Enhanced Due Diligence Report: Contents and Template
Enhanced due diligence is judged by what is in the file. This guide sets out what regulators require EDD to cover, then gives a section-by-section template for the report that records it — from the trigger and ownership profile to source of wealth, adverse media, the risk decision and the monitoring plan.
Most EDD failures are not a lack of effort but a lack of evidence: a source-of-wealth narrative nobody checked, an approval with no record of what was considered, or no plan for what happens next. A consistent report structure fixes that.
For when EDD applies in the first place, see our guide to EDD triggers and measures.
Why the Report Matters
Every major regime describes EDD as a set of specific measures, and supervisors test whether each was applied and evidenced. The report is where that evidence lives. It is also what a later reviewer, auditor or examiner reads to understand why the firm took on, kept or exited a higher-risk relationship — often years after the analyst who wrote it has moved on.
In the US, the FFIEC examination manual describes EDD as collecting additional information about customers that pose heightened risk — such as source of funds and wealth, occupation or type of business, financial statements and expected transaction volumes — and reviewing those relationships more often.
What Regulators Require EDD to Cover
| Measure | EU AMLR (from July 2027) | UK MLR 2017 | MAS Notice 626 | FATF |
|---|---|---|---|---|
| More information on the customer and beneficial owners | Art 34(4)(a) | Reg 33(3A)(a) | — | INR.10 para 20 |
| Intended nature of the relationship | Art 34(4)(b) | Reg 33(3A)(b) | — | INR.10 para 20 |
| Source of funds and source of wealth | Art 34(4)(c) | Reg 33(3A)(c); reg 35(5)(b) for PEPs | Para 8.3(b) | INR.10 para 20; R.12 |
| Reasons for transactions | Art 34(4)(d) | Reg 33(3A)(d) | — | INR.10 para 20 |
| Senior management approval | Art 34(4)(e); Art 42 for PEPs | Reg 33(3A)(e); reg 35(5)(a) | Para 8.3(a) | INR.10 para 20; R.12 |
| Enhanced ongoing monitoring | Art 34(4)(f) | Reg 33(3A)(f); reg 35(5)(c) | Para 8.3(c) | INR.10 para 20; R.12 |
| First payment through an account in the customer's name | Art 34(4)(g) | — | Guidelines 8-5-8 | INR.10 para 20 |
| Public sources and reputation | — | Reg 33(5) | Guidelines 8-5-8 | INR.10 para 20 |
The UK measures in regulation 33(3A) are mandatory for business involving a FATF call-for-action country; for other higher-risk cases firms choose proportionate measures from regulations 33(4)–(5). See our guide to source of funds vs source of wealth for how to evidence the most demanding row.
The EDD Report Template, Section by Section
Case summary
Customer name and identifier, relationship type and product, date opened, the risk rating before EDD, the analyst and the date of the report.
Trigger and scope
Why EDD applies — for example a PEP, a high-risk country, an unusually large or complex transaction, or a high risk score — with the rule or regulation it falls under, and which parties the review covers.
Customer and ownership profile
Identity details, occupation or business, an ownership structure chart for entities, every beneficial owner and controller, and PEP, family member or close associate status for each.
Purpose and expected activity
Why the customer wants the relationship, expected products, volumes, counterparties and jurisdictions — the baseline that monitoring will test against.
Source of wealth
How the customer and beneficial owners built their overall wealth, with the evidence relied on (for example sale agreements, accounts, payslips, probate records) and how each claim was corroborated.
Source of funds
Where the money for this relationship or transaction comes from, with bank statements or other evidence tracing it to that source.
Screening and adverse media
Sanctions, PEP and adverse media results for every party, the searches run, how possible matches were resolved and the relevance of any confirmed media.
Jurisdiction, product and channel risk
The countries involved and why, product features that add risk, and how the customer was onboarded.
Risk assessment and mitigation
The residual risk after the measures above, and the mitigations applied: transaction limits, tailored monitoring rules, restrictions on products or channels, or conditions on the relationship.
Decision and approval
Recommendation, senior management decision (approve, approve with conditions, decline or exit), the approver's name, role and date, and any challenge raised.
Ongoing monitoring plan
The review frequency, triggers for an early review, and the monitoring scenarios applied to this customer.
Evidence index
A list of every document and search relied on, with dates and where each is stored.
Writing Each Section Well
- Corroborate, don't transcribe. MAS's Guidelines expect source of wealth and funds to be corroborated, not simply recorded from what the customer says. Say what evidence supports each statement.
- Join the dots. Check that the source of wealth explains the amounts involved, and that the expected activity fits the customer's profile.
- Show the challenge. MAS expects the AML/CFT compliance function's input into senior management approval; record questions asked and how they were answered.
- Be specific about mitigation. "Enhanced monitoring" should name the controls and the review date, not just the phrase.
- Record adverse media properly. Our guide to running an adverse media search covers what to keep.
Common Weaknesses
- A source-of-wealth story with no supporting documents.
- Ownership mapped to the first holding company, not the natural persons at the top.
- Screening run on the customer but not on beneficial owners or controllers.
- Approval recorded without the information the approver saw.
- No monitoring plan, or a review date that is never met.
- Copied text from a previous report that no longer fits the customer.
Review Frequency and Refresh
An EDD report is not a one-off. Under the EU AML Regulation, from 10 July 2027 customer information must be updated at least once a year for higher-risk customers. In the UK, PEP measures continue for at least 12 months after the person leaves office (regulation 35(9)). Refresh the report on schedule and whenever an event — new adverse media, a change of ownership, unexpected activity — changes the picture.
For ownership in particular, our worked UBO calculation examples show how to identify who sits at the top of a structure.
Frequently Asked Questions
What is an enhanced due diligence report?
The written record of the enhanced measures a firm applied to a higher-risk customer and the decision it reached — covering the trigger, ownership, purpose, source of wealth and funds, screening, risk assessment, approval and monitoring plan.
What should an EDD report include?
At minimum: the reason for EDD, the customer and beneficial ownership profile, purpose and expected activity, source of wealth and source of funds with evidence, screening and adverse media results, the residual risk and mitigations, senior management approval and the ongoing monitoring plan.
Who approves an EDD report?
Senior management approval for establishing or continuing a higher-risk or PEP relationship is required under the EU AML Regulation, the UK Money Laundering Regulations, MAS Notice 626 and the FATF standards. Firms define in policy which role approves, usually with input from compliance.
How often should an EDD report be reviewed?
At least annually for higher-risk customers is common practice, and the EU AML Regulation will require higher-risk customer information to be updated at least once a year from 10 July 2027. Reviews should also happen whenever a trigger event occurs.
What is the difference between source of wealth and source of funds in an EDD report?
Source of wealth explains how the customer built their overall wealth; source of funds explains where the specific money used in the relationship or transaction comes from. EDD reports should evidence both.
Sources
- Regulation (EU) 2024/1624 (AMLR), Articles 34 and 42
- Money Laundering Regulations 2017, regulation 33
- Money Laundering Regulations 2017, regulation 35
- MAS Notice 626
- MAS: Guidelines to MAS Notice 626
- FATF Recommendations (Recommendation 10 interpretive note and Recommendation 12)
- FFIEC BSA/AML Examination Manual: Customer Due Diligence
This article is general information, not legal advice. Requirements change — check the current text with the regulator before relying on it.
EDD as a Workflow, Not a Word Document
One Constellation routes higher-risk customers into structured EDD workflows with source-of-wealth and source-of-funds capture, tiered approvals and scheduled refresh.
