Enhanced Due Diligence (EDD) Memo Template (PEP, High-Risk Country)

Enhanced Due Diligence Memo: [Customer name]

Enhanced due diligence (EDD) memo for one customer relationship or occasional transaction that presents higher money laundering or terrorist financing risk: the trigger (politically exposed person, high-risk third country, complex or unusual structure or transaction, or another higher-risk factor), the analysis, source of wealth and source of funds corroboration, adverse media, mitigation measures, senior management approval, the enhanced monitoring plan and the decision. Based on FATF Recommendations 10, 12 and 19 (cited by number and title), the current EU framework (Directive (EU) 2015/849 as transposed in national law), the EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624 (AMLR), which applies from 2027-07-10, the UK Money Laundering Regulations 2017 and US rules for private banking and correspondent accounts (31 CFR 1010.610 and 1010.620), as of 2026-10. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, compliance or regulatory advice. Obtain the standard or law for the normative text and check current local law.

Document control

Approvals

Revision history

Contents

1. EDD trigger and legal basis
2. Customer and relationship summary
3. Higher-risk factor analysis
4. Source of wealth
5. Source of funds
6. Adverse media and open-source findings
7. Risk conclusion
8. Mitigation measures and conditions
9. Senior management approval
10. Enhanced monitoring plan
11. Decision and rationale
12. Glossary and references
13. Standard and licence note

1. EDD trigger and legal basis

Record every reason EDD applies. Laws require EDD in defined cases and in any other case the institution's own risk assessment identifies as higher risk. The list below covers the cases most institutions meet. Tick each that applies and record the specific mandatory measures in section 8.

2. Customer and relationship summary

Summarise the customer, the relationship requested and the people involved. Link to the KYC profile for the detail.

3. Higher-risk factor analysis

3.1 Politically exposed person

Describe the prominent public function and whether it gives the person influence that could be abused for corruption or misuse of public funds. Member States publish lists of the functions they treat as prominent public functions (AMLR Art. 43 requires such lists). Consider whether the customer's business deals with the public body the PEP serves, whether the PEP's family or close associates are involved, and how long ago the function started or ended. Under the AMLR (Art. 45), the institution keeps applying risk-based measures for at least 12 months after a person stops holding the function and until it judges that no further PEP-specific risk remains.

EDD applies to domestic and foreign PEPs alike: neither EU law (national law transposing AMLD4 now, the AMLR from 2027-07-10) nor UK law lets the institution skip enhanced measures because a PEP is domestic. The category still changes the extent of the measures. In the UK, MLR 2017 reg. 35(3A), inserted by SI 2023/1371 from 2024-01-10, makes a lower level of risk the starting point for domestic PEPs and their family members and known close associates, so the EDD applied is normally less than for a non-domestic PEP unless other enhanced risk factors are present. Record the category and, where the measures are lighter, the reasoning.

3.2 High-risk third country

For each country link, record whether it is on the European Commission's list of high-risk third countries (or your national list), on an FATF public statement, or subject to sanctions, and which flows touch it. For EU institutions the current list is set by Commission delegated regulation under Directive (EU) 2015/849; from 2027-07-10 the AMLR (Arts 29 to 31) gives the Commission power to identify countries and to specify which enhanced measures and countermeasures apply to each. Check the current list on the date of the memo.

3.3 Complex structure or unusual transactions

Explain every layer of the ownership structure and the business reason for it. A holding company may be used for estate planning, investor protection or tax reasons that are lawful; the question is whether the reason is documented, whether it obscures who controls the customer and whether any layer sits in a country with weak transparency rules. For an unusual transaction, record its background and purpose, the counterparties and why the amount or pattern differs from the profile.

3.4 Other higher-risk factors

List any other factor from the risk rating (product, channel, industry, cash intensity, new technology) and state whether it changes the measures needed. Example: Trade finance with suppliers outside the EU raises trade-based money laundering risk; the bank applies document review on each collection and price plausibility checks on a sample of invoices.

4. Source of wealth

Establish how each PEP or high-risk subject accumulated their wealth. For a PEP the law requires adequate measures to establish both source of wealth and source of funds (FATF R.12; Dir. (EU) 2015/849 Art. 20 via national law; AMLR Art. 42(1)(b) from 2027-07-10). Start from the subject's own declaration, break it into components, and corroborate each material component with documents from independent or public sources. Explain any gap.

Narrative: [State whether the declared wealth is consistent with the person's career, age and public income, and whether any part remains unexplained.] Example: Total declared wealth of EUR 3.2 million is consistent with an entrepreneur who sold a business in 2019 and co-founded the customer. The components backed by independent records (SOW-001, SOW-003 and SOW-004) total EUR 2,100,000, which is 65.6% of the declared total. The remaining 34.4% (SOW-002) is an estimate of a private holding, judged reasonable against the customer's filed accounts. Public income since 2023 is modest relative to the total and explains only part of SOW-004. No unexplained component remains.

4.1 Evidence quality

Rank evidence by independence and reliability. Strongest are records created by a third party for its own purposes: notarised sale agreements matched to bank receipts, land registry entries, probate or inheritance deeds, audited accounts and tax assessments. Next are documents prepared by professionals who owe duties to others, such as a lawyer's or accountant's letter confirming a specific transaction. Weakest are documents produced by the customer alone, such as a self-prepared wealth statement or a spreadsheet of past income. Use public sources to test plausibility: a company sale should be visible in the register, a property in the land registry, a public salary in the published pay scale. Where evidence cannot be obtained, say why, describe the alternative work done and let the approver decide whether the gap is acceptable. Never fill a gap with an assumption that is not labelled as one.

5. Source of funds

Identify the origin of the money that will enter the relationship: the initial deposit, any capital injection and the recurring flows. For a trading company, compare expected inflows with filed revenue; for a capital injection by an owner, trace it to the owner's account and to the wealth component it comes from.

Check: twelve months of expected recurring receipts total 12 x 1,540,000 = EUR 18,480,000, which reconciles to filed revenue within 0.5% (18,480,000 / 18,400,000 = +0.43%).

6. Adverse media and open-source findings

Search public sources for each EDD subject: news databases, court and insolvency registers, regulatory enforcement lists, procurement records where the subject is a PEP, and corporate registers for undisclosed interests. Record the search terms and languages so the search can be repeated at the next review. Assess each finding for credibility (reliable source or not), relevance (financial crime, corruption, sanctions, fraud, tax evasion) and recency.

Search log: [terms, languages, databases, date, analyst].

7. Risk conclusion

State the inherent risk, the evidence that explains it and the residual risk after mitigation. Compare the residual risk with the institution's risk appetite for this customer type, as set in the AML business risk assessment (compliance/aml-business-risk-assessment).

Conclusion: [Three to five sentences.] Example: The relationship is high risk because a beneficial owner is a domestic PEP and the ownership includes a foreign holding and a trust. The wealth of the PEP is mostly built before office and is corroborated by independent records for 65.6% of the declared total, with the remainder supported by a reasonable valuation. No link exists between the PEP's function and the customer's revenue. Residual risk is within appetite if the monitoring in section 10 is applied.

8. Mitigation measures and conditions

Map every trigger to the measures applied. The AMLR (Art. 34(4), from 2027-07-10) lists the menu of enhanced measures: more information on the customer and beneficial owners, on the intended nature of the relationship, on source of funds and source of wealth, and on the reasons for transactions; senior management approval; enhanced monitoring with more frequent controls; and a first payment through an account in the customer's name at an institution with comparable CDD standards. Current national law under Directive (EU) 2015/849 Art. 18 and UK MLR reg. 33 set a similar risk-based expectation.

9. Senior management approval

Obtain approval from senior management before establishing the relationship and, for an existing customer who becomes a PEP, before continuing it. The approver should be independent of the sales target for this customer and should receive this memo in full. Record any questions asked and the answers given.

10. Enhanced monitoring plan

Set out what changes in monitoring for this customer while EDD applies. Typical changes are lower alert thresholds, additional scenarios linked to the trigger (for a PEP, payments involving public bodies or unusual cash), periodic manual review of a sample of transactions and more frequent screening. Confirm that the changes are configured in the monitoring system, and record the configuration reference. The scenario design itself belongs in the transaction monitoring specification (compliance/transaction-monitoring-scenario-spec).

PEP status end: [Record the end date of the function and the earliest date on which the PEP measures may be reconsidered.] Example: If the term ends in 2028-03, PEP measures continue to at least 2029-03, then continue until the bank concludes that no further PEP-specific risk remains.

11. Decision and rationale

Record the decision, the reasons and the conditions. If the institution cannot complete EDD, or the residual risk is outside appetite, it must not establish (or must end) the relationship and must consider whether to report suspicion to the financial intelligence unit. Do not tell the customer that a report has been considered or made.

Communicate the outcome to the customer in neutral terms. When the relationship is accepted with conditions, tell the customer which documents or behaviours the conditions require, such as annual shareholder confirmations, without disclosing internal risk scores. When the relationship is declined or ended, give the reason your policy allows and keep the full rationale in this memo. If a report to the financial intelligence unit has been made or is being considered, the decline letter must not hint at it.

At each annual refresh, repeat sections 3 to 7 with current facts, compare actual activity with the profile and the monitoring results from section 10, and record whether every condition was met. A refresh that only updates the date is not a review.

12. Glossary and references

References (obtain current versions):

• FATF Recommendations 10, 12 and 19 (cited by number and title only).
• Directive (EU) 2015/849 as amended, Arts 18, 18a and 20 to 23, and the [Member State] transposing law; the Commission delegated regulation listing high-risk third countries (current consolidated version).
• Regulation (EU) 2024/1624 (AMLR), Arts 29 to 31, 34, 35, 41 to 46, applies from 2027-07-10, EUR-Lex.
• EBA Guidelines on ML/TF risk factors (EBA/GL/2021/02), as amended.
• UK Money Laundering Regulations 2017 (SI 2017/692), regs 33 and 35; FCA guidance on the treatment of PEPs (FG17/6, name only).
• 31 CFR 1010.605 (definitions, including senior foreign political figure), 31 CFR 1010.620 (private banking accounts), eCFR.
• Related templates: KYC and CDD Customer Profile (compliance/kyc-cdd-profile), Customer Risk Rating Methodology (compliance/customer-risk-rating-methodology), AML Business Risk Assessment (compliance/aml-business-risk-assessment), Transaction Monitoring Scenario Specification (compliance/transaction-monitoring-scenario-spec), SAR and STR Narrative (compliance/sar-str-narrative), Sanctions Compliance Procedure (compliance/sanctions-compliance-procedure), Correspondent Banking Due Diligence (compliance/correspondent-banking-due-diligence).

Standard and licence note

Based on public law: EU legislation from EUR-Lex (Directive (EU) 2015/849 and Regulation (EU) 2024/1624), reused with acknowledgement under Commission Decision 2011/833/EU and summarised in original wording; US federal regulations in 31 CFR Chapter X (US government works); and the UK Money Laundering Regulations 2017 cited by regulation number. FATF Recommendations, EBA guidelines and FCA guidance are cited by number and name only; no text from them is reproduced. This template is not affiliated with or endorsed by the European Commission, the EBA, the FCA, FinCEN, AMLA or the FATF. All names, companies and figures in the examples are fictional. This template is original text written for this collection. Check the current official version of each law and your national transposition before use. Template licence: MIT.