KYC and CDD Customer Profile Template (EU AMLR, US CDD Rule)

KYC and CDD Customer Profile: [Customer name]

Customer due diligence (CDD) profile for one customer relationship: identification and verification of the customer and the people acting for it, beneficial ownership and control, purpose and intended nature of the relationship, source of funds and expected activity, politically exposed person (PEP), sanctions and adverse media screening, customer risk rating, the due diligence decision and the ongoing monitoring and periodic review record. Based on FATF Recommendations 10, 12 and 24 (cited by number and title), the US Customer Identification Program rule (31 CFR 1020.220) and CDD Rule (31 CFR 1010.230), the current EU framework (Directive (EU) 2015/849 as transposed in national law) and the EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624 (AMLR), which applies from 2027-07-10, and the UK Money Laundering Regulations 2017, as of 2026-10. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, compliance or regulatory advice. Obtain the standard or law for the normative text and check current local law.

Document control

Approvals

Revision history

Contents

1. Scope and legal basis
2. Customer identification
3. Identity verification
4. Beneficial ownership and control
5. Purpose and intended nature of the relationship
6. Source of funds and expected activity
7. Screening: PEP, sanctions and adverse media
8. Customer risk rating
9. Due diligence decision and conditions
10. Ongoing monitoring and periodic review
11. Records, data protection and confidentiality
12. Glossary and references
13. Standard and licence note

1. Scope and legal basis

This profile records the customer due diligence performed on one customer by [Institution name]. It covers the measures that every customer receives (identification, verification, beneficial ownership, purpose and nature, ongoing monitoring) and records whether any simplified or enhanced measures were applied. The institution's AML/CFT policy (AML/CFT Programme Policy, compliance/aml-cft-programme-policy) sets the standard; this file shows that the standard was met for this customer.

Use the table below to record the rules that apply to the booking entity. Keep the AMLR rows even before 2027-07-10 so that the profile can be refreshed without a format change when the regulation applies.

2. Customer identification

Record the customer's identifying data exactly as it appears in the source document or register. Where the customer is a legal entity, identify the entity itself, its legal representatives and every person who will act on its behalf, and confirm their authority. Where the customer is a natural person, record the data for the individual and for any attorney or guardian.

The minimum data differs slightly by jurisdiction. The US CIP rule requires name, date of birth (individuals), address and an identification number before account opening. The AMLR lists a wider data set from 2027-07-10, including all names, place and date of birth, nationalities and, for legal entities, the Legal Entity Identifier where available. Collect the wider set when the booking entity is in the EU, so that the profile is ready for the regulation.

2.1 Legal entity customer

2.2 Legal representatives and authorised persons

2.3 Natural person customer (use instead of 2.1 for individuals)

3. Identity verification

Verify the identity of the customer, each legal representative, each authorised person and each beneficial owner using reliable and independent sources. For legal entities, an official register extract dated close to onboarding is the usual primary source; for individuals, a government-issued identity document or an electronic identification means at a sufficient assurance level. Where a document is checked remotely, record the liveness and document authenticity checks.

Record discrepancies and how they were resolved. Under the US CIP rule the record must describe the documents relied on, the non-documentary methods used and the resolution of any substantive discrepancy. Under EU law, discrepancies between the information you hold and a central beneficial ownership register must be reported to the register authority (AMLR Art. 24 from 2027-07-10; national law today).

Discrepancy log:

4. Beneficial ownership and control

Identify each natural person who ultimately owns or controls the customer, take reasonable measures to verify their identity and record how the ownership and control structure works. A beneficial owner may hold an interest through ownership or exercise control by other means, such as voting agreements, the right to appoint directors or family arrangements.

Thresholds differ by regime and must be applied as written in the law that binds the booking entity:

• US CDD Rule (31 CFR 1010.230(d)): each individual who directly or indirectly owns 25 percent or more of the equity interests (ownership prong), plus one individual with significant responsibility to control, manage or direct the entity (control prong). Certain entity types are excluded or subject to the control prong only.
• EU, current law: Directive (EU) 2015/849 treats a shareholding or ownership interest of more than 25 percent as an indication of ownership; check the national transposition, which may set a lower threshold.
• EU, AMLR from 2027-07-10: Art. 52 sets ownership of 25 percent or more of shares, voting rights or other ownership interest, with indirect holdings calculated by multiplying through the chain and adding all chains; Art. 53 covers control by other means; where no owner can be identified, the senior managing officials are recorded and the reason is documented. The Commission may set a lower threshold for categories of entity that present a higher risk (Art. 52(2)); check for delegated acts.
• UK MLR 2017, reg. 5: more than 25 percent of shares or voting rights, or control by other means.

Because the example below has three owners at exactly 30 percent, every regime above treats them as beneficial owners. A holding of exactly 25 percent would qualify under the US rule and the AMLR, but not under a "more than 25 percent" rule; record which test was applied.

Indirect ownership in the example is calculated as the product of the holdings along each chain:

so Mirela Strand holds 50% x 60% = 30% and Tomas Ekhart holds 50% x 60% = 30%. Together with Halden Voss (30% direct) and the trust (10%), the holdings sum to 100%.

Trust holding (10 percent): record the settlor, trustees, protector and beneficiaries or class of beneficiaries even though the trust is below the ownership threshold, because a trust layer is a complexity factor in the risk rating. Example: Lantern Trustees Ltd (fictional professional trustee) holds for the Corran Family Trust; beneficiaries are the descendants of a fictional settlor, none of whom holds any other interest in the customer.

5. Purpose and intended nature of the relationship

Explain what the customer will use the relationship for and why the institution considers that use credible. The AMLR (Art. 25, from 2027-07-10) expects the institution, where necessary, to obtain information on the purpose and economic rationale, the estimated amount of activity, the source and destination of funds and the customer's business activity or occupation. Current national law and the US CDD programme requirement expect a comparable understanding to build a customer risk profile.

Narrative conclusion: [Two or three sentences stating whether the purpose is clear, plausible and consistent with the customer's size and ownership.] Example: The customer is an established wholesale distributor with ten years of filed accounts. The requested products match its import and distribution model. The move from another bank is explained by a trade finance need; the previous bank's reference letter is on file.

6. Source of funds and expected activity

Record where the funds that will flow through the relationship come from and what volumes are expected. Source of funds describes the origin of the money used in the relationship (for a trading company, usually sales receipts and bank financing). Source of wealth describes how the beneficial owners accumulated their total wealth and is collected under enhanced due diligence; when it is needed, document it in the EDD memo and summarise it here.

Expected activity profile (monthly, EUR):

Annualised, the example inflows are 12 x (1,450,000 + 90,000) = EUR 18,480,000, consistent with filed revenue of EUR 18.4 million. Recompute this check whenever the profile is refreshed.

7. Screening: PEP, sanctions and adverse media

Screen every subject named in this profile against the sanctions lists that bind the booking entity (UN, EU, national, and US OFAC lists where the institution has US exposure or US dollar clearing), against a PEP database and for adverse media. Sanctions screening must also consider ownership and control: the AMLR (Art. 20(1)(d), from 2027-07-10) requires checking whether designated persons control the customer or hold more than 50 percent of it, and the US OFAC 50 percent rule treats entities owned 50 percent or more in aggregate by blocked persons as blocked. The sanctions procedure (compliance/sanctions-compliance-procedure) sets matching rules and escalation.

A PEP is an individual entrusted with a prominent public function, and their family members and known close associates. Any PEP among the customer, beneficial owners or representatives requires senior management approval, measures to establish source of wealth and source of funds, and enhanced ongoing monitoring (FATF R.12; Directive (EU) 2015/849 Arts 20 to 23 via national law; AMLR Art. 42 from 2027-07-10; UK MLR reg. 35). A person who leaves a prominent function remains subject to risk-based measures for at least 12 months under the AMLR (Art. 45). These measures apply to domestic and foreign PEPs alike under EU and UK law. In the UK, reg. 35(3A) (inserted by SI 2023/1371 from 2024-01-10) makes a lower level of risk the starting point for a domestic PEP, which lightens the extent of EDD but does not remove it.

8. Customer risk rating

Rate the customer with the approved customer risk rating methodology (compliance/customer-risk-rating-methodology). Record each factor score, the weighted result, any automatic high-risk trigger and any override. A PEP, a link to a high-risk third country identified by the European Commission, or a correspondent relationship are typical automatic triggers for enhanced due diligence; check your methodology for the exact list.

The example applies the institution's approved methodology exactly as written (Customer Risk Rating Methodology, compliance/customer-risk-rating-methodology, sections 3 and 4): four factor groups scored 1 to 4, group weights customer 35%, geography 25%, product 25% and channel 15%, and bands Low 1.00 to 1.79, Medium 1.80 to 2.59 and High 2.60 to 4.00. The group score is the sub-weighted average of its sub-factor scores; the composite is the weighted sum of the group scores:

Check: 0.805 + 0.375 + 0.750 + 0.150 = 2.08. Had the relationship been opened remotely with electronic identification (channel score 2), the composite would be 2.23, still Medium. The PEP match on BO-002 meets automatic trigger TRG-01 of the methodology (any PEP, domestic or foreign, among customers, beneficial owners or authorised persons), so the final rating is High with enhanced due diligence, whatever the composite score. Store the composite anyway: the EDD analyst uses it to size the enhanced measures, and model validation uses it to test the scorecard.

9. Due diligence decision and conditions

State whether the relationship is accepted and on what conditions. If the institution cannot complete CDD, it must not establish the relationship or carry out the transaction and must terminate an existing relationship, and it must consider whether to report suspicion to the financial intelligence unit (Directive (EU) 2015/849 Art. 14(4) via national law; AMLR Art. 21 from 2027-07-10; UK MLR reg. 31). Record any refusal, because the AMLR also requires records of refused relationships to be kept (check the Art. 77 text).

Example decision: Accepted with conditions on 2026-09-30 by the head of corporate banking and approved by a member of senior management because BO-002 is a PEP. The structure is explained, ownership is verified through registers and certified documents, and expected activity reconciles to filed revenue. Enhanced monitoring applies for the duration of the PEP status and at least 12 months after it ends.

10. Ongoing monitoring and periodic review

Monitor the relationship continuously so that transactions stay consistent with what the institution knows about the customer, its business, its risk profile and, where necessary, its source of funds. Review and update the profile on a schedule set by the risk rating and whenever a trigger event occurs. From 2027-07-10 the AMLR (Art. 26) caps the interval between updates at 1 year for higher-risk customers under enhanced measures and 5 years for all others; current national law and your policy may be stricter. In the US, ongoing CDD under 31 CFR 1020.210 is risk-based; the FinCEN exceptive relief order of 2026-02-13 lets covered institutions identify beneficial owners at first account opening and then again only when facts call the information into question or risk-based monitoring requires it.

Trigger events that force an early review: change of ownership or control, new PEP status, sanctions designation of a connected party, material adverse media, a suspicious activity or transaction report, activity well outside the expected profile, a request for a new higher-risk product, and a change in the customer's country links.

Activity versus profile (complete at each review):

11. Records, data protection and confidentiality

Keep the profile, the evidence listed in sections 3 and 4, the screening results, the risk rating and the decision in the institution's customer records system. Retention periods apply from the end of the relationship: five years under Directive (EU) 2015/849 Art. 40 via national law (Member States may extend), five years under the AMLR Art. 77 from 2027-07-10 (counted from termination of the relationship, the occasional transaction or the refusal to enter into it), five years after account closure for US CIP identifying data and five years after the record is made for verification records, and five years under UK MLR reg. 40. Personal data collected for CDD is processed under the AML legal obligation and must not be reused for unrelated purposes without a separate legal basis.

Never disclose to the customer or third parties that a suspicious activity or transaction report has been filed or is being considered (tipping-off prohibition). Keep any reporting decisions in the restricted case file, not in this profile; record only the case reference where your procedure allows it.

12. Glossary and references

References (obtain current versions):

• FATF Recommendations 10, 12, 24 and 25 (cited by number and title only).
• Directive (EU) 2015/849, as amended by Directive (EU) 2018/843, and the [Member State] transposing law.
• Regulation (EU) 2024/1624 (AMLR), OJ L, 2024-06-19, applies from 2027-07-10, EUR-Lex.
• Directive (EU) 2024/1640 (AMLD6), repealing Directive (EU) 2015/849 from 2027-07-10, EUR-Lex.
• 31 CFR 1020.220 (CIP for banks), 31 CFR 1010.230 (beneficial ownership), 31 CFR 1020.210 (AML programme for banks), eCFR.
• FinCEN order granting exceptive relief from the CDD Rule beneficial ownership requirements, 2026-02-13 (check the order text on fincen.gov).
• UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692), legislation.gov.uk.
• Related templates: Customer Risk Rating Methodology (compliance/customer-risk-rating-methodology), EDD Memo (compliance/edd-memo), Sanctions Compliance Procedure (compliance/sanctions-compliance-procedure), AML/CFT Programme Policy (compliance/aml-cft-programme-policy), AML Business Risk Assessment (compliance/aml-business-risk-assessment), Transaction Monitoring Scenario Specification (compliance/transaction-monitoring-scenario-spec), Correspondent Banking Due Diligence (compliance/correspondent-banking-due-diligence), GDPR Records of Processing (compliance/gdpr-ropa).

Standard and licence note

Based on public law: US federal regulations in 31 CFR Chapter X (US government works) and the FinCEN order of 2026-02-13; EU legislation from EUR-Lex (Directive (EU) 2015/849 and Regulation (EU) 2024/1624), reused with acknowledgement under Commission Decision 2011/833/EU and summarised in original wording; and the UK Money Laundering Regulations 2017 cited by regulation number. FATF Recommendations and AMLA drafts are cited by number and name only; no text from them is reproduced. This template is not affiliated with or endorsed by FinCEN, the European Commission, AMLA, the FATF or any supervisor. All names, companies and figures in the examples are fictional. This template is original text written for this collection. Check the current official version of each law and your national transposition before use. Template licence: MIT.