What enhanced due diligence is
Every regulated payment provider carries out customer due diligence: it identifies the client, establishes who owns and controls it, understands the purpose of the relationship and screens the people involved. For most relationships, that standard level is enough.
Enhanced due diligence, usually shortened to EDD, is what happens when the provider's risk assessment concludes that a relationship presents a higher risk of money laundering or terrorist financing. Canadian law requires reporting entities to take enhanced measures for high-risk clients. In broad terms, these measures cover three areas: taking further steps to verify identity and the information held, keeping that information updated more often, and monitoring the relationship more closely.
EDD is not a finding of wrongdoing. Many entirely legitimate businesses sit in categories that call for it, simply because their sector, structure or geography carries more inherent risk. A licensed gaming operator, a family office with a discretionary trust and a broker serving clients across several continents can all expect EDD as a matter of course. What matters is that the provider ends up with a clear, documented understanding of the client and its money.
When it applies
Each provider sets out in its own risk assessment which factors make a relationship high risk. Common triggers include:
- Politically exposed persons. Where a client or beneficial owner is a foreign politically exposed person, Canadian law requires specific steps, including senior management approval and measures to establish the source of funds or wealth. Domestic politically exposed persons and heads of international organisations, and their family members and close associates, call for these steps where the relationship is assessed as high risk.
- Sector. Businesses with higher inherent risk, such as gaming, brokerage, adult entertainment, defence and certain commodities, are frequently placed in a higher risk category.
- Structure. Multi-layer ownership, trusts with discretionary beneficiaries, nominee arrangements or entities in jurisdictions with limited public registers.
- Geography. Connections to countries identified by FATF as having strategic deficiencies, or to countries subject to sanctions or ministerial directives.
- Ownership that cannot be confirmed. Where beneficial ownership cannot be obtained or confirmed, the provider must treat the entity as high risk.
- Activity. Transactions that are unusually large, complex or out of line with the client's stated business.
What it involves in practice
EDD builds on the standard file. The extra work typically includes some or all of the following:
- Source of funds: evidence of where the money for specific transactions comes from, such as trading revenue, a capital injection, a loan or the sale of an asset.
- Source of wealth: for individuals behind the client, an account of how their overall wealth was built, supported by documents.
- Business understanding: a detailed description of the business model, main counterparties, expected payment flows by currency, country and volume, and how the business earns its revenue.
- Licences and regulatory status: copies of operating licences, confirmation that they are current, and details of the regulator.
- Adverse media and background checks on the entity and the key individuals.
- Senior approval: sign-off by a senior manager or the compliance officer before the relationship is accepted.
- Enhanced monitoring: lower thresholds for transaction review, more frequent periodic reviews and closer scrutiny of new counterparties.
The provider may also hold a video call with directors or beneficial owners, ask for financial statements, or request copies of key contracts.
Source of funds and source of wealth: an example
The two terms are often confused. A short, illustrative example helps.
A holding company owned by one individual wants to convert EUR 2 million into US dollars and pay it to a property developer as part of an acquisition.
Source of funds concerns this money. The provider wants to see where the EUR 2 million came from. Suppose the company received it from the sale of a minority stake in an operating business. The evidence might be the sale agreement, the completion statement and a bank statement showing receipt of the proceeds.
Source of wealth concerns the individual behind the company. The provider wants to know how the owner came to hold the stake in the first place, and how the owner built the wider wealth that supports a transaction of this size. The answer might be twenty years building an engineering business, evidenced by company accounts, a summary of shareholdings and press coverage of the business.
Both answers should be consistent with each other and with everything else on file. If the owner's documented career does not plausibly support the wealth involved, the provider will ask further questions before proceeding.
Examples from higher-risk sectors
Each sector raises its own questions. These examples are illustrative, not exhaustive.
- iGaming operators. Expect requests for the gaming licence and the regulator's details, the markets the operator accepts players from, how it blocks restricted markets, and how operator funds are kept separate from player funds. A provider serving the operator at business level will want to confirm that it is not handling player money.
- CFD brokers. The provider will ask about the broker's licence, how client money is held and segregated, the use of introducing brokers or affiliates, and the jurisdictions from which retail clients are onboarded.
- Adult entertainment. Typical questions cover age and consent verification for performers and users, content moderation, chargeback history and the payment flows between platforms, studios and creators.
- Defence. The provider will want export permits, end-user information, the identity of the end customer and confirmation that the goods and destinations comply with export controls and sanctions.
- Physical trade. Expect requests for contracts, invoices, bills of lading and the names of vessels and ports, particularly where goods could be dual-use or routes pass near sanctioned regions.
Examples from complex structures
Structures attract EDD when they make it harder to see who is behind the money. Common examples include:
- Discretionary trusts. Beneficiaries may be a class rather than named people. The provider will want the trust deed or certified extracts, details of the trustee, the settlor and any protector, and information on distributions made.
- Multi-layer holdings across several jurisdictions. The provider will want registers for each layer and a clear explanation of why each entity exists, for example asset protection, a fund requirement or a historical acquisition.
- Private trust companies and foundations. These raise questions about who controls the board or council and who benefits.
- Nominee arrangements. The nominee agreement and identification of the person the nominee acts for.
- Family offices. The provider will want to understand the family, the source of the family's wealth, the office's governance, and which family members can instruct payments.
None of these structures is improper. They do, however, need to be explained, and the explanation should come with documents rather than assurances.
EDD does not stop at onboarding
A relationship classed as high risk stays under closer watch for as long as it is classed that way. Ongoing EDD typically means:
- Periodic reviews on a shorter cycle than lower-risk clients, with refreshed documents such as good standing certificates, licences and identification.
- Transaction monitoring with lower thresholds, so more payments are reviewed by a person.
- Requests for supporting documents on larger or unusual payments, such as an invoice, contract or board resolution.
- Reassessment when anything material changes: new owners, a new licence, entry into a new market or a significant change in volumes.
Risk ratings can move in both directions. A client that has been open, consistent and well documented over a period of time may be reassessed. A client whose activity drifts away from its stated profile, or who answers questions slowly or partially, may find its rating going up.
What the outcome can be
EDD leads to a decision. The usual outcomes are:
- Acceptance on the provider's standard terms, with the relationship rated high risk and monitored accordingly.
- Acceptance with conditions, such as limits on volumes or corridors, a requirement to provide documents with each payment above a set size, or exclusion of certain counterparties.
- A request for more information before a decision can be made.
- Decline. A provider may decide that the risk is outside its appetite, or that it cannot obtain enough information to manage it.
A provider is not obliged to explain every reason for a decline, and the tipping-off rule may limit what it can say in some cases. A decline from one provider does not mean that no provider will take the business. Specialist providers that understand particular sectors often have both the appetite and the expertise for relationships that a generalist will not take on.
How to prepare
The best way through EDD is preparation. A well-organised client can often turn a long exchange of emails into a single review. Before applying, assemble:
- A one-page description of the business, the payment flows and the reasons for the structure.
- An ownership chart with percentages and voting rights for every layer, and registers to support it.
- Identification for directors, signatories and beneficial owners.
- Current licences and the regulators' contact details.
- Recent financial statements or management accounts.
- A source of wealth summary for each main beneficial owner, with supporting documents.
- Evidence of source of funds for the first significant transactions.
- For trusts, the deed and any supplemental deeds, and details of the trustee.
Answer every question fully. Where a document does not exist, say so and offer an alternative. Consistency across documents matters more than volume.
Before you act
This article is general information about enhanced due diligence. It is not legal advice, and each provider applies its own risk assessment and procedures.
CCYFX provides Foreign exchange, International payments, Collections and payouts, and Digital asset conversion for businesses. Our onboarding page lists what we typically ask for, and our guide to beneficial ownership in layered structures may help you prepare your ownership documents.
