What are customer due diligence measures?

Customer due diligence measures are actions that an obliged institution applies to a customer in order to identify and mitigate money laundering and terrorist financing risks. They include more than just customer identification and verification. They also include identifying and verifying the beneficial owner, understanding the purpose and nature of the relationship, and conducting ongoing monitoring.

The scope and intensity of these measures should take into account the identified AML/CFT risk associated with the customer, business relationship, or occasional transaction. Customer due diligence measures are therefore not a one-off check performed during onboarding. They cover the entire process, from understanding the customer and their structure, through assessing the relationship, to monitoring, updating information, and documenting the actions performed. In international terminology, this area is commonly referred to as Customer Due Diligence (CDD).

What do customer due diligence measures include?

The basic catalogue of customer due diligence measures is set out in Article 34 of the AML Act.

It includes four main elements:

1. Identification of the customer and verification of their identity.
   The institution establishes the required customer data and then confirms the customer’s identity on the basis of documents, data, or information obtained from a reliable and independent source. This is one of the fundamental elements of KYC and, in the case of business customers, also of the KYB process.
2. Identification of the beneficial owner and taking measures to verify their identity.
   In the case of a customer that is a legal person, an organisational unit without legal personality, or a trust, this also includes establishing the ownership and control structure. Data from KRS or CRBR may be used in the analysis, but they do not replace an independent determination of the beneficial owner.
3. Assessment of the business relationship and – where appropriate – obtaining information on its purpose and intended nature.
   The institution should understand not only who the customer is, but also why the customer is entering into the relationship and what type of activity can be expected within it.
4. Ongoing monitoring of the business relationship.
   This includes analysing transactions in the context of the institution’s knowledge of the customer, their business activity, and risk, updating the documents, data, and information held and – where justified by the circumstances – examining the source of funds or other assets available to the customer.

When applying measures concerning the customer and the beneficial owner, the institution also identifies the person authorised to act on behalf of the customer and verifies that person’s identity and authority. Customer due diligence measures therefore connect customer data with an analysis of who stands behind the relationship, what its purpose is, and whether subsequent activity remains consistent with the information held. Merely collecting a document or information does not yet mean that a customer due diligence measure has been properly applied. The information obtained must be appropriately verified and assessed.

When are customer due diligence measures applied?

Customer due diligence measures are applied primarily when establishing a business relationship. However, the obligation may also arise in other situations. These include, among other things:

• carrying out certain occasional transactions;
• suspicion of money laundering or terrorist financing;
• doubts as to the veracity or completeness of previously obtained customer identification data.

In the case of an occasional transaction, one of the basic thresholds is the equivalent of EUR 15,000 or more, regardless of whether that value is reached in a single operation or in several operations that appear to be linked. The Act also provides separate thresholds and rules for certain types of transactions and activities, so the obligation to apply customer due diligence measures should not be reduced to a single monetary threshold.

The measures also apply to customers with whom a relationship is already ongoing. In particular, the following may be relevant:

• a change in the nature or circumstances of the business relationship;
• a change in customer data;
• a change in the beneficial owner or the ownership and control structure;
• the emergence of new information affecting the risk;
• activity that deviates from the customer’s previous profile.

Onboarding starts the process of applying customer due diligence measures, but it does not end it.

How does risk affect the scope of customer due diligence measures?

Customer due diligence measures are applied taking into account a risk-based approach. An obliged institution should identify and assess the money laundering and terrorist financing risk associated with a specific relationship or occasional transaction and then adjust the scope and intensity of the measures taken accordingly.

Relevant factors may include, among other things:

• the type of customer;
• the nature of the customer’s business activity;
• the geographic area;
• the type of products and services;
• the way in which they are distributed;
• the intended use of the account;
• the value of the transaction;
• the purpose, regularity, and expected duration of the relationship.

However, a risk-based approach does not mean complete discretion.

Risk affects the scope and intensity of the measures, but it does not allow the institution to disregard the basic obligations arising from the Act. If the assessment confirms a lower risk of money laundering or terrorist financing, simplified due diligence measures (SDD) may be applied in certain cases. This does not mean that customer due diligence measures are not applied. Rather, the way in which they are applied is adjusted to the lower level of risk.

Where the risk is higher, enhanced due diligence measures (EDD) are applied, requiring an appropriate deepening of the analysis and monitoring. The Act also provides for situations in which enhanced measures are required because of specific risk factors. SDD and EDD are therefore not entirely separate from CDD. They are ways of adjusting the due diligence process to the identified level of risk.

Do customer due diligence measures end after the customer has been verified?

No. Ongoing monitoring of the business relationship is one of the fundamental customer due diligence measures. The institution should analyse transactions carried out within the relationship and assess whether they remain consistent with its knowledge of the customer, their business activity, and the assigned risk level. Information collected during KYC or KYB therefore provides a reference point for the subsequent analysis of activity.

If the customer declared a particular purpose of the relationship, type of business activity, scale of operations, or way of using a product, subsequent behaviour should be assessed in that context. Monitoring also includes ensuring that the documents, data, and information held remain up to date.

Changes to, among other things:

• the ownership structure;
• the beneficial owner;
• representation;
• the business profile;
• the nature of the relationship;
• the way products are used;
• the risk level

may require information to be updated or certain measures to be applied again.

Where justified by the circumstances, ongoing monitoring also includes examining the source of funds or other assets available to the customer. This does not mean that the source of funds must be examined to the same extent for every transaction. The scope of the measures should result from the circumstances and the identified risk. Onboarding makes it possible to build knowledge of the customer. Monitoring is intended to check whether that knowledge continues to reflect the actual course of the relationship.

Must customer due diligence measures be documented?

Yes. An obliged institution should document the customer due diligence measures applied and the results of the ongoing analysis of transactions carried out. It is therefore not sufficient merely to perform a particular check. The organisation should be able to demonstrate:

• what information it obtained;
• what actions it took;
• what sources it used;
• what risks it identified;
• what conclusions it reached;
• why the scope of the measures applied was appropriate;
• what decisions it made on the basis of the analysis performed.

This is particularly important in situations where the scope of the measures applied differs because of the level of risk. An AML process should lead not only to a decision, but also to the ability to reconstruct the basis on which that decision was made.

What should be done if customer due diligence measures cannot be applied?

An inability to apply a required customer due diligence measure triggers the consequences specified in the AML Act.

Depending on the situation, the obliged institution:

• does not establish a business relationship;
• does not carry out an occasional transaction;
• does not carry out a transaction through a bank account;
• terminates an existing business relationship.

The institution should also assess whether the inability to apply the measures constitutes grounds for submitting an appropriate notification to GIIF. The issue does not arise only when the customer expressly refuses to provide a document. It may also arise where the information obtained is insufficient, inconsistent, or unreliable and, despite the measures taken, does not allow the required due diligence measure to be properly applied.

For example, merely asking the customer about the beneficial owner, the purpose of the transaction, or the source of funds or other assets does not in itself mean that the obligation has been fulfilled if the response obtained has not been assessed or does not allow the required findings to be made.

The application of customer due diligence measures can therefore be simplified into the following process:

information → verification → analysis → risk assessment → decision → monitoring → updating → documentation.

Collecting information is the beginning of the process. A customer due diligence measure is properly applied when the information has been appropriately established, verified, and assessed in the context of risk.