Enhanced Due Diligence (EDD) for high-risk clients
Overview. When a client's AML risk assessment meets your firm's escalation threshold (high risk, or high and medium, you choose), IdentityCheck automatically opens an Enhanced Due Diligence case and emails the client a secure form for extra information. One of your designated EDD assessors reviews it and re-rates the client, then records an officer decision, approve or decline, with a written reason. Every step is kept in an append-only history you can show at audit.
EDD in IdentityCheck helps you gather and evidence extra due diligence on higher-risk clients. Your firm sets the risk appetite and makes the final call; the platform records and supports the decision.
What happens when a client is high risk?
You do not have to remember to escalate anyone. When a completed risk assessment, or a later change to a client's rating, meets your firm's threshold, an EDD case opens on its own and the client is emailed a secure link to provide more information.
You decide what "high risk" means for escalation. In your settings you choose whether EDD triggers on high ratings only or on high and medium. You also select the client-facing and internal forms EDD uses, and designate which staff are EDD-capable. EDD cannot be switched on until both forms and at least one EDD-capable assessor are in place.
How does EDD work?
An EDD case moves through a clear set of stages, and you can see where every case sits on the Ongoing Due Diligence dashboard:
- Awaiting customer. The client opens the secure emailed link (no login is needed, the link is the credential) and completes your EDD form, including any file uploads. When they submit, every EDD-capable assessor is emailed that input is ready.
- Awaiting assessment. A designated EDD-capable assessor reviews the client's answers and completes your internal EDD assessment form, which re-rates the client. As with the initial assessment, scoring is worked out on the server so a rating cannot be tampered with.
- Awaiting approval, then closed. An EDD-capable assessor records the officer decision, approve or decline, with a mandatory written rationale and an optional approver role. That closes the case. If periodic reviews are switched on, closing the case schedules the client's next review from their new rating.
The dashboard is searchable and shows each case with the client, its current state, the rating that triggered it and the current rating. Opening a case shows the client's answers, the completed assessment and the full history.
Who records the officer decision?
Acting on an EDD case is the most tightly controlled permission in IdentityCheck. Only the assessors you designate as EDD-capable can review a submission, re-rate a client or record the officer decision, and there is no owner or admin override.
The officer decision is recorded with the deciding person and their written rationale, so you have a clear, attributable record of who approved or declined the client and why. Whatever you decide, the platform captures who did what and when.
Frequently asked
What happens when a client is high risk?
IdentityCheck automatically opens an Enhanced Due Diligence case and emails the client a secure link to provide extra information. A designated assessor reviews it and re-rates the client, then an officer decision of approve or decline, with a written reason, closes the case.
How does EDD work?
The client completes your EDD form using an emailed link, with no login needed. An EDD-capable assessor reviews the answers and completes your internal EDD assessment, which re-rates the client. An assessor then records the officer decision with a mandatory written rationale.
Do all high-risk clients go to EDD, or medium too?
You choose. EDD can be set to trigger on high ratings only, or on high and medium. When a completed assessment or a later rating change meets your threshold, a case opens automatically.
Who can act on an EDD case?
Only the assessors you designate as EDD-capable can review submissions, re-rate a client or record the officer decision. This is the strictest permission in IdentityCheck, with no owner or admin override.