What Does Customer Due Diligence (CDD) Mean at a Bank?

Customer due diligence (CDD) is how a bank learns who its customers are, understands why they use its services, and assesses whether their activity makes sense for their known circumstances. It is a core part of a bank’s know your customer (KYC) process and its anti-money laundering (AML) controls.

CDD is not simply an identity check when someone opens an account. Banks are expected to use information about customers to assess risk and, where appropriate, monitor activity over time. For customers, that can mean being asked for identification, business documents, information about who owns a company, or an explanation of an unusual transaction.

CDD also matters beyond an individual banking relationship. If a bank fails to identify or respond to suspicious activity, the consequences can include regulatory action. In some circumstances, people with information about possible violations may be able to report it through the federal AML whistleblower program. This guide explains how CDD works, how it relates to suspicious activity reports, and what whistleblower protections and eligibility may involve.

What CDD means in practice

CDD is the process a bank uses to build and maintain a reasonable picture of a customer and the risks associated with the relationship. Federal rules require covered banks to establish a written CDD program as part of their Bank Secrecy Act (BSA) compliance program. The BSA is the main federal framework requiring financial institutions to keep certain records and help detect and report financial crime.

A bank’s process will depend on the customer and the products involved. A personal checking account generally presents different risks from a company account with international transfers or a complex ownership structure. CDD is therefore not one identical checklist for every customer.

The main elements of CDD

Bank CDD programs generally address four connected tasks:

• Identify and verify customers. Banks collect identifying information and use documents or other methods to verify identity. This is commonly associated with the Customer Identification Program, which is related to but distinct from broader CDD.
• Identify beneficial owners of certain companies. When a legal entity opens an account, a bank generally collects information about individuals who own or control it, subject to applicable rules and exceptions. This helps establish who is behind the entity.
• Understand the purpose and expected use of the relationship. A bank may ask what a business does, where it operates, how it expects to use the account, or where funds will come from.
• Conduct ongoing monitoring and update information as appropriate. Banks use customer information to help identify transactions that may not fit the account’s expected activity or risk profile. They may update records when circumstances change.

For example, a small local contractor might describe an account used to receive customer payments and pay suppliers. If the account later begins receiving frequent, large international transfers unrelated to that business, the bank may review the activity and seek additional information. The transactions may have a legitimate explanation; a mismatch is a reason to assess, not proof of wrongdoing.

CDD, KYC, and AML controls: how they differ

Term What it generally means Example Customer due diligence (CDD) Gathering and using information to understand a customer and assess risk throughout the relationship. Learning a company’s business, ownership, and expected account activity. Know your customer (KYC) A broad industry term for knowing and verifying who a customer is and understanding the relationship. Checking a customer’s identity and asking about the purpose of an account. AML controls The wider set of policies, people, systems, and procedures a bank uses to meet AML obligations and manage financial-crime risk. Transaction monitoring, staff training, escalation procedures, and reporting.

These terms overlap, but they are not interchangeable. CDD is one important part of a bank’s broader AML controls. KYC is often used as an umbrella term for customer identification and related checks.

How CDD connects to suspicious activity reports

A suspicious activity report (SAR) is a confidential report that a financial institution files with the Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury. Banks generally must file a SAR when applicable legal requirements are met, including when transactions appear suspicious under the BSA and relevant rules.

CDD can help a bank decide whether activity is unusual in context. A transaction that looks routine for one customer may be inconsistent with another customer’s stated business, account history, or expected activity. Monitoring and review may lead a bank to ask questions, escalate the matter internally, or file a SAR.

A SAR is not a finding that a customer committed a crime. It is a report of potentially suspicious activity for law enforcement and other authorized agencies to assess. Banks generally may not tell the subject of a SAR that one has been filed. That confidentiality requirement is one reason a customer may not receive a detailed explanation for a bank’s questions, account restrictions, or decision to end a relationship.

FinCEN’s website, fincen.gov, provides information about the BSA, SARs, and financial-crime reporting. Public resources can explain the framework, but they do not reveal whether a particular institution has filed a SAR about a particular person or business.

What is the AML/BSA whistleblower program?

The AML/BSA whistleblower program provides a way for eligible individuals to submit information to the U.S. Treasury Department about certain financial-crime violations. FinCEN administers the program. It is intended to encourage people with meaningful, nonpublic information to report possible misconduct, including conduct involving a financial institution’s compliance systems.

The program does not mean every report results in an investigation, enforcement action, or payment. A whistleblower award may be available only when the statutory conditions are met, including conditions tied to successful enforcement and collected monetary sanctions. Award amounts and eligibility depend on the facts and the law; no outcome or award is guaranteed.

Legal origin and timeline

• January 1, 2021: The Anti-Money Laundering Act of 2020, enacted as part of the National Defense Authorization Act for Fiscal Year 2021, created a BSA whistleblower framework.
• December 23, 2022: The Anti-Money Laundering Whistleblower Improvement Act became law as part of the National Defense Authorization Act for Fiscal Year 2023. It strengthened and expanded the earlier framework, including changes to potential awards and coverage.
• After enactment: FinCEN has been responsible for administering the program and providing information about how to submit tips and claims. Whistleblowers should check current FinCEN materials for the applicable process and requirements.

The date matters because the program was not created from scratch in 2022. The 2022 law amended the framework established in 2021. Anyone considering a report should consult current official instructions and, where appropriate, an attorney experienced in whistleblower matters.

Who may be eligible, and what counts as “original information”?

In general, a person may be eligible to submit information if they voluntarily provide original information about a covered violation to the government and the information contributes to a successful enforcement action that meets the law’s requirements. The details are fact-specific, and statutory exclusions and procedural rules can apply.

“Original information” generally means information based on the person’s independent knowledge or independent analysis that is not already known to the government from another source, subject to legal definitions and exceptions. It may include firsthand observations, records, or analysis that helps authorities understand how a suspected scheme worked.

For example, an employee might have seen that a bank repeatedly ignored internal alerts about transfers inconsistent with customer profiles, or that staff were instructed not to document certain CDD concerns. That information could be relevant if it is specific, reliable, and not simply speculation. Whether it qualifies for an award is a separate legal question.

Some people may be excluded or face limits based on their role, how they obtained the information, or their involvement in the conduct. Rules can treat information from compliance, audit, or supervisory work differently, with exceptions in certain circumstances. Employees should not assume that a job title automatically disqualifies them—or automatically makes them eligible. Legal advice can help assess the specific facts.

What kinds of violations may qualify?

The program concerns covered violations under the governing statutes. Depending on the facts and applicable law, reports may involve conduct such as:

• SAR-related failures: Possible failures to identify, escalate, or report suspicious activity when reporting requirements apply, or conduct involving the handling of SAR information.
• Structuring: Breaking transactions into smaller amounts to evade reporting or recordkeeping requirements. A transaction below a reporting threshold is not automatically unlawful; intent and the surrounding facts matter.
• CDD deficiencies: Possible failures to identify customers or beneficial owners, understand the purpose of accounts, maintain appropriate customer information, or use that information in risk-based monitoring.
• Recordkeeping violations: Possible failures to maintain required records or provide required information, including records relevant to certain transactions.
• Sanctions violations: Certain violations of U.S. sanctions laws may fall within the expanded whistleblower framework, depending on the law and the specific conduct.

A weak CDD process is not, by itself, proof that a bank violated the law. The relevant questions may include what rules applied, what the bank knew, what steps it took, and whether the conduct was sufficiently serious and connected to a covered violation.

What to do next if you have concerns

If you are a customer who has been asked for additional information, provide accurate documents through a verified bank channel and ask what information is needed. Do not assume that a request means the bank suspects a crime. If your account is restricted or closed, ask about any appeal or review process the bank makes available, while recognizing https://openclassactions.com/blog/aml-bsa-whistleblower-program-faqs.php that it may not be able to discuss confidential reporting.

If you have firsthand information about possible institutional misconduct, consider these practical steps:

1. Write down what you personally know. Note dates, people involved, systems or processes, and what you observed directly. Separate firsthand facts from assumptions.
2. Preserve information lawfully. Do not access systems without authorization, remove restricted records, or violate privacy and confidentiality rules. Do not use a work laptop or work account for sensitive personal communications.
3. Review official guidance. Check FinCEN’s website for current whistleblower information and submission procedures. A SAR itself is confidential, so do not try to obtain or disclose one improperly.
4. Consider independent legal advice. An attorney can discuss eligibility, confidentiality, retaliation concerns, and how to report without unnecessarily exposing sensitive information.
5. Avoid public disclosures before getting advice. Posting documents or accusations online can create legal, privacy, and employment risks and may affect how information is handled.

The bottom line

Customer due diligence means more than checking an identity document. It is the bank’s ongoing effort to understand who a customer is, who owns a business customer, what the relationship is for, and whether account activity fits the information available. Those practices support KYC and form part of a bank’s wider AML controls.

When CDD or monitoring raises concerns, a bank may investigate internally and, when required, file a SAR with FinCEN. A SAR is a confidential report, not proof of a crime. Separately, the AML/BSA whistleblower program may provide a reporting route for people with original information about covered violations, but eligibility and any award depend on detailed legal requirements. Official FinCEN resources and qualified legal advice are useful next steps when the issue is more than a routine customer information request.