> ## Content Index > Fetch the complete content index at: https://blog.amlbot.com/llms.txt > Use this file to discover other available public pages before exploring further. # Crypto Customer Due Diligence (CDD): A Practical Guide for Crypto Businesses - URL: https://blog.amlbot.com/crypto-customer-due-diligence/ - Published: 2024-05-21T20:57:56.000Z - Updated: 2026-10-01T21:45:33.000Z - Author: AMLBot Team - Tags: AMLBot Academy A crypto business can verify a customer's passport and still know almost nothing about the risk of the relationship. Verified identity answers one question. Effective customer due diligence connects several: who the customer is, who ultimately owns or controls them, why the relationship exists, what activity is expected, where the customer operates, where funds come from when that matters, and what their wallets actually show once the account is live. > *Crypto customer due diligence connects who the customer is with what the customer is expected to do and what their on-chain activity actually shows.* That connection is what separates CDD from identity verification, and it is where most crypto programmes have the widest gap. ## What Is Crypto Customer Due Diligence (CDD)? Crypto Customer Due Diligence is the process of connecting a verified customer identity with the purpose, expected activity, risk profile, and ongoing behaviour of the customer relationship. In practice it covers customer identification and verification, beneficial ownership where relevant, the purpose and intended nature of the relationship, customer risk assessment, appropriate screening, and ongoing review. Four terms get used interchangeably and should not be: - **KYC** is the identity and verification layer — establishing and confirming who the customer is. - **CDD** is the broader customer relationship and risk process that contains KYC. - **EDD** is additional scrutiny applied where a relationship presents elevated risk. - **KYT** is the transaction and on-chain monitoring layer that supports ongoing CDD. **KYC is a component of customer due diligence, while CDD also includes customer risk assessment, beneficial ownership where relevant, the purpose of the relationship, and ongoing monitoring.** The regulatory side of the identity layer — what must be collected and verified in each market — is set out in [crypto KYC requirements](https://blog.amlbot.com/crypto-kyc-requirements/). For the general theory of CDD across AML and KYC programmes, [customer due diligence in the broader AML framework](https://blog.amlbot.com/the-role-of-customer-due-diligence-in-aml-and-kyc-compliance/) covers ground this article does not repeat. ### Customer Due Diligence Is Not Every Type of Crypto Due Diligence "Crypto due diligence" is used for several unrelated disciplines, and conflating them wastes work: - **Customer Due Diligence** assesses your individual or corporate customer. - **Counterparty Due Diligence** assesses another VASP or service provider you transact or integrate with. - **Protocol Due Diligence** assesses a smart contract or DeFi protocol. - **Investment and Tax Due Diligence** are separate disciplines again. Customer Due Diligence and counterparty VASP Due Diligence are separate processes: one assesses the customer relationship, while the other assesses another service provider. They can apply at the same time, a corporate VASP customer may require both, but neither replaces the other, and [counterparty VASP due diligence](https://blog.amlbot.com/counterparty-vasp-due-diligence-guide/) has its own methodology. ## What Information Crypto CDD Should Establish ### Identify and Verify the Customer For an individual customer, this means collecting the identifying information required under the applicable framework and verifying it using reliable, independent evidence, with sanctions and PEP screening where applicable. Verification methods follow applicable rules and risk, not a universal template. A selfie, biometric check or proof of address may be required in some frameworks, for some risk tiers, or not at all. What matters is that the method satisfies the rules binding your business and produces evidence you can show a supervisor. Most businesses run this layer through [KYC and KYB verification](https://amlbot.com/kyc?ref=blog.amlbot.com), though tooling does not change what has to be established. ### Understand the Customer, Beneficial Ownership, and Purpose of the Relationship Identity alone does not describe a relationship. For an individual, this stage establishes occupation or business where relevant, the purpose of the account, which products they intend to use, and expected volume. For a corporate customer it extends to the legal entity, directors and authorised persons, ownership and control structure, relevant beneficial owners, the nature of the business, and expected crypto flows. On beneficial ownership, resist the common shortcut of a single global percentage. Identify the natural persons who ultimately own or control the legal-entity customer according to the applicable beneficial-ownership rules — thresholds and control tests differ by jurisdiction. The mechanics sit in [crypto KYB and beneficial ownership verification](https://blog.amlbot.com/crypto-kyb-business-verification-vasps/). ### Build the Customer Risk Profile A risk profile should assemble several signals rather than resting on one. Relevant inputs typically include customer type, geography, the product or service used, ownership complexity, expected volume, source of funds where relevant, PEP and sanctions context, expected counterparties, transaction behaviour after onboarding, and on-chain exposure. Geography deserves a specific caution: a customer connected to a higher-risk jurisdiction is not automatically high-risk or suspicious absent an applicable legal basis. Jurisdiction is one input among several, as [how jurisdiction risk affects crypto customer reviews](https://blog.amlbot.com/jurisdiction-risk-crypto-aml/) sets out in detail. The wider principle, proportionate controls calibrated to assessed risk, is covered in [risk-based AML controls for crypto businesses](https://blog.amlbot.com/risk-based-approach-crypto-aml/). ## Standard, Simplified, and Enhanced Due Diligence ### Standard Customer Due Diligence Standard CDD is the baseline, not "basic KYC". It means identifying and verifying the customer, understanding the relationship, assessing risk, identifying beneficial owners where required, establishing expected activity, and applying ongoing monitoring appropriate to the relationship. ### Simplified Due Diligence Simplified due diligence does not mean skipping KYC or ignoring risk. It may be used only in lower-risk circumstances where applicable rules permit it. SDD is proportionate reduction, applied where lower risk has actually been established, where the framework allows it, and where the rationale is documented. In February 2025 FATF amended Recommendation 1 and the Interpretive Notes to Recommendations 10 and 15, strengthening the emphasis on proportionality and simplified measures in lower-risk situations. The practical reading: a risk-based approach does not mean everyone gets more checks — higher risk draws enhanced measures, lower risk may draw simplified ones. FATF is equally clear that simplified measures are unavailable where suspicion of money laundering or terrorist financing exists, or in specified higher-risk scenarios. > (Source: FATF, "FATF updates standards to promote financial inclusion", February 2025 — [https://www.fatf-gafi.org/en/publications/Fatfrecommendations/update-standards-promote-financial-conclusion-feb-2025.html](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/update-standards-promote-financial-conclusion-feb-2025.html?ref=blog.amlbot.com)) ### Enhanced Due Diligence for Higher-Risk Customers Enhanced Due Diligence is not a separate onboarding system. It is **additional** scrutiny applied when a customer or relationship presents elevated risk under the applicable framework. Triggers usually arise from a combination of factors: PEP exposure, opaque ownership, unusual or inconsistent transaction behaviour, higher-risk geography under the applicable framework, a material mismatch between expected and actual activity, unexplained source of funds, adverse information, or unusual use of high-risk services. Two shortcuts to avoid: a large transaction alone does not automatically require EDD, and a customer connected to a grey-listed jurisdiction is not automatically an EDD case. Both depend on the applicable rule and the wider risk picture. Depending on the case, EDD measures can include additional customer information, deeper ownership verification, Source of Funds, Source of Wealth where relevant, explanation of transaction purpose, corroborating documents, additional screening, management approval where applicable, and more intensive monitoring. Source of Funds information becomes especially relevant when a crypto business needs to understand or corroborate the origin of specific assets or transactions. The method for reconciling what a customer says with what the chain shows is covered separately in how to [verify Source of Funds against on-chain evidence](https://blog.amlbot.com/source-of-funds-in-crypto-aml-how-to-match-customer-information-with-on-chain-evidence/). ## Connect Customer Due Diligence With On-Chain Activity This is the part that makes crypto CDD different from CDD anywhere else. At onboarding the customer tells you what they do, why they need the account, expected volumes, expected sources and expected counterparties. Once live, on-chain activity shows actual volume, actual VASP and counterparty exposure, high-risk sources, sanctions exposure, mixer or obfuscation indicators, unexpected chains, and rapid behaviour changes. Wallet screening and transaction monitoring support ongoing CDD by testing whether actual on-chain activity remains consistent with the customer's expected profile. The purpose is not to replace customer identification — it is to test the profile against reality. One technical point matters here and is frequently misstated. **A blockchain address does not inherently reveal the identity or jurisdiction of its controller; crypto CDD connects customer information with attributed wallets, counterparties, and transaction behaviour.** Context comes from verified customer association, entity attribution, declared wallet ownership or control, transaction history and counterparty intelligence — never from the address string itself. Operationally this requires the customer record and the monitoring layer to share data, which is what [continuous crypto transaction monitoring](https://blog.amlbot.com/amlbot-continuous-transaction-monitoring/) is designed to provide, and why [crypto transaction monitoring](https://amlbot.com/transaction-monitoring?ref=blog.amlbot.com) results need to write back into the customer profile rather than into a separate log. ## Ongoing CDD: When to Review and Reassess a Customer **Ongoing customer due diligence is not limited to periodic KYC refreshes. Material changes in ownership, activity, geography, transaction behaviour, or risk exposure can trigger reassessment.** Two mechanisms work together. 1. **Periodic Review** runs on a cadence set by customer risk, applicable law, internal policy and customer type. No universal 6, 12 or 24-month calendar applies to every business — FATF expects CDD information to be kept current and relevant, particularly for higher-risk customers, without prescribing one schedule. 2. **Event-Driven Review** triggers when something changes: ownership or directors, business activity, a material shift in expected volume, new products, PEP or sanctions status, new adverse information, wallet risk, a transaction pattern that stops matching the profile, new jurisdictions or counterparties, or a Source of Funds explanation that becomes inconsistent. The second mechanism is the one most programmes underbuild, and usually the one that catches real problems first. ## A Practical Crypto Customer Due Diligence Workflow - **Identify.** Who is the customer? → Verified identity or entity. - **Ownership.** Who ultimately owns or controls the customer? → Verified beneficial ownership where relevant. - **Purpose.** Why is the relationship being established? → Expected use and activity. - **Risk Assessment.**What risks does the relationship create? → Documented customer risk profile. - **Due Diligence Level.** How much scrutiny is appropriate? → SDD, standard CDD or EDD, where permitted or required. - **On-Chain Baseline.** Does wallet activity match the declared profile? → Initial crypto-risk context. - **Ongoing Monitoring.** Has behaviour or exposure changed? → Alerts and review triggers. - **Reassessment.** Does the customer risk rating still make sense? → Updated CDD decision. - **Escalation.** Is additional information or action required? → EDD, restrictions, reporting or exit as applicable. ## Regulatory Baseline for Crypto Customer Due Diligence FATF sets the international framework. Recommendation 10 covers customer due diligence, while Recommendation 15 and its Interpretive Note apply the relevant preventive measures to virtual asset service providers — INR.15 states that Recommendations 10 to 21 apply to VASPs, with crypto-specific qualifications. The approach throughout is risk-based and proportionate. The detail sits in [FATF standards for virtual assets and VASPs](https://blog.amlbot.com/fatf-crypto-standards-recommendation-15/). FATF also sets an international-standard threshold of USD/EUR 1,000 for occasional transactions by VASPs requiring CDD. This is the FATF standard; legally enforceable triggers and thresholds depend on national or regional implementation. That distinction is the one to carry: FATF Recommendations are international standards, while national and regional law creates the enforceable rules. CDD triggers, beneficial-ownership definitions, permitted simplified measures, EDD scenarios, recordkeeping and review requirements all vary by jurisdiction — which is why [crypto KYC and CDD requirements across jurisdictions](https://blog.amlbot.com/crypto-kyc-requirements/) is a separate exercise from designing the process itself. In the EU specifically, Regulation (EU) 2024/1624 has been adopted, but its main private-sector CDD obligations apply from 10 July 2027, with Articles 19 and 20 setting the future harmonised framework and separate rules for CASPs on occasional transactions. It does not govern current CDD operations in full — what changes, and when, is covered in [how AMLR changes EU customer due diligence from July 2027](https://blog.amlbot.com/how-eu-amlr-changes-kyc-obligations-for-crypto-businesses/). > (Source: Regulation (EU) 2024/1624 — [https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng](https://eur-lex.europa.eu/eli/reg/2024/1624/oj/eng?ref=blog.amlbot.com)) A note on the United States, because this is widely misstated: FinCEN's formal CDD Rule applies to defined covered financial institutions — federally regulated banks, federally insured credit unions, mutual funds, brokers or dealers in securities, futures commission merchants and introducing brokers. MSBs are not automatically in that list. Many crypto businesses may be money transmitters and MSBs with Bank Secrecy Act obligations — AML programme, customer-related controls depending on activity, recordkeeping, SAR reporting and applicable transfer requirements — but that is not the bank CDD Rule applying identically. > (Source: FinCEN, CDD Rule FAQs — [https://www.fincen.gov/resources/statutes-and-regulations/cdd-rule-faqs](https://www.fincen.gov/resources/statutes-and-regulations/cdd-rule-faqs?ref=blog.amlbot.com)) ## CDD Is a Lifecycle, Not an Onboarding Checklist The failure mode in crypto CDD is rarely a missing verification step. It is a verified customer file that nobody revisits while the on-chain behaviour drifts away from everything the file says. An effective process runs as a chain: identity, purpose, risk, expected activity, actual on-chain activity, ongoing reassessment. Each link feeds the next, and a break anywhere leaves the rest describing a customer who no longer exists. Using third-party KYC or blockchain analytics technology does not transfer responsibility for customer due diligence decisions away from the regulated business. AMLBot can [support the verification and transaction-monitoring layers ](https://amlbot.com/?ref=blog.amlbot.com)of this workflow, while the business remains responsible for its CDD policy, risk decisions, escalation and regulatory obligations. ## FAQ ### What Is Customer Due Diligence in Crypto? Crypto customer due diligence is the process of identifying a customer, verifying their identity, understanding the purpose of the relationship, assessing customer risk, and monitoring that relationship over time. The crypto-specific layer is that actual wallet and transaction activity should be assessed against the customer profile rather than treated as a separate exercise. ### What Is the Difference Between KYC and Customer Due Diligence in Crypto? KYC mainly establishes who the customer is through identification and verification. CDD is broader, covering identity, the purpose of the relationship, beneficial ownership where relevant, customer risk assessment and ongoing monitoring. The two terms do not carry exactly the same legal definition in every jurisdiction, so check how the applicable framework uses them. ### What Information Is Collected During Crypto Customer Due Diligence? Typically: required identity or entity information, beneficial owners where relevant, the purpose of the relationship, expected activity, applicable risk factors, relevant source-of-funds information, and screening information such as sanctions and PEP results. The exact requirements depend on jurisdiction and on the risk the relationship presents. ### What Is Enhanced Due Diligence in Crypto? Enhanced due diligence means additional measures applied to higher-risk relationships or scenarios. Depending on the case, it can include deeper ownership and customer checks, Source of Funds and Source of Wealth information, additional supporting documents, explanation of transaction purpose, increased monitoring, and management approval where the applicable framework requires it. ### When Should a Crypto Business Apply Enhanced Due Diligence? EDD depends on the applicable rules and on a combination of risk factors rather than any single trigger. Common examples include PEP status, opaque ownership structures, unusual activity, unexplained funds, material geographic or customer risk, and a mismatch between the expected profile and actual behaviour. Neither transaction size alone nor grey-list exposure alone decides it. ### What Is Simplified Due Diligence in Crypto? Simplified due diligence means proportionate reduced measures, available where lower risk has been established and the applicable law allows it. It does not mean zero CDD or skipping identity verification. FATF does not support simplified measures where suspicion exists or where specified higher-risk circumstances apply. ### Does Crypto CDD Include Wallet Screening and Transaction Monitoring? CDD and KYT are distinct but connected. Customer identification and risk assessment establish the expected profile. Wallet screening and transaction monitoring then help determine whether actual on-chain activity remains consistent with that profile, feeding results back into the customer risk rating rather than running as a separate stream. ### How Often Should Crypto Customer Due Diligence Be Updated? There is no one-size-fits-all schedule, and no universal 6, 12 or 24-month rule. Review frequency depends on customer risk, applicable jurisdiction, internal policy and customer type. Alongside periodic review, CDD needs event-driven reassessment when identity, ownership, expected activity, counterparties or risk signals change materially during the relationship, since those changes rarely align with a review calendar. ### What Is the Difference Between Customer Due Diligence and Counterparty VASP Due Diligence? Customer CDD evaluates your customer. Counterparty VASP due diligence evaluates another crypto service provider involved in a commercial relationship or transfer flow. A corporate VASP customer may require both processes at once, since being your customer and being a service provider in your transaction chain are different roles. ### Does Using a KYC or AML Provider Satisfy Customer Due Diligence Requirements? Not by itself. Technology can support identity verification, screening, wallet analytics and transaction monitoring. The crypto business remains responsible for its CDD policy, applicable requirements, risk classification, EDD decisions, escalation, reporting and governance. Outsourcing the tooling does not outsource the obligation.