A client has been identified as higher risk.

So what happens next?

Perhaps you ask for more information. You obtain additional details about the transaction. You investigate source of funds or source of wealth. You carry out further searches. Maybe the matter is referred for senior management approval.

More checks are completed. More evidence is collected. The file gets bigger. But here is the question I think we sometimes forget to ask:

What are we actually trying to achieve?

Because enhanced due diligence should not simply mean doing more due diligence.

It should mean having a thorough understanding of the risk.

Why is this client higher risk?

That sounds like an obvious question, but it is probably the most important place to start.

A client might require enhanced due diligence because they are a Politically Exposed Person.

Another might have connections to a higher-risk jurisdiction.

Another might sit behind a complicated corporate structure involving several companies, trusts or jurisdictions.

The transaction itself might be unusually large or complex.

Or perhaps something simply doesn’t make sense or raises suspicion.

All of these could justify looking deeper.

But they don’t necessarily justify looking for the same things.

And that distinction matters.

If the concern is geographical exposure, the additional enquiries should help you understand that exposure.

If the concern is an unusually complex corporate structure, the enquiries should help establish who ultimately owns or controls it, why the structure exists and whether there is a credible commercial rationale behind it.

If the client is a PEP, the nature of their political exposure, source of wealth, source of funds and the potential for corruption may become particularly important.

If the transaction itself appears unusual, then perhaps the real question is why it is happening at all.

EDD should be a response to the risk you have identified, not simply a predetermined bundle of additional checks. So, the EDD itself should be directed by the risk that was presented.

More information does not always translate to better understanding

There is a natural tendency in compliance to equate additional evidence with additional comfort. If something concerns us, we ask for another document. Then perhaps another. And another. Eventually we have a substantial file. But do we have a better understanding?

Quantity of information does not necessarily translate into quality of understanding.

Take source of funds as an example.

Knowing that £250,000 is sitting in a client’s bank account tells you that the money exists. It doesn’t necessarily tell you where it came from.

• Was it accumulated savings?
• A property sale?
• An inheritance?
• Business income?
• A loan?
• A transfer from another person?

More importantly does the evidence support the explanation?

Source of wealth asks a different, although related, question. It looks more broadly at how the client accumulated their overall wealth.

Someone might be able to demonstrate precisely where the money for a particular transaction came from while still leaving unanswered questions about how they acquired that wealth in the first place. In addition, even if they can justify the capital sum does their income and source of wealth support a transaction such as this?

The objective shouldn’t simply be to obtain something that can be put on file under the heading Source of Funds.

The objective is to understand the story behind the money and decide whether that story makes sense.

Never forget complexity can itself be information

Whilst complexity isn’t evidence of criminality, it should always be considered.

There are perfectly legitimate commercial, tax, investment and family reasons why individuals and businesses use holding companies, trusts and multi-jurisdictional structures.

But complexity can still tell us something.

Suppose identifying the ultimate beneficial owner requires working through four companies across three jurisdictions.

The compliance objective shouldn’t simply be to keep searching until a name eventually appears at the end.

We should also be asking:

• Why is the structure this complicated?
• Does the explanation make commercial sense?
• Does the ownership structure match what the client has told us?
• Can we actually identify the people who ultimately own or control it?
• Is there an obvious reason for the jurisdictions involved?
• Or does every answer simply lead to another layer?

Sometimes the explanation will be entirely reasonable.

Sometimes it won’t.

And sometimes the inability to obtain a clear explanation may itself become relevant to our assessment of the risk.

That is the very point of EDD.

Not simply to uncover more information, but to understand what that information means.

What if nothing is technically wrong?

I think this is where professional judgement becomes particularly important. AML isn’t always about finding a document that proves something is right or wrong. Often there won’t be one.

The identity document might be genuine. The company might genuinely exist. The beneficial owners might have been identified. The money might genuinely be sitting in a regulated bank account.

None of those things necessarily answers the question that caused the client or matter to be considered higher risk. Sometimes it is the combination of perfectly legitimate facts that deserves further thought.

• Why is this person using this company?
• Why is this company in that jurisdiction?
• Why is this transaction being structured in this particular way?
• Why is the money coming from somewhere different to where we expected?
• Why is somebody apparently unconnected to the matter providing the funds?

There may be perfectly reasonable answers to every one of those questions. But EDD is about being sufficiently curious to ask them. But to get to that level you first have to understand the risk flags that started you on the path.

EDD shouldn’t end when the client is onboarded

There is another potential trap. We carry out enhanced due diligence. We came to a satisfactory conclusion. The client is approved. EDD complete.

Except, of course, the risk that required EDD hasn’t necessarily disappeared simply because the onboarding process has finished.

The Money Laundering Regulations require enhanced ongoing monitoring in relevant higher-risk situations as well as enhanced due diligence. So if a risk was sufficient to trigger EDD in the first place, it stands to reason that it should remain part of your ongoing monitoring for as long as it remains relevant.

Clients change. Companies change. Beneficial ownership and business activities change. Geographical exposure can shift, new adverse information can emerge, and people can become PEPs or find themselves subject to sanctions.

The risk you understood when the relationship began may not be the risk you are dealing with a year or two later.

EDD therefore shouldn’t simply be viewed as a higher hurdle that a client needs to clear at onboarding.

It is part of an ongoing understanding of the relationship.

Could somebody else understand your decision?

There is one final test that I think is particularly useful and one I often see missed time and time again.

Imagine somebody completely independent opens your file in two years’ time. Your MLRO, an auditor, the regulator or worse the police. Could they understand your reasoning from what they see within the documentation and notes?

Or will they just see a file stuffed with paper upon paper with no apparent rationale for why decisions were taken?

• Why was this client or matter considered higher risk?
• What specifically were you concerned about?
• What additional enquiries did you make?
• Why did you make those particular enquiries?
• What did you discover?

And, most importantly:

Why were you ultimately satisfied to proceed?

If the file contains 50 documents but cannot answer those questions, I’m not convinced that adding document number 51 necessarily makes the due diligence any better.

Because the audit trail should demonstrate more than the fact that a process took place.

It should demonstrate the thinking behind it.

What are you actually looking for?

Perhaps that is the question we should ask more often when carrying out enhanced due diligence.

Not:

What else do we need to collect?

But:

What are we trying to understand?

Once we know that, the additional checks become much easier to determine.

EDD isn’t about treating every higher-risk client as suspicious.

Nor is it about creating the biggest possible compliance file.

It is about identifying the particular risk in front of you, asking the questions that help you understand it, considering the answers with appropriate professional scepticism and being able to explain why you reached the decision you did.

Because a thick file doesn’t necessarily demonstrate good compliance.

It might simply demonstrate that you collected a lot of information.

EDD shouldn’t be about proving that you did more.

It should be about demonstrating that you understood more.