September 21, 2026

What Triggers an EDD Review (and How to Run One)

Axle Team

Key takeaways

EDD reviews trigger two ways: at onboarding, when the customer risk profile is high, and event-driven during the relationship, when monitoring surfaces a material change.
The FFIEC manual names concrete trigger events — unexplained activity changes, ownership changes, law enforcement inquiries, negative news, and elapsed time since the last review.
There is no categorical requirement to refresh customer information on a fixed schedule; the requirement is risk-based and event-driven. Most programs still set periodic cycles for high-risk customers and should document why.
A defensible EDD file answers four questions: who the customer really is, where the money comes from, whether activity matches expectations, and why you are keeping (or exiting) the relationship.

The enhanced due diligence process is the additional, risk-based investigation a financial institution runs on higher-risk customers: refreshing KYC and beneficial ownership, verifying source of funds and wealth, re-running sanctions, PEP, and adverse media screening, and documenting a keep-or-exit recommendation. It triggers at onboarding for high-risk profiles and afterward whenever monitoring detects a material change in the relationship.

When the enhanced due diligence process is triggered

Under FinCEN's CDD Rule, every covered institution must understand the nature and purpose of customer relationships, build a customer risk profile, and conduct ongoing monitoring. EDD is what that framework demands at the high end of the risk spectrum. The FFIEC BSA/AML Examination Manual states the expectation directly:

"Information provided by higher risk profile customers and their transactions should be reviewed more closely at account opening and more frequently throughout the term of their relationship with the bank."
— FFIEC BSA/AML Examination Manual, Customer Due Diligence — Overview (May 2018)

That gives you the first trigger class: risk-profile-driven. If the customer risk rating is high at onboarding — because of geography, industry, ownership structure, product usage, or expected activity — the enhanced due diligence process starts before the account does. Some customer types also carry standing regulatory EDD mandates: foreign correspondent accounts and private banking accounts under 31 CFR 1010.610 and 1010.620, plus supervisory expectations for politically exposed persons and money services businesses.

The second trigger class is event-driven. The FFIEC manual lists the factors that should prompt a relationship review, including:

Significant and unexplained changes in account activity
Changes in employment or business operation
Changes in ownership of a business entity
Red flags identified through suspicious activity monitoring
Law enforcement inquiries and requests such as criminal subpoenas, National Security Letters, and section 314(a) requests
Results of negative media search programs
Length of time since customer information was gathered and the customer risk profile assessed

What regulators require — and what they leave to you

FinCEN's CDD Rule sets the floor. In FinCEN's own words: "The CDD Rule has four core requirements. It requires covered financial institutions to establish and maintain written policies and procedures that are reasonably designed to" identify and verify customers, identify and verify beneficial owners of legal entity customers, understand the nature and purpose of relationships to develop customer risk profiles, and "conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information."

Note what is absent: a mandated refresh calendar. The FFIEC manual is explicit on this point:

"The ongoing monitoring element does not impose a categorical requirement that the bank must update customer information on a continuous or periodic basis."
— FFIEC BSA/AML Examination Manual, Customer Due Diligence — Overview (May 2018)

In practice, most programs still run periodic reviews for high-risk relationships — partly because "length of time since customer information was gathered" is itself a listed trigger, and partly because examiners expect you to catch changes your event feeds miss. The manual also warns why getting the risk rating right matters:

"Improper identification and assessment of a customer's risk can have a cascading effect, creating deficiencies in multiple areas of internal controls and resulting in an overall weakened BSA compliance program."
— FFIEC BSA/AML Examination Manual, Customer Due Diligence — Overview (May 2018)

How to run an EDD review, step by step

Scope the review and state the risk rationale. Record what triggered the review and which risk factors it must resolve. A review that opens without a question rarely closes with an answer.
Refresh identity and beneficial ownership. Reconfirm legal identity, then re-verify beneficial owners at the 25% ownership threshold and the control prong. Check registry data against what the customer told you at onboarding.
Verify source of funds and source of wealth. The FFIEC manual lists the information to consider for higher-risk customers: source of funds and wealth, occupation or type of business, financial statements, where the business is organized and operates, primary trade area, and expected domestic versus international volumes.
Re-run the screening sweep. Sanctions, PEP, and adverse media on the customer, beneficial owners, and connected parties — and adjudicate the hits rather than pasting raw results into the file.
Review activity against the expected profile. Compare actual transaction patterns to the nature-and-purpose baseline. Unexplained deviation is either a documentation gap or a risk signal — the review decides which.
Write the narrative and recommendation. State findings, unresolved gaps, and a clear position: retain, retain with conditions or a rating change, or exit. An examiner should be able to reconstruct your reasoning from the file alone.
Route for approval and set the next trigger. Update the risk rating through your documented approval chain, log any SAR referral separately, and schedule the next review date or the monitoring conditions that will reopen the file.

A practitioner's note on why EDD reviews stall

The slowest part of a periodic EDD review is rarely the analysis — it is assembly and outreach. The internal-data portion of a file is often finished on day one, and then the whole review sits open for weeks waiting on a source-of-funds document from the customer. Split the workflow: run the internal refresh (registries, screening, activity review) immediately, and put customer outreach on its own track with its own SLA. Rate the risk on what you have, flag the file as pending documents, and stop letting the outreach clock hold the entire review — and your aging metrics — hostage.

Where AI agents fit

Most of an EDD review is retrieval, cross-checking, and writing — exactly the work AI agents absorb well. Axle's agents run enhanced due diligence reviews end to end: assembling the file from registries and internal systems, running the screening sweep the way Baley adjudicates watchlist hits, and drafting the narrative and recommendation for a human to approve. If you are weighing where agents fit your due diligence operation, the AI readiness playbook is a practical place to start.

FAQ

How often should enhanced due diligence be refreshed?

No U.S. rule sets a fixed interval — the FFIEC manual states there is no categorical periodic-update requirement. The obligation is event-driven and risk-based. In practice, many institutions set annual or similar cycles for high-risk relationships, since elapsed time is itself a listed review factor; whatever cadence you choose, document the rationale.

What is the difference between CDD and EDD?

CDD is the baseline for every customer: identity, beneficial ownership, nature and purpose, risk profile, ongoing monitoring. EDD is the deeper layer applied when the risk profile warrants it — more information, closer review, more frequent refresh. For some relationship types, such as foreign correspondent and private banking accounts, specific EDD measures are mandated by regulation rather than left to risk appetite.

What should an EDD file contain?

The trigger and scope, refreshed identity and ownership data, source of funds and wealth evidence, adjudicated screening results, an activity-versus-expectation analysis, and a signed narrative with a retain-or-exit recommendation and the next review trigger. If a reviewer cannot reconstruct the decision from the file, the file is not done.

If your EDD backlog is growing faster than your team, see how Axle runs enhanced due diligence reviews with AI agents.

What Triggers an EDD Review (and How to Run One)

More from the blog