Ask most fintech teams what KYC requires, and they will describe a product flow: capture a document, run a face match, screen a name. Ask a regulator the same question, and they will describe customer due diligence, the legal framework from which every one of those product steps derives. The difference in framing is not academic. Institutions that understand CDD as the source obligation design controls that survive audits; institutions that understand only the product steps discover their gaps during inspections.
Customer due diligence is the process of knowing who your customer is, confirming that knowledge with reliable evidence, understanding who ultimately benefits from the relationship, and understanding what the relationship is for, calibrated to risk, and maintained for as long as the relationship lasts. This guide unpacks the framework under Indian law, its four components, its risk tiers, and what operationalising it actually looks like.
What Is Customer Due Diligence?
Customer due diligence (CDD) is the set of measures a regulated entity must take to identify its customer, verify that identity using reliable and independent sources, identify any beneficial owner, and understand the nature and purpose of the business relationship with the depth of those measures scaled to the money-laundering and terror-financing risk the customer presents.
Two clarifications position CDD correctly. First, KYC and CDD are often used interchangeably, but the cleaner mental model is that KYC is the operational programme and CDD is its legal substance: the RBI’s KYC Master Directions are, in essence, an instruction manual for performing CDD. Second, CDD is not an onboarding event. The obligation explicitly continues through the relationship; transactions must remain consistent with the institution’s understanding of the customer, and that understanding must stay current.
Globally, the framework descends from the FATF Recommendations (Recommendation 10 in particular); domestically, it is hard law under the Prevention of Money Laundering Act and its rules.
The Legal Basis: PMLA, Rule 9, and RBI KYC Directions
Three instruments anchor customer due diligence in India.
The AML Compliance Software India 2026 of “reporting entities” banks, NBFCs, payment providers, securities intermediaries, insurers, and designated businesses, including client verification, record maintenance, and reporting to FIU-IND.
Rule 9 of the PML (Maintenance of Records) Rules, 2005 is the operative CDD provision: it mandates identification and verification of every client at the commencement of an account-based relationship, identification of the beneficial owner, and understanding of the ownership and control structure for legal-entity clients. The 2023 amendments materially tightened this frame lowering beneficial-ownership thresholds and expanding covered entities; changes with ownership implications.
Sector regulators translate the rules into supervision. For RBI-regulated entities, the KYC Master Directions specify the acceptable documents (OVDs), the permitted verification modes Aadhaar, [video KYC]), the risk-categorisation duty, and periodic update cadences. SEBI and IRDAI mirror the structure for their sectors. Our [RBI KYC Master Directions guide] walks through the banking version in detail.
The layering matters practically: PMLA defines the offence-adjacent duties, Rule 9 defines the CDD substance, and the sectoral directions define the audit checklist your inspector carries.
The Four Components of Customer Due Diligence
Every CDD programme decomposes into four questions, each with its own evidence discipline.
1. Identification: Who Claims to Be Here?
Collecting the identity claim: name, date of birth, address, identifiers (PAN, Aadhaar reference, registration numbers for entities) through the application journey.
2. Verification: Is the Claim True?
Confirming the claim against reliable, independent sources: Aadhaar-anchored rails, OVDs verified at their issuing registries, and biometric binding of the person to the credential via [face match and liveness]. The verification rails this series has covered are all instruments of this component.
3. Beneficial Ownership: Who Is Actually Behind This?
For legal-entity customers, identifying the natural persons who ultimately own or control the entity, through the ownership thresholds and control tests, is required under the 2023 amendments. A company’s KYC is legally incomplete until its beneficial owners are identified and verified as individuals.
4. Purpose and Nature: What Is This Relationship For?
Understanding the intended use, expected transaction types, volumes, geographies, and counterparties. This component gets the least product attention and does the most monitoring work: “consistent with the declared purpose” is the baseline against which suspicious activity is defined.
The four components are conjunctive. A stack that verifies identity brilliantly but skips beneficial ownership, or never captures purpose, is performing partial CDD, which, in an inspection, is non-compliant CDD.
Risk Tiers: Simplified, Standard, and Enhanced Due Diligence
CDD is explicitly risk-based: the same depth for every customer is both wasteful and non-compliant, since the framework requires calibration.
Simplified due diligence applies to demonstrably low-risk customers and products small-value accounts, regulated-entity customers, and government bodies permitting lighter evidence within defined limits. Simplification is a documented risk decision, not an operational shortcut.
Standard CDD is the default: full identification, verification, beneficial ownership, and purpose measures.
Enhanced due diligence (EDD) applies where risk is elevated: politically exposed persons, high-risk jurisdictions, complex or opaque ownership structures, unusual purpose profiles, and non-face-to-face relationships as policy defines them. EDD means more source-of-funds and source-of-wealth inquiry, senior-management approval, tighter monitoring, and shorter review cycles. Our dedicated [EDD in banking analysis] cover the deep end.
The connective tissue is the institution’s risk-categorisation model: every customer carries a risk grade, the grade selects the CDD tier, and the tier drives evidence depth, approval level, and review frequency. The tiered architecture we outlined in [risk-based KYC] is this principle turned into system design.
Ongoing Due Diligence: CDD as a Lifecycle
The least-implemented word in the CDD framework is “ongoing.” Three duties continue after onboarding.
Transaction consistency monitoring. Activity must be checked against the understood profile of the purpose component earning its keep. A declared salary account moving trade-scale volumes is a monitoring alert precisely because CDD recorded what the account was for. This is the doctrinal basis of the [ongoing AML monitoring] programme.
Periodic KYC updates. Re-KYC at risk-scaled intervals: the RBI framework’s periodic-update regime refreshes identity evidence, contact data, and risk categorisation. Institutions running [KYC remediation programmes] are usually paying down debt accumulated by treating this duty as optional.
Event-driven refresh. Trigger events: ownership changes in entity customers, adverse media, unusual activity, dormancy reactivation warrant CDD refresh outside the calendar. Beneficial-ownership changes are the classic silent drift: the entity you onboarded is not the entity you are banking on three years later.
Operationalising CDD in Digital Journeys
Translating the framework into product reality turns on four design commitments.
Map controls to components. Every journey step should trace to a CDD component in your policy documentation: identification, verification, BO, or purpose. The mapping is what converts a slick onboarding flow into an auditable compliance programme.
Make purpose capture real. Replace the ignored dropdown with structured, product-appropriate purpose profiling that actually parameterises monitoring rules. If monitoring never reads it, purpose capture is theatre.
Automate the evidence bundle. Every verification rail in this series produces machine-readable evidence registry responses, match scores, liveness results, and consent artefacts. CDD-grade record-keeping (PMLA requires five-year retention beyond relationship end) should assemble these automatically per customer, uniformly across rails.
Grade risk with governed models. Risk categorisation deserves the same governance as credit policy: documented factors, periodic validation, and change control. It is the switchboard the entire tiered framework runs through and the first thing a thematic inspection tests.
Key Takeaways
- Customer due diligence is the legal substance of KYC: identification, verification, beneficial ownership, and purpose calibrated to risk and maintained through the relationship.
- The Indian frame is PMLA + Rule 9 + sectoral KYC directions, with the 2023 amendments tightening beneficial-ownership duties.
- The four components are conjunctive; skipping BO or purpose makes the whole CDD defective, however strong the identity verification.
- Simplified, standard, and enhanced tiers must flow from a governed risk-categorisation model calibration is itself a compliance duty.
- “Ongoing” is enforceable: transaction-consistency monitoring, periodic re-KYC, and event-driven refresh complete the lifecycle.
Frequently Asked Questions
Q1. What is customer due diligence?
Customer due diligence is the legally required process of identifying a customer, verifying their identity from reliable independent sources, identifying beneficial owners, and understanding the relationship’s purpose scaled to risk and continued throughout the relationship.
Q2. What is the difference between KYC and customer due diligence?
KYC is the operational programme; customer due diligence is its legal substance under PMLA Rule 9 and FATF standards. The RBI’s KYC Master Directions effectively prescribe how regulated entities must perform customer due diligence.
Q3. What are the four components of customer due diligence?
Customer due diligence comprises identification (collecting the identity claim), verification (confirming it against independent sources), beneficial-ownership identification for entity customers, and understanding the nature and purpose of the relationship.
Q4. When is enhanced customer due diligence required?
Enhanced customer due diligence applies to elevated-risk situations — politically exposed persons, high-risk jurisdictions, complex ownership structures, and unusual purpose profiles adding source-of-funds inquiry, senior-management approval, and intensified monitoring.
Q5. Is customer due diligence a one-time onboarding step?
No. Customer due diligence is explicitly ongoing: institutions must monitor transactions for consistency with the customer’s profile, refresh KYC periodically on risk-based cycles, and re-perform due diligence when trigger events occur.
Conclusion
Customer due diligence is where compliance stops being a checklist and becomes epistemology: what does the institution actually know about this customer, on what evidence, and is that knowledge still true? Every verification API, screening engine, and monitoring rule in the modern stack is, ultimately, machinery for answering those three questions defensibly.
The regulatory trajectory of tighter beneficial-ownership rules, richer verification rails, and DPDP-era evidence discipline keeps raising the standard for what “knowing your customer” means. Institutions that build CDD as an evidence-producing lifecycle, rather than an onboarding gate, will find that trajectory an advantage: their answer to the regulator’s three questions is already sitting in the audit bundle.
