Customer due diligence and the risk-based approach

AML & Compliance Updated 14 Aug 2026

Summary

Decide how much checking a member needs, using the three levels of due diligence your policy sets.

About 4 minutes · 7 steps. Also called: CDD, risk-based approach, know your customer.

Prerequisites

  • Your institution's AML or KYC policy, which sets the risk levels and thresholds.
  • Know Your Customer — identification comes before any of this.

Step-by-step

  1. Understand the idea before any screen or sign-in: due diligence means knowing who your member is, what they do, and whether their activity fits that picture.

  2. Accept that the depth varies on purpose. The same effort on everyone wastes time on low-risk members and leaves high-risk members under-checked.

  3. Give every member a risk rating when they join. Your policy sets the levels, often low, medium and high.

  4. Apply standard due diligence to an ordinary member: identify and verify against a document, then record what they do and the account's purpose. Keep what you saw, and watch activity normally.

  5. Apply simplified due diligence only where your policy says the risk is genuinely low: less supporting detail, never skipped identification, never skipped monitoring.

  6. Apply enhanced due diligence where the risk is higher. It is four things together. Take more identity evidence. Record the source of funds, with evidence rather than a spoken answer. Get senior approval before opening or continuing the relationship. Then monitor more closely, with tighter thresholds.

  7. See where ratings land. The Customers screen in Wakandi AML Risk Monitoring filters members by risk classification, so a rating is a working label, not a note in a drawer.

    The Customers screen filtered by risk, where each member's classification is visible
    Figure 1: The Customers screen filtered by risk, where each member's classification is visible

Note: What raises a member's risk, and when to change a rating, is the next lesson, Keeping due diligence up to date.

Common pitfalls & FAQ

  • "Simplified due diligence means I can skip the paperwork." It means less supporting detail, decided by your policy, not by you on the day. Identification and monitoring always happen.
  • "Enhanced due diligence is one more ID copy." It is four things together. Doing only the first is not enhanced.
  • "How much cash is too much?" Use your institution's threshold and your country's rules, not a figure remembered from somewhere else.

Back to course: Anti-Money Laundering for SACCOs