# KYC and CDD Customer Profile: [Customer name]

> Customer due diligence (CDD) profile for one customer relationship:
> identification and verification of the customer and the people acting
> for it, beneficial ownership and control, purpose and intended nature
> of the relationship, source of funds and expected activity, politically
> exposed person (PEP), sanctions and adverse media screening, customer
> risk rating, the due diligence decision and the ongoing monitoring and
> periodic review record. Based on FATF Recommendations 10, 12 and 24
> (cited by number and title), the US Customer Identification Program
> rule (31 CFR 1020.220) and CDD Rule (31 CFR 1010.230), the current EU
> framework (Directive (EU) 2015/849 as transposed in national law) and
> the EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624
> (AMLR), which applies from 2027-07-10, and the UK Money Laundering
> Regulations 2017, as of 2026-10. Replace every `[bracketed]` value and
> every row marked *Example*. This is a document format, not legal,
> compliance or regulatory advice. Obtain the standard or law for the
> normative text and check current local law.

<!--
Guidance: How to use this template
- Purpose: one profile per customer that proves the institution knows
  who the customer is, who owns and controls it, why it wants the
  relationship and what activity to expect. Monitoring analysts,
  investigators, auditors and supervisors read this file first.
- Fill sections 1 to 4 at onboarding before the account is opened (or
  within the deferral your law allows), then sections 5 to 9 before
  the approval decision. Section 10 is a running log.
- Rate risk with the institution's approved methodology
  (Customer Risk Rating Methodology, `compliance/customer-risk-rating-methodology`);
  do not invent scores in this file. If the rating is high or a PEP or
  high-risk third country is involved, open an EDD memo
  (`compliance/edd-memo`) and link it here.
- The worked example is fictional: Fernhollow Bank (a fictional
  mid-sized EU credit institution) onboarding Quillmere Marine
  Supplies B.V. (a fictional wholesale distributor). All people and
  companies in the example are invented.
- Local-first: this editor stores the file in your browser. Keep real
  customer files in the institution's case management system and apply
  its retention and access rules; never paste real personal data into
  shared copies of the template.
- Common pitfall: a profile that lists documents collected but never
  states what the institution concluded (ownership understood, purpose
  plausible, activity expected), so it cannot be used to judge whether
  later transactions are unusual.
-->

## Document control

<!-- Guidance: The profile is a controlled record. The owner is the relationship or onboarding analyst; the reviewer is the KYC quality checker; the approver depends on the risk rating and your approval matrix. Record the version on every refresh so a reader can see which profile was in force when a transaction occurred. -->

| Field | Value |
|---|---|
| Document ID | [KYC-YYYY-NNNNN] (*Example:* KYC-2026-01482) |
| Customer ID | [Core banking customer number] |
| Customer legal name | [Name] (*Example:* Quillmere Marine Supplies B.V.) |
| Relationship type | [Retail / SME / Corporate / Financial institution / Private banking] |
| Booking entity | [Legal entity and branch] (*Example:* Fernhollow Bank, head office) |
| Version | [1.0] |
| Status | [Draft / Pending approval / Approved / Under review / Exited] |
| Owner | [@relationship-manager] |
| Approvers/reviewers | [@kyc-analyst], [@kyc-quality-checker], [@approver per matrix] |
| CDD level applied | [Simplified / Standard / Enhanced] |
| Risk rating | [Low / Medium / High] (see section 8) |
| Linked records | [EDD memo ID], [screening case IDs], [credit file ID] |
| Last updated | YYYY-MM-DD |
| Next review due | YYYY-MM-DD (see section 10) |
| Classification | Confidential: customer due diligence record, need-to-know |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| KYC analyst (preparer) | [@name] | [Complete] | YYYY-MM-DD |
| KYC quality checker | [@name] | [Pass / Return with comments] | YYYY-MM-DD |
| Approver (per risk matrix) | [@name] | [Approve / Approve with conditions / Decline] | YYYY-MM-DD |
| Senior management (high risk, PEP) | [@name] | [Approve / Decline] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@name] | Onboarding profile |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Trigger review after change of shareholder |
| 2.0 | YYYY-MM-DD | [@name] | *Example:* Periodic review, risk rating confirmed Medium |

## Contents

1. [Scope and legal basis](#1-scope-and-legal-basis)
2. [Customer identification](#2-customer-identification)
3. [Identity verification](#3-identity-verification)
4. [Beneficial ownership and control](#4-beneficial-ownership-and-control)
5. [Purpose and intended nature of the relationship](#5-purpose-and-intended-nature-of-the-relationship)
6. [Source of funds and expected activity](#6-source-of-funds-and-expected-activity)
7. [Screening: PEP, sanctions and adverse media](#7-screening-pep-sanctions-and-adverse-media)
8. [Customer risk rating](#8-customer-risk-rating)
9. [Due diligence decision and conditions](#9-due-diligence-decision-and-conditions)
10. [Ongoing monitoring and periodic review](#10-ongoing-monitoring-and-periodic-review)
11. [Records, data protection and confidentiality](#11-records-data-protection-and-confidentiality)
12. [Glossary and references](#12-glossary-and-references)
13. [Standard and licence note](#standard-and-licence-note)

## 1. Scope and legal basis

<!-- Guidance: State which rules this profile must satisfy. A bank in the EU applies national law transposing Directive (EU) 2015/849 today and the AMLR from 2027-07-10; a US branch applies the CIP and CDD rules; a UK entity applies the Money Laundering Regulations 2017. Pitfall: citing the AMLR as if it already applied. Until 2027-07-10 the binding text is your national transposing law. -->

This profile records the customer due diligence performed on one
customer by [Institution name]. It covers the measures that every
customer receives (identification, verification, beneficial ownership,
purpose and nature, ongoing monitoring) and records whether any
simplified or enhanced measures were applied. The institution's AML/CFT
policy (AML/CFT Programme Policy, `compliance/aml-cft-programme-policy`)
sets the standard; this file shows that the standard was met for this
customer.

Use the table below to record the rules that apply to the booking
entity. Keep the AMLR rows even before 2027-07-10 so that the profile
can be refreshed without a format change when the regulation applies.

| Jurisdiction | Rule (as of 2026-10, check local law) | Topic in this profile | Status |
|---|---|---|---|
| International | FATF Recommendation 10 (Customer due diligence) | Sections 2 to 6, 10 | Standard, implemented through national law |
| International | FATF Recommendation 12 (Politically exposed persons) | Section 7 | Standard |
| International | FATF Recommendations 24 and 25 (Transparency and beneficial ownership of legal persons and of legal arrangements) | Section 4 | Standard |
| EU (current) | Directive (EU) 2015/849 as amended, Arts 13 (CDD measures), 14 (timing), 18 to 24 (enhanced due diligence, PEPs), 40 (records), as transposed in [Member State] law | All | In force until 2027-07-09 via national law |
| EU (from 2027-07-10) | Regulation (EU) 2024/1624 (AMLR): Art. 19 (when to apply CDD), Art. 20 (CDD measures), Art. 22 (identification data), Art. 23 (timing of verification), Art. 25 (purpose and intended nature), Art. 26 (ongoing monitoring and update periods), Arts 51 to 55 (beneficial owners of legal entities), Art. 77 (record retention) | All | Applies from 2027-07-10 (Art. 90) |
| EU (pending) | AMLA regulatory technical standards on CDD information under AMLR Art. 28 | Sections 2 to 6 | Final draft submitted to the Commission in 2026-10; not yet adopted, check status |
| US | 31 CFR 1020.220 (Customer Identification Program for banks) | Sections 2, 3, 7, 11 | In force |
| US | 31 CFR 1010.230 (beneficial ownership of legal entity customers) | Section 4 | In force; FinCEN exceptive relief order of 2026-02-13 limits re-identification at each new account (optional, check order) |
| US | 31 CFR 1020.210 (AML programme including risk-based ongoing CDD) | Sections 8, 10 | In force; FinCEN programme NPRM of 2026-04-07 is a proposal only |
| UK | Money Laundering Regulations 2017 (SI 2017/692), regs 27 to 31 (CDD), reg. 5 (beneficial owner of body corporate), regs 33 and 35 (EDD, PEPs) | All | In force, check amendments |

## 2. Customer identification

<!-- Guidance: Capture the identifying data the rule requires before the relationship starts. Questions: is the legal name exactly as on the register? Is the registered office different from the principal place of business? Who is acting for the customer and on what authority? Pitfall: recording a trading name only, so screening runs on the wrong name. -->

Record the customer's identifying data exactly as it appears in the
source document or register. Where the customer is a legal entity,
identify the entity itself, its legal representatives and every person
who will act on its behalf, and confirm their authority. Where the
customer is a natural person, record the data for the individual and
for any attorney or guardian.

The minimum data differs slightly by jurisdiction. The US CIP rule
requires name, date of birth (individuals), address and an
identification number before account opening. The AMLR lists a wider
data set from 2027-07-10, including all names, place and date of birth,
nationalities and, for legal entities, the Legal Entity Identifier where
available. Collect the wider set when the booking entity is in the EU,
so that the profile is ready for the regulation.

### 2.1 Legal entity customer

| Field | Value |
|---|---|
| Registered legal name | [Name] (*Example:* Quillmere Marine Supplies B.V.) |
| Trading names | [Names] (*Example:* Quillmere Marine) |
| Legal form | [Form] (*Example:* private limited company) |
| Country of incorporation | [Country] (*Example:* Netherlands) |
| Registration number | [Number] (*Example:* 00000000, fictional) |
| Legal Entity Identifier (LEI) | [LEI or "none"] |
| Tax identification number | [TIN] |
| Registered office | [Address] |
| Principal place of business (if different) | [Address] |
| Date of incorporation | YYYY-MM-DD (*Example:* 2014-03-11) |
| Industry and activity code | [NACE / NAICS code and description] (*Example:* wholesale of marine hardware and safety equipment) |
| Listed or regulated status | [Exchange and ticker / Regulator and licence / None] |
| Website and public footprint | [URL] |

### 2.2 Legal representatives and authorised persons

| ID | Name | Role | Authority source | Identified and verified |
|---|---|---|---|---|
| REP-001 *(Example)* | Ana Reyes-Lowe | Managing director | Commercial register extract, YYYY-MM-DD | Yes, see VER-002 |
| REP-002 *(Example)* | Halden Voss | Director and signatory | Board resolution of YYYY-MM-DD | Yes, see VER-003 |
| REP-003 *(Example)* | Nils Okafor-Brandt | Finance manager, online banking user | Mandate form, signed by REP-001 | Yes, see VER-004 |

### 2.3 Natural person customer (use instead of 2.1 for individuals)

| Field | Value |
|---|---|
| Full name and all surnames | [Name] |
| Date and place of birth | YYYY-MM-DD, [Place] |
| Nationalities | [All nationalities, or statelessness] |
| National identification number | [Number, where applicable] |
| Residential address | [Address] |
| Tax identification number and tax residence | [TIN, country] |
| Occupation and employer | [Occupation] |

## 3. Identity verification

<!-- Guidance: Verification means checking the identifying data against a reliable, independent source. Record what you relied on, not only that you checked. Questions: was the person present, or verified remotely? If remote, which electronic identification means or remote onboarding solution was used? Pitfall: verifying the company but not the individuals acting for it. -->

Verify the identity of the customer, each legal representative, each
authorised person and each beneficial owner using reliable and
independent sources. For legal entities, an official register extract
dated close to onboarding is the usual primary source; for individuals,
a government-issued identity document or an electronic identification
means at a sufficient assurance level. Where a document is checked
remotely, record the liveness and document authenticity checks.

Record discrepancies and how they were resolved. Under the US CIP rule
the record must describe the documents relied on, the non-documentary
methods used and the resolution of any substantive discrepancy. Under
EU law, discrepancies between the information you hold and a central
beneficial ownership register must be reported to the register
authority (AMLR Art. 24 from 2027-07-10; national law today).

| ID | Subject | Method | Source and reference | Date | Result |
|---|---|---|---|---|---|
| VER-001 *(Example)* | Quillmere Marine Supplies B.V. | Register extract | Commercial register, extract no. [ref] | 2026-09-14 | Matches name, number, office, directors |
| VER-002 *(Example)* | REP-001 Ana Reyes-Lowe | Remote ID: passport chip read and liveness check | [Remote onboarding provider], session [ref] | 2026-09-15 | Verified |
| VER-003 *(Example)* | REP-002 / BO-003 Halden Voss | In-person ID document check | National identity card, branch [code] | 2026-09-16 | Verified |
| VER-004 *(Example)* | REP-003 Nils Okafor-Brandt | Remote ID | [Provider], session [ref] | 2026-09-16 | Verified |
| VER-005 *(Example)* | BO-001 Mirela Strand | Certified copy of passport plus address proof | Certified by notary, YYYY-MM-DD | 2026-09-18 | Verified |
| VER-006 *(Example)* | BO-002 Tomas Ekhart | Electronic identification (eIDAS notified scheme, high assurance) | [Scheme], transaction [ref] | 2026-09-18 | Verified |

Discrepancy log:

| ID | Discrepancy | Resolution | Reported to register |
|---|---|---|---|
| DIS-001 *(Example)* | Register lists Strand Holding Ltd at a former address | Customer provided updated register filing dated 2026-09-20 | Not required (address only, register updated by customer) |

## 4. Beneficial ownership and control

<!-- Guidance: Identify every natural person who ultimately owns or controls the customer and understand the structure. Calculate indirect ownership by multiplying through each layer and adding the chains. Pitfall: stopping at the first corporate shareholder, or recording "no beneficial owner" without naming the senior managing official. -->

Identify each natural person who ultimately owns or controls the
customer, take reasonable measures to verify their identity and record
how the ownership and control structure works. A beneficial owner may
hold an interest through ownership or exercise control by other means,
such as voting agreements, the right to appoint directors or family
arrangements.

Thresholds differ by regime and must be applied as written in the law
that binds the booking entity:

- **US CDD Rule (31 CFR 1010.230(d))**: each individual who directly
  or indirectly owns 25 percent or more of the equity interests
  (ownership prong), plus one individual with significant
  responsibility to control, manage or direct the entity (control
  prong). Certain entity types are excluded or subject to the control
  prong only.
- **EU, current law**: Directive (EU) 2015/849 treats a shareholding
  or ownership interest of more than 25 percent as an indication of
  ownership; check the national transposition, which may set a lower
  threshold.
- **EU, AMLR from 2027-07-10**: Art. 52 sets ownership of 25 percent
  or more of shares, voting rights or other ownership interest, with
  indirect holdings calculated by multiplying through the chain and
  adding all chains; Art. 53 covers control by other means; where no
  owner can be identified, the senior managing officials are recorded
  and the reason is documented. The Commission may set a lower
  threshold for categories of entity that present a higher risk
  (Art. 52(2)); check for delegated acts.
- **UK MLR 2017, reg. 5**: more than 25 percent of shares or voting
  rights, or control by other means.

Because the example below has three owners at exactly 30 percent, every
regime above treats them as beneficial owners. A holding of exactly 25
percent would qualify under the US rule and the AMLR, but not under a
"more than 25 percent" rule; record which test was applied.

```mermaid
flowchart TD
  MS["BO-001 Mirela Strand (individual)"] -->|50%| SH["Strand Holding Ltd (Malta, fictional)"]
  TE["BO-002 Tomas Ekhart (individual)"] -->|50%| SH
  SH -->|60%| Q["Quillmere Marine Supplies B.V. (customer)"]
  HV["BO-003 Halden Voss (individual)"] -->|30%| Q
  CT["Corran Family Trust (trustee: Lantern Trustees Ltd)"] -->|10%| Q
  AR["Ana Reyes-Lowe, managing director (senior managing official)"] -. control .-> Q
```

Indirect ownership in the example is calculated as the product of the
holdings along each chain:

$$
\text{Indirect share} = \prod_{k=1}^{n} s_k
$$

so Mirela Strand holds 50% x 60% = 30% and Tomas Ekhart holds
50% x 60% = 30%. Together with Halden Voss (30% direct) and the trust
(10%), the holdings sum to 100%.

| ID | Name | Nationality and residence | Direct % | Indirect % | Total % | Basis (ownership / control) | Verified | PEP |
|---|---|---|---|---|---|---|---|---|
| BO-001 *(Example)* | Mirela Strand | [Nationality], resident Malta | 0 | 30.0 | 30.0 | Ownership via Strand Holding Ltd | VER-005 | No |
| BO-002 *(Example)* | Tomas Ekhart | [Nationality], resident Netherlands | 0 | 30.0 | 30.0 | Ownership via Strand Holding Ltd | VER-006 | Yes, see section 7 |
| BO-003 *(Example)* | Halden Voss | [Nationality], resident Netherlands | 30.0 | 0 | 30.0 | Ownership, also director | VER-003 | No |
| CTL-001 *(Example)* | Ana Reyes-Lowe | [Nationality], resident Netherlands | 0 | 0 | 0 | Control prong / senior managing official | VER-002 | No |

Trust holding (10 percent): record the settlor, trustees, protector and
beneficiaries or class of beneficiaries even though the trust is below
the ownership threshold, because a trust layer is a complexity factor
in the risk rating. *Example:* Lantern Trustees Ltd (fictional
professional trustee) holds for the Corran Family Trust; beneficiaries
are the descendants of a fictional settlor, none of whom holds any
other interest in the customer.

| Question | Answer |
|---|---|
| Ownership structure understood and plausible for the business? | [Yes / No, explain] (*Example:* Yes; holding company used by two co-founders since 2018) |
| Nominee shareholders or directors? | [Yes / No] |
| Bearer shares or similar instruments? | [Yes / No] |
| Beneficial ownership register checked and consistent? | [Register, date, result] |
| Layers above two levels or in a high-risk third country? | [Yes / No] |
| US: certification of beneficial owners obtained (31 CFR 1010.230(b)) | [Yes / Not applicable] |

## 5. Purpose and intended nature of the relationship

<!-- Guidance: Write in your own words why the customer wants this relationship and why it makes sense. Questions: which products, which currencies, which counterparties, which countries? Is the size consistent with the customer's turnover? Pitfall: copying "business banking" as the purpose, which gives monitoring nothing to compare with. -->

Explain what the customer will use the relationship for and why the
institution considers that use credible. The AMLR (Art. 25, from
2027-07-10) expects the institution, where necessary, to obtain
information on the purpose and economic rationale, the estimated amount
of activity, the source and destination of funds and the customer's
business activity or occupation. Current national law and the US CDD
programme requirement expect a comparable understanding to build a
customer risk profile.

| Item | Customer's statement | Institution's assessment |
|---|---|---|
| Products requested | [Products] (*Example:* EUR and USD current accounts, SEPA and SWIFT payments, trade finance documentary collections, card acquiring) | [Assessment] (*Example:* Consistent with a wholesale distributor that imports from Asia and sells within the EU) |
| Business model | [Description] (*Example:* Buys marine safety equipment from manufacturers in South Korea and Türkiye, sells to chandleries and boatyards in the Netherlands, Germany and Denmark) | [Assessment] |
| Main counterparties | [Top suppliers and customers] | [Assessment] |
| Countries involved | [Countries] (*Example:* NL, DE, DK, KR, TR, MT) | [Assessment: any high-risk third country?] |
| Reason for choosing this institution | [Statement] (*Example:* Moving from another bank to obtain trade finance) | [Assessment] |
| Expected relationship length | [Years] | |

Narrative conclusion: [Two or three sentences stating whether the
purpose is clear, plausible and consistent with the customer's size
and ownership.] *Example:* The customer is an established wholesale
distributor with ten years of filed accounts. The requested products
match its import and distribution model. The move from another bank
is explained by a trade finance need; the previous bank's reference
letter is on file.

## 6. Source of funds and expected activity

<!-- Guidance: Source of funds is where the money in this relationship comes from; source of wealth is how the owners built their overall wealth. Source of wealth is normally required only under EDD (PEPs, high risk). Record expected volumes so monitoring can detect deviation. Pitfall: expected activity set so wide that nothing would ever look unusual. -->

Record where the funds that will flow through the relationship come
from and what volumes are expected. Source of funds describes the
origin of the money used in the relationship (for a trading company,
usually sales receipts and bank financing). Source of wealth describes
how the beneficial owners accumulated their total wealth and is
collected under enhanced due diligence; when it is needed, document it
in the EDD memo and summarise it here.

| Item | Value |
|---|---|
| Primary source of funds | [Source] (*Example:* Customer receipts from EU trade buyers) |
| Secondary sources | [Source] (*Example:* Shareholder loan from Strand Holding Ltd, EUR 400,000, agreement dated 2025-11-03) |
| Evidence | [Documents] (*Example:* Filed 2025 financial statements, revenue EUR 18.4 million; aged receivables list) |
| Initial deposit and origin | [Amount and remitting account] |
| Source of wealth (EDD only) | [Summary or "not required"] (*Example:* Required for BO-002 as a PEP, see EDD-2026-0311) |

Expected activity profile (monthly, EUR):

| Activity | Expected count | Expected value | Main counterparties or countries |
|---|---|---|---|
| Incoming SEPA credit transfers *(Example)* | 180 | 1,450,000 | NL, DE, DK customers |
| Outgoing international transfers *(Example)* | 25 | 1,050,000 | Suppliers in KR and TR |
| Outgoing SEPA payments (payroll, rent, taxes) *(Example)* | 70 | 260,000 | NL |
| Cash deposits *(Example)* | 0 | 0 | Not expected; any cash is a deviation |
| Card acquiring settlements *(Example)* | 22 | 90,000 | Webshop sales, EU cardholders |

Annualised, the example inflows are 12 x (1,450,000 + 90,000) =
EUR 18,480,000, consistent with filed revenue of EUR 18.4 million.
Recompute this check whenever the profile is refreshed.

## 7. Screening: PEP, sanctions and adverse media

<!-- Guidance: Screen the customer, every beneficial owner, legal representative and authorised person, and material counterparties named in section 5. Record the list versions and the decision on each potential match. Pitfall: screening the company name only and missing an owner who is designated or politically exposed. -->

Screen every subject named in this profile against the sanctions lists
that bind the booking entity (UN, EU, national, and US OFAC lists where
the institution has US exposure or US dollar clearing), against a PEP
database and for adverse media. Sanctions screening must also consider
ownership and control: the AMLR (Art. 20(1)(d), from 2027-07-10)
requires checking whether designated persons control the customer or
hold more than 50 percent of it, and the US OFAC 50 percent rule treats
entities owned 50 percent or more in aggregate by blocked persons as
blocked. The sanctions procedure (`compliance/sanctions-compliance-procedure`)
sets matching rules and escalation.

A PEP is an individual entrusted with a prominent public function, and
their family members and known close associates. Any PEP among the
customer, beneficial owners or representatives requires senior
management approval, measures to establish source of wealth and source
of funds, and enhanced ongoing monitoring (FATF R.12; Directive (EU)
2015/849 Arts 20 to 23 via national law; AMLR Art. 42 from 2027-07-10;
UK MLR reg. 35). A person who leaves a prominent function remains
subject to risk-based measures for at least 12 months under the AMLR
(Art. 45). These measures apply to domestic and foreign PEPs alike under
EU and UK law. In the UK, reg. 35(3A) (inserted by SI 2023/1371 from
2024-01-10) makes a lower level of risk the starting point for a
domestic PEP, which lightens the extent of EDD but does not remove it.

| ID | Subject | Screening type | Lists or sources and version | Date | Potential matches | Disposition |
|---|---|---|---|---|---|---|
| SCR-001 *(Example)* | Quillmere Marine Supplies B.V. | Sanctions | EU consolidated list, UN list, OFAC SDN (list dates on case) | 2026-09-18 | 0 | Clear |
| SCR-002 *(Example)* | Strand Holding Ltd | Sanctions and ownership | As SCR-001 | 2026-09-18 | 1 (name similarity) | False positive: different registration number and country, case SAN-2026-7781 |
| SCR-003 *(Example)* | BO-002 Tomas Ekhart | PEP | [PEP data provider] | 2026-09-18 | 1 | True match: domestic PEP, member of the national parliament since 2023-12; EDD required |
| SCR-004 *(Example)* | All individuals | Adverse media | [News database], search terms on file | 2026-09-19 | 2 articles | Not relevant: articles concern a sailing regatta sponsorship |
| SCR-005 *(Example)* | Top five suppliers | Sanctions | As SCR-001 | 2026-09-19 | 0 | Clear |

## 8. Customer risk rating

<!-- Guidance: Apply the approved methodology and record the inputs, the score and any override. The rating sets the CDD level and the review frequency. Pitfall: a manual override to "low" without a documented reason and approver. -->

Rate the customer with the approved customer risk rating methodology
(`compliance/customer-risk-rating-methodology`). Record each factor
score, the weighted result, any automatic high-risk trigger and any
override. A PEP, a link to a high-risk third country identified by the
European Commission, or a correspondent relationship are typical
automatic triggers for enhanced due diligence; check your methodology
for the exact list.

The example applies the institution's approved methodology exactly as
written (Customer Risk Rating Methodology,
`compliance/customer-risk-rating-methodology`, sections 3 and 4): four
factor groups scored 1 to 4, group weights customer 35%, geography 25%,
product 25% and channel 15%, and bands Low 1.00 to 1.79, Medium 1.80 to
2.59 and High 2.60 to 4.00. The group score is the sub-weighted average
of its sub-factor scores; the composite is the weighted sum of the group
scores:

$$
S = 0.35\,G_{\text{cust}} + 0.25\,G_{\text{geo}} + 0.25\,G_{\text{prod}} + 0.15\,G_{\text{chan}}
$$

| Group | Sub-factor scores and sub-weights *(Example)* | Group score $G$ | Weight | Contribution | Reason |
|---|---|---|---|---|---|
| Customer (legal entity scorecard) | Ownership 3 x 0.30; industry 2 x 0.30; PEP connection 3 x 0.20; adverse media 1 x 0.20 | 0.90 + 0.60 + 0.60 + 0.20 = 2.30 | 0.35 | 0.805 | Trust in the ownership chain (ownership 3); standard commercial sector (industry 2); BO-002 is a domestic PEP (PEP connection 3); no relevant media |
| Geography | Incorporation 1 x 0.50; counterparties 2 x 0.50 | 0.50 + 1.00 = 1.50 | 0.25 | 0.375 | Incorporated in NL; suppliers in KR and TR and holding in MT, none a score-3 or score-4 jurisdiction |
| Product and service | Highest product score = 3 | 3.00 | 0.25 | 0.750 | Trade finance and card acquiring both score 3 |
| Delivery channel | Face to face = 1 | 1.00 | 0.15 | 0.150 | Relationship opened in branch with signatory REP-002 present; remote checks used only for other individuals |
| **Composite** | | | **1.00** | **2.08** | Medium band |

Check: 0.805 + 0.375 + 0.750 + 0.150 = 2.08. Had the relationship been
opened remotely with electronic identification (channel score 2), the
composite would be 2.23, still Medium. The PEP match on BO-002 meets
automatic trigger TRG-01 of the methodology (any PEP, domestic or
foreign, among customers, beneficial owners or authorised persons), so
the final rating is **High** with enhanced due diligence, whatever the
composite score. Store the composite anyway: the EDD analyst uses it to
size the enhanced measures, and model validation uses it to test the
scorecard.

| Item | Value |
|---|---|
| Calculated rating | [Low / Medium / High] (*Example:* Medium, 2.08) |
| Automatic triggers | [List] (*Example:* TRG-01, PEP beneficial owner) |
| Override | [None / Up / Down, reason, approver] |
| Final rating | [Rating] (*Example:* High) |
| CDD level | [Simplified / Standard / Enhanced] (*Example:* Enhanced, EDD-2026-0311) |

## 9. Due diligence decision and conditions

<!-- Guidance: Record a clear decision with reasons and any conditions. If CDD cannot be completed, the law requires the institution not to open the relationship (or to end it) and to consider a suspicious activity or transaction report. Pitfall: approving "subject to documents" and never tracking the missing documents. -->

State whether the relationship is accepted and on what conditions. If
the institution cannot complete CDD, it must not establish the
relationship or carry out the transaction and must terminate an
existing relationship, and it must consider whether to report
suspicion to the financial intelligence unit (Directive (EU) 2015/849
Art. 14(4) via national law; AMLR Art. 21 from 2027-07-10; UK MLR
reg. 31). Record any refusal, because the AMLR also requires records
of refused relationships to be kept (check the Art. 77 text).

| Item | Value |
|---|---|
| Decision | [Accept / Accept with conditions / Decline / Exit] |
| Rationale | [Two or three sentences] |
| Conditions | [Conditions with owners and dates] |
| Approver and authority level | [@name, role, matrix level] |
| Senior management approval (PEP or high risk) | [@name, date, reference] |
| Report to FIU considered? | [Not applicable / Yes, case reference] |

| ID | Condition | Owner | Due | Status |
|---|---|---|---|---|
| CON-001 *(Example)* | Obtain signed shareholder loan agreement from Strand Holding Ltd | [@rm] | 2026-10-31 | Open |
| CON-002 *(Example)* | No cash deposits without prior approval from compliance | [@kyc] | Ongoing | Active |
| CON-003 *(Example)* | Review after first six months of trade finance activity | [@rm] | 2027-04-30 | Scheduled |

*Example decision:* Accepted with conditions on 2026-09-30 by the head of
corporate banking and approved by a member of senior management because
BO-002 is a PEP. The structure is explained, ownership is verified
through registers and certified documents, and expected activity
reconciles to filed revenue. Enhanced monitoring applies for the
duration of the PEP status and at least 12 months after it ends.

## 10. Ongoing monitoring and periodic review

<!-- Guidance: CDD does not end at onboarding. Set the review date from the risk rating and list the events that force an earlier review. Under the AMLR the gap between updates must not exceed 1 year for customers under enhanced measures and 5 years for all others. Pitfall: reviews that copy the previous profile without testing actual activity against section 6. -->

Monitor the relationship continuously so that transactions stay
consistent with what the institution knows about the customer, its
business, its risk profile and, where necessary, its source of funds.
Review and update the profile on a schedule set by the risk rating and
whenever a trigger event occurs. From 2027-07-10 the AMLR (Art. 26)
caps the interval between updates at 1 year for higher-risk customers
under enhanced measures and 5 years for all others; current national
law and your policy may be stricter. In the US, ongoing CDD under
31 CFR 1020.210 is risk-based; the FinCEN exceptive relief order of
2026-02-13 lets covered institutions identify beneficial owners at
first account opening and then again only when facts call the
information into question or risk-based monitoring requires it.

| Rating | Review frequency *(Example policy)* | Scope |
|---|---|---|
| High | Every 12 months | Full refresh, EDD memo update, activity review against section 6 |
| Medium | Every 36 months | Full refresh, activity review |
| Low | Every 60 months | Data refresh and screening confirmation |

Trigger events that force an early review: change of ownership or
control, new PEP status, sanctions designation of a connected party,
material adverse media, a suspicious activity or transaction report,
activity well outside the expected profile, a request for a new
higher-risk product, and a change in the customer's country links.

| ID | Date | Type | Findings | Rating after review | Reviewer |
|---|---|---|---|---|---|
| REV-001 *(Example)* | 2027-03-15 | Trigger: TM alert on cash deposit | Single deposit of EUR 9,500 explained as boat show takings; supported by event invoices; condition CON-002 breached and escalated | High (unchanged) | [@kyc] |
| REV-002 *(Example)* | 2027-09-30 | Periodic (12 months) | Volumes within 15% of profile; BO-002 still a PEP; EDD memo refreshed | High (unchanged) | [@kyc] |

Activity versus profile (complete at each review):

| Activity | Expected monthly value | Actual average | Variance | Explanation |
|---|---|---|---|---|
| Incoming SEPA *(Example)* | 1,450,000 | 1,610,000 | +11.0% | Seasonal peak before summer |
| Outgoing international *(Example)* | 1,050,000 | 1,120,000 | +6.7% | Within tolerance |

## 11. Records, data protection and confidentiality

<!-- Guidance: State where the evidence lives and how long it is kept. Data protection law limits what you collect to what CDD needs; retention rules then decide how long you keep it. Pitfall: keeping copies of identity documents in personal mailboxes or shared drives outside the retention schedule. -->

Keep the profile, the evidence listed in sections 3 and 4, the
screening results, the risk rating and the decision in the
institution's customer records system. Retention periods apply from
the end of the relationship: five years under Directive (EU) 2015/849
Art. 40 via national law (Member States may extend), five years under
the AMLR Art. 77 from 2027-07-10 (counted from termination of the
relationship, the occasional transaction or the refusal to enter into
it), five years after account closure for US CIP identifying data and
five years after the record is made for verification records, and five
years under UK MLR reg. 40. Personal data collected for CDD is
processed under the AML legal obligation and must not be reused for
unrelated purposes without a separate legal basis.

Never disclose to the customer or third parties that a suspicious
activity or transaction report has been filed or is being considered
(tipping-off prohibition). Keep any reporting decisions in the
restricted case file, not in this profile; record only the case
reference where your procedure allows it.

| Record | System and location | Retention trigger | Retention period |
|---|---|---|---|
| This profile and versions | [CLM system] | End of relationship | [5 years or longer per national law] |
| Identity and verification evidence | [Document store] | End of relationship | [Period] |
| Screening results and dispositions | [Screening system] | End of relationship | [Period] |
| Refusal record (if declined) | [CLM system] | Date of refusal | [Period] |

## 12. Glossary and references

<!-- Guidance: Keep definitions short and in your own words. Point to your internal policy for the binding definitions. -->

| Term | Meaning in this profile |
|---|---|
| Beneficial owner | Natural person who ultimately owns or controls the customer, or on whose behalf a transaction is carried out |
| CDD | Customer due diligence: identify, verify, understand ownership, purpose and nature, monitor |
| CIP | US Customer Identification Program under 31 CFR 1020.220 |
| EDD | Enhanced due diligence: extra measures for higher risk, PEPs and high-risk third countries |
| High-risk third country | Country identified by the European Commission (or by your national authority) as having strategic AML/CFT deficiencies |
| PEP | Politically exposed person, with family members and known close associates |
| SDD | Simplified due diligence: reduced measures where lower risk is established and the law allows |
| Senior managing official | Person recorded as beneficial owner when no owner meets the threshold, or the control person under the US rule |
| Source of funds | Origin of the money used in the relationship or transaction |
| Source of wealth | How a person built their total net worth |

References (obtain current versions):

- FATF Recommendations 10, 12, 24 and 25 (cited by number and title only).
- Directive (EU) 2015/849, as amended by Directive (EU) 2018/843, and the [Member State] transposing law.
- Regulation (EU) 2024/1624 (AMLR), OJ L, 2024-06-19, applies from 2027-07-10, EUR-Lex.
- Directive (EU) 2024/1640 (AMLD6), repealing Directive (EU) 2015/849 from 2027-07-10, EUR-Lex.
- 31 CFR 1020.220 (CIP for banks), 31 CFR 1010.230 (beneficial ownership), 31 CFR 1020.210 (AML programme for banks), eCFR.
- FinCEN order granting exceptive relief from the CDD Rule beneficial ownership requirements, 2026-02-13 (check the order text on fincen.gov).
- UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692), legislation.gov.uk.
- Related templates: Customer Risk Rating Methodology (`compliance/customer-risk-rating-methodology`), EDD Memo (`compliance/edd-memo`), Sanctions Compliance Procedure (`compliance/sanctions-compliance-procedure`), AML/CFT Programme Policy (`compliance/aml-cft-programme-policy`), AML Business Risk Assessment (`compliance/aml-business-risk-assessment`), Transaction Monitoring Scenario Specification (`compliance/transaction-monitoring-scenario-spec`), Correspondent Banking Due Diligence (`compliance/correspondent-banking-due-diligence`), GDPR Records of Processing (`compliance/gdpr-ropa`).

## Standard and licence note

Based on public law: US federal regulations in 31 CFR Chapter X (US
government works) and the FinCEN order of 2026-02-13; EU legislation
from EUR-Lex (Directive (EU) 2015/849 and Regulation (EU) 2024/1624),
reused with acknowledgement under Commission Decision 2011/833/EU and
summarised in original wording; and the UK Money Laundering Regulations
2017 cited by regulation number. FATF Recommendations and AMLA drafts
are cited by number and name only; no text from them is reproduced. This
template is not affiliated with or endorsed by FinCEN, the European
Commission, AMLA, the FATF or any supervisor. All names, companies and
figures in the examples are fictional. This template is original text
written for this collection. Check the current official version of each
law and your national transposition before use. Template licence: MIT.