Enhanced Due Diligence

Customer due diligence is not one procedure applied identically to everyone. The IFSCA Guidelines run three settings off a single risk rating:

• rated low → simplified CDD
• rated medium → standard CDD
• rated high → standard CDD plus enhanced CDD

Enhanced Due Diligence is that top setting. It is never a substitute for ordinary CDD — the Guidelines say the enhanced measures are undertaken in addition to the measures under clause 5.4, not instead of them.

And the risk rating has to be assigned before due diligence begins, not discovered during it.

Where the risks of ML/TF are high, a Regulated Entity shall conduct enhanced CDD measures consistent with the risks identified. There are six:

1. Obtain additional information on the customer — occupation, volume of assets, information from public databases — and update the identification data of customer and beneficial owner more regularly.
2. Take additional steps to examine the ownership and financial position, including source of wealth and source of funds of the customer or the beneficial owner.
3. Record the purpose behind the specified transaction and the intended nature of the relationship between the transaction parties.
4. Obtain the approval of Senior Management to commence or continue the business relationship.
5. Conduct enhanced monitoring — increasing the number and timing of controls and selecting patterns of transactions needing further examination.
6. Require the first payment to be carried out through an account in the customer's own name with a bank subject to similar CDD standards.

That first-payment account must be with a Bank; or a regulated financial institution whose entire operations are supervised for AML/CFT in a jurisdiction equivalent to FATF standards; or a subsidiary of such an institution where the parent's law ensures the subsidiary observes the same standards.

EDD is mandatory for PEPs, where the additional measures include collecting the source of wealth and income of family members, beneficial owners and close relatives, verifying identity before accepting the PEP as a customer, and obtaining Senior Management approval before opening the account or making any payout. If an existing customer subsequently becomes a PEP, Senior Management approval is needed to continue the relationship. EDD is also required, proportionate to the risks, for persons from countries for which FATF calls for it.

Risk rating also drives how often the file is refreshed. Periodic updation runs annually for high risk, once in three years for medium, once in five years for low — or, for a resident Indian customer with an existing relationship with the Financial Group in India, two, eight and ten years respectively. Where the Financial Group's rating differs from the Regulated Entity's, the stricter of the two periodicities applies.

On 9 January 2026 a GIFT IFSC banking unit is approached by Mr Dalmar Osei, a former deputy energy minister of a foreign state who stepped down in 2023, to open an account and place USD 12 million.

He is a PEP who has stepped down — and the Guidelines expressly let the Regulated Entity take a risk-based view of such a person, considering the level of influence he may continue to exercise. The unit rates him high, so the file runs:

Eighteen months later the monitoring throws an alert: USD 2.3 million arrives from an unassociated third party in a grey-listed jurisdiction. Because he is high risk, that alert is escalated, the purpose is documented, and the Principal Officer decides on the STR — due within seven working days of concluding that the transaction is suspicious.

Had the unit instead rated Mr Osei low and applied simplified CDD, it would have broken an explicit rule: SCDD shall not be conducted where there is a suspicion of ML/TF, and simplified measures are unacceptable wherever specific higher-risk scenarios apply.

Chapter 6 (section 6.5) lists the six enhanced measures, and the Chapter 5 sample question — "obtaining the approval of Senior Management to commence or continue the business relationship is a measure specified under which process?" — has Enhanced Due Diligence as its answer. Chapter 6's own sample question asks when EDD must be performed, with "all of the above" covering high risk, PEPs and PEPs who have stepped down. The periodic updation cycles in section 6.10 are a separate, very examinable set of numbers.

• EDD is in addition to CDD, never instead of it. Six extra measures on top of the four standard ones.
• Senior Management approval is the signature measure of EDD — it is the distractor-proof answer when a question describes it without naming the process.
• Simplified CDD is forbidden wherever there is a suspicion of ML/TF, regardless of how low the customer's rating was.
• The risk rating comes first. Customer risk assessment is completed before due diligence for a new customer, and the rating and its reasons must be kept confidential from the customer to avoid tipping off.
• Periodic updation: 1 / 3 / 5 years normally, 2 / 8 / 10 years for a resident Indian customer with an existing Financial Group relationship in India, and the stricter cycle wins if the two ratings disagree.
• The first payment must come from an account in the customer's own name. A payment from a spouse, a group company or a nominee defeats the measure.
• A PEP who has stepped down is not automatically out of scope — the Guidelines require a risk-based judgement on residual influence.