Due Diligence

Simplified Due Diligence (SDD)

Simplified due diligence (SDD) is the lighter end of the risk-based approach to customer due diligence. Where a firm has assessed a customer, product or relationship as presenting a low risk of money laundering or terrorist financing, and the law allows it, the firm may reduce the extent, timing or type of some CDD measures: for example, it may not have to trace and verify the beneficial owners of a regulated financial institution or a listed company, it may verify identity after the relationship starts, or it may review the file less often. SDD is a documented determination, not an exemption from the regime: identification of the customer, ongoing monitoring, sanctions screening and suspicious transaction reporting continue, and SDD must stop as soon as risk rises or suspicion arises.

See Investor Onboarding Back to Glossary

Every major AML regime recognises simplified measures, because the FATF Recommendations, last updated in June 2026, build the whole system on a risk-based approach: more effort where risk is higher, less where it is demonstrably lower. The regimes differ in two things: whether SDD is a list of qualifying customers written into the law, or a judgement the firm makes against risk factors; and exactly which measures may be reduced. For a fund manager, administrator or transfer agent the question arises daily, because the investors in a fund include banks, insurers, pension schemes, listed companies, other funds and nominees, each of which may qualify, alongside private individuals and holding companies that never do.

Hong Kong. Section 4 of Schedule 2 to the Anti-Money Laundering and Counter-Terrorist Financing Ordinance lets a financial institution carry out only the measures in section 2(1)(a), (ab), (c) and (d), in other words everything except identifying and verifying the beneficial owner, if it has reasonable grounds to believe the customer is a financial institution, a supervised institution in an equivalent jurisdiction, a corporation listed on any stock exchange, the Hong Kong Government or a public body, an equivalent-jurisdiction government or public body, or an investment vehicle where the person responsible for CDD-like measures on all its investors is a financial institution or a supervised Hong Kong or equivalent-jurisdiction institution with similar measures (s.4(3)). Where an entity of that kind sits in a customer's ownership chain, the firm need not look beyond it (s.4(2)). Product-based SDD covers employee pension schemes funded by payroll deduction with non-assignable interests, pension insurance policies with no surrender clause that cannot be used as collateral, and life policies with an annual premium of no more than HK$8,000 or a single premium of no more than HK$20,000 (s.4(5)). The SFC Guideline adds that the other aspects of CDD and ongoing monitoring remain, that the use of SDD must be supported by a robust assessment, and that SDD must not be applied or continued where the firm suspects ML/TF or doubts information already obtained (paragraphs 4.8.1, 4.8.2 and 4.8.5). Appendix C to the Guideline gives examples of simplified measures under the risk-based approach: a different type or range of documents, data or information for verifying identity, less frequent review of CDD records, reduced transaction scrutiny within a reasonable monetary threshold, or inferring the purpose of the relationship from its type. See our guide to SFC AML requirements for asset managers.

European Union. Article 33 of Regulation (EU) 2024/1624, the AML Regulation that applies from 10 July 2027, lists the simplified measures available where the Annex II and III risk factors show a low degree of risk: verifying the customer and beneficial owner after the relationship is established, but no later than 60 days; reducing the frequency of identification updates; collecting less information on the purpose of the relationship, or inferring it; reducing the frequency or degree of transaction scrutiny; and other measures identified by the EU anti-money laundering authority, AMLA. The measures must be proportionate, the firm must still carry out sufficient monitoring to detect unusual or suspicious transactions, its internal procedures must specify the simplified verification measures for each lower-risk customer type, and it must verify regularly that the conditions still exist. SDD must not be applied where there are doubts about the information provided, where the lower-risk factors are no longer present, where monitoring excludes a lower-risk scenario, where ML/TF is suspected, or where there is a suspicion of attempts to circumvent targeted financial sanctions (Article 33(5)).

United Kingdom. Regulation 37 of the Money Laundering Regulations 2017 allows a relevant person to apply simplified measures to a particular relationship or transaction if it determines that it presents a low degree of risk, taking account of its own risk assessment, information from its supervisor and the risk factors in regulation 37(3): among them public administrations, individuals resident in lower-risk areas, credit and financial institutions subject to equivalent requirements and supervision, companies listed on a regulated market, low-premium life policies, non-assignable pension schemes, and countries with effective AML systems or low corruption. The firm must still comply with regulations 28, 29 and 30A, but may adjust the extent, timing or type of the measures it undertakes under regulation 28 and regulation 29(11) to (13); it must carry out sufficient monitoring to detect unusual or suspicious transactions, and must bear in mind that one or more lower-risk factors do not always indicate low risk (regulation 37(2) and (4)).

Singapore. Paragraph 7 of MAS Notice SFA04-N02, dated 30 June 2025, permits a capital markets intermediary, which includes licensed fund managers, to perform simplified CDD on a customer, its representatives and its beneficial owners if it is satisfied that the risks are low, supported by an adequate analysis, with measures commensurate with the risk. It may also do so, subject to the same conditions, for a customer that is a financial institution listed in Appendix 2 to the Notice (paragraph 7.5). It must not do so where the customer or a beneficial owner is from a jurisdiction subject to FATF countermeasures or known to have inadequate AML/CFT measures, or where it suspects ML/TF, and it must document the details of its risk assessment and the nature of the simplified measures (paragraphs 7.1 to 7.6). See MAS Notice SFA04-N02 explained.

Cayman Islands. Regulation 21 of the Anti-Money Laundering Regulations (2025 Revision) allows simplified measures only where a low level of risk has been identified and assessed under regulation 8, commensurate with the lower risk factors, and a finding of low risk is only valid if it is consistent with the National Risk Assessment or the supervisory authority's findings, whichever is more recent. Regulation 22 lists the "acceptable applicants" for whom verification of identity is not required when the identity is known, the purpose is known and no suspicious activity has been identified: another person required to comply with regulation 5, or a majority-owned subsidiary of the firm itself, a government body of a low-risk country, a business regulated by an overseas authority in a low-risk country, a company listed on a recognised exchange with adequate beneficial-ownership disclosure, and certain pension funds; the basis must be evidenced in writing (reg 22(2)). CIMA's Rule on Effective Compliance Programme, in force since 18 September 2026, requires the firm to complete its risk assessment before deciding, to document the basis, to reassess periodically and to continue sanctions screening (10.5.21 to 10.5.23), and CIMA's Sanctions Rule states that SDD "does not reduce or waive screening obligations" and that all customers must be re-screened when a sanctions list is updated (7.5). See Cayman Islands AML rules for funds.

SDD compared across regimes

Regime	Who or what may qualify	What may be simplified	What never changes
Hong Kong, AMLO Schedule 2 s.4	Financial institutions, supervised equivalent-jurisdiction institutions, listed companies, governments and public bodies, and investment vehicles where the person responsible for CDD-like measures on all the investors is such an institution; certain pension and low-premium life products	The beneficial-owner measure may be omitted; the FI still identifies and verifies the customer, the purpose of the relationship and anyone acting for the customer	Ongoing monitoring; no SDD where there is suspicion or doubt about information already held
European Union, Regulation (EU) 2024/1624 Article 33 (applies from 10 July 2027)	Business relationships or transactions presenting a low degree of risk on the Annex II and III factors	Verification after the relationship starts but within 60 days; less frequent identification updates; less information on purpose, or purpose inferred; reduced frequency or degree of transaction scrutiny; other measures identified by AMLA	Sufficient monitoring to detect unusual or suspicious transactions; regular re-verification that the conditions still hold; documented decisions
United Kingdom, MLR 2017 regulation 37	A relationship or transaction the firm determines is low risk after its business-wide risk assessment and the listed customer, product and geographic factors	The extent, timing or type of the measures under regulation 28 and regulation 29(11) to (13)	The duty to carry out CDD itself; sufficient monitoring to detect unusual or suspicious transactions; SDD stops when risk rises or suspicion arises
Singapore, MAS Notice SFA04-N02 paragraph 7	Customers, their representatives and beneficial owners where the capital markets intermediary is satisfied, on an adequate analysis, that risks are low; financial institutions listed in Appendix 2	CDD measures under paragraph 6, commensurate with the risk	Documentation of the risk assessment and of the simplified measures; no SDD for FATF-countermeasure or inadequate-AML jurisdictions or where ML/TF is suspected
Cayman Islands, AMLRs regulations 21 and 22 and CIMA Rule 10.5.21 to 10.5.23	Customers assessed as low risk under regulation 8, consistent with the National Risk Assessment; "acceptable applicants" such as other regulated persons, low-risk-country government bodies and regulated businesses, listed companies and certain pension funds	Verification of identity may be dispensed with for acceptable applicants when the identity, purpose and absence of suspicion are established and the basis is evidenced in writing	Sanctions screening and re-screening on every list update; documentation and periodic reassessment; no SDD where ML, TF or PF is known or suspected

How to apply SDD in a fund or investor onboarding process

1. Decide what kind of SDD your regime offers. Hong Kong writes qualifying customers into the law; the Cayman Islands combine a documented low-risk determination (regulation 21) with a statutory list of acceptable applicants (regulation 22); the EU, the UK and Singapore require a documented low-risk determination against listed factors, and Singapore adds a list of Appendix 2 financial institutions that remains subject to the same risk analysis. Build the investor risk model around the regime that governs the fund and the firm.

2. Prove the qualifying status. For a regulated institution, check the regulator's register and record it; for a listed company, obtain proof of listing and consider the exchange's disclosure rules; for an investment vehicle, identify who performs CDD on its investors and whether that person is itself supervised. Our KYB entry covers the entity checks.

3. Write down what is simplified and why. The measures reduced, the risk factors relied on, the consistency with any national risk assessment, the approver and the review date. Every regime above requires documentation, and an inspector will read it.

4. Keep the parts that never simplify. Identify and verify the customer itself, screen for sanctions and re-screen on list updates, monitor subscriptions, redemptions and transfers against the expected profile, and report suspicion. The look-through approach and SDD are two outcomes of the same classification exercise.

5. Set the exit triggers. Doubts about information, a change in ownership or regulatory status, a change of jurisdiction risk, unusual activity or any suspicion ends SDD and requires standard or enhanced due diligence.

Common mistakes

Treating SDD as "no due diligence" and holding nothing more than a name on the register; applying it to a customer that is merely a subsidiary or affiliate of a regulated institution without checking whether the law extends to it; relying on an intermediary's self-description instead of a regulator's register; forgetting that a low-risk rating must be consistent with the national risk assessment; and omitting sanctions screening or periodic re-screening because the file was classified as low risk. For a fund manager the SDD decision is part of the wider know-your-investor design, and for an administrator or transfer agent it is one of the reasons an investor onboarding workflow has to record not just each investor but the basis on which the firm decided how much to check.

Key points

Reduced CDD for customers, products or relationships assessed as lower risk, where the law permits
Hong Kong lists qualifying customers in the law; Cayman combines a risk determination with a list of acceptable applicants; the EU, UK and Singapore require a documented low-risk determination
The customer is still identified and verified; monitoring, sanctions screening and suspicious transaction reporting continue
SDD ends on suspicion, doubt about information, or when the lower-risk factors disappear

How One Constellation helps

One Constellation gives fund managers, administrators and transfer agents an investor onboarding portal with identity verification, KYB and beneficial-ownership tracing, sanctions, PEP and adverse-media screening with re-screening on list updates, risk rating with a recorded basis for simplified or enhanced measures, transaction monitoring and case management with STR workflows, so every SDD decision is documented and reviewed in one place.

Explore Investor Onboarding

Frequently asked

What is simplified due diligence in AML?+

Simplified due diligence is a reduced set of customer due diligence measures that a regulated firm may apply where it has assessed, and documented, that a customer, product or relationship presents a lower risk of money laundering or terrorist financing. Depending on the regime, the firm may omit the beneficial-owner measure, verify identity after the relationship starts, collect less information on purpose, or review the file less often. It must still identify the customer, monitor the relationship, screen for sanctions and report suspicion.

Which customers qualify for simplified due diligence?+

Typically regulated financial institutions, supervised institutions in equivalent jurisdictions, companies listed on a stock exchange, governments and public bodies, certain pension schemes and low-premium life insurance products, and, in Hong Kong, investment vehicles where the person responsible for CDD-like measures on all the investors is a financial institution or a supervised Hong Kong or equivalent-jurisdiction institution. In the EU, the UK and Singapore the firm must determine low risk against listed factors; in Hong Kong the qualifying categories are written into the legislation; in the Cayman Islands a documented low-risk determination is combined with a statutory list of acceptable applicants.

What is the difference between SDD, CDD and EDD?+

Customer due diligence is the standard set of measures: identify and verify the customer and beneficial owner, understand the purpose of the relationship and monitor it. Simplified due diligence reduces the extent, timing or type of some of those measures where risk is lower. Enhanced due diligence adds measures, such as senior management approval, source of wealth and funds and closer monitoring, where risk is higher, for example for politically exposed persons or higher-risk jurisdictions.

Can a fund apply simplified due diligence to its investors?+

Only to investors who qualify under the regime that governs the fund and its manager or administrator, and only with a documented basis. A regulated bank, insurer, listed company or supervised fund investing in its own name will often qualify; a private holding company, a trust or an individual will not. Nominee and omnibus holders are a separate question, because the firm must decide whether it may rely on the intermediary or must look through to the underlying investors.

Does simplified due diligence remove the need for sanctions screening?+

No. The Cayman Islands Sanctions Rule states that SDD does not reduce or waive screening obligations and requires all customers to be re-screened when a sanctions list is updated, and the EU AML Regulation bars SDD where there is a suspicion of attempts to circumvent targeted financial sanctions. In every regime the customer must still be identified, which is what makes screening possible.

Sources

This entry is general information, not legal advice. Check the current text with the regulator before relying on it.

The Right Amount of Diligence, Documented

Rate every investor, record the basis for simplified or enhanced measures, keep screening and monitoring running and review on schedule, in one workflow built for fund managers, administrators and transfer agents.

Book a Demo Explore Investor Onboarding