Note: For a company or trust, verify the identity of the beneficial owners and authorised representatives in sections C and D, not the company or trust record itself.

Uploading evidence

Evidence fields take PDF files up to 10 MB, one at a time. Save the case before uploading. Uploaded PDFs are added to the end of the case PDF.

E. Sanctions and PEP

E1. Sanctions and PEP screening has a row for each person: the client, their representatives, and their beneficial owners and controllers. For each person record:

• Name searched

• Date of search

• Subject to sanctions?

• Politically exposed person (PEP)?

Click Add another person to add more rows. Use E2. PEP screening notes for any detail.

Note: This section is your record of the screening. Run the search in your screening tool, or with an OnboardMe AML check, and record the result here.

This section also records Source of funds and Source of wealth. Options such as loan or finance and inheritance carry a higher risk weight.

F. Nature and purpose

F1. Nature and purpose of the transaction records why the client is engaging you and whether the explanation is truthful and plausible. If you send an information request, the client answers "Why are you engaging us?" and their answer appears here.

G. Final checks

• G1. Final onboarding checks: a final set of yes or no checks

• Additional steps taken to reach required satisfaction

• G2. Escalation check: "Do matters need to be sent to the AML/CTF compliance officer?" This means your AML compliance officer, whatever the role is called in your country (for example, your MLRO in the UK)

• G3. Final risk rating: starts as your initial rating, and can be changed

The final risk rating decides whether the case needs approval. See Approving and completing a CDD case.

H. Sign-off

Record the Name, Role and Date of the person signing off, and the Date the designated service started to be provided. The Complete button is on this section.

Required questions

Required questions are marked with an asterisk. If some sections still have unanswered questions when you click Complete, OnboardMe warns you: Some sections are incomplete. You can choose Review incomplete sections or Complete anyway.

If the checklist has changed

If your business changes the checklist for this client type after a case is created, the case shows Checklist template has changed. Choose:

• Keep current checklist to keep the questions already on the case, or

• Switch to current checklist to pull in the latest questions.

You can't switch once an information request has been sent to the client.

Next steps

• Requesting information from your client

• Approving and completing a CDD case