How to pass enhanced due diligence (EDD) as a high-risk applicant

For many companies, undergoing Enhanced Due Diligence (EDD) is one of the most challenging stages of opening a bank account, obtaining a licence, raising investment, or establishing relationships with financial institutions. This is particularly true for businesses operating in the crypto, fintech, payment services, iGaming, and other regulated sectors, where the level of scrutiny goes far beyond standard KYC procedures. However, being classified as a high-risk applicant does not automatically result in rejection. The outcome largely depends on the company's ability to demonstrate a transparent corporate structure, a legitimate source of funds, and effective internal compliance procedures. Proper preparation for Enhanced Due Diligence can significantly increase the likelihood of a successful review and help avoid lengthy delays. In this article, we explain how EDD works, which documents should be prepared in advance, and the common mistakes that most often lead to additional inquiries or rejection.

What is Enhanced Due Diligence and when is it applied?

Enhanced Due Diligence (EDD) is an enhanced customer verification process applied when a financial institution, regulator, or another AML/CFT-obliged entity identifies an elevated level of risk. Unlike standard customer due diligence, EDD involves a more detailed assessment of the company's business structure, source of funds, nature of its activities, and internal control framework. The purpose of this process is not to make access to financial services more difficult but to ensure that a prospective client complies with applicable legal requirements and does not present an unacceptable level of risk.

Standard CDD vs Enhanced Due Diligence

Standard Customer Due Diligence (CDD) is generally limited to identifying the customer, verifying beneficial ownership, and conducting a basic assessment of the nature of the business. Enhanced Due Diligence is applied where standard checks are not sufficient to assess potential risks. In such cases, financial institutions may request additional documentation and more detailed information about the source of funds, ownership structure, business model, and existing compliance procedures.

Within the EU, the supervisory landscape has also evolved. Since 1 January 2026, the newly established Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), headquartered in Frankfurt, has taken over EU-level AML/CFT functions from the European Banking Authority and coordinates the work of national Financial Intelligence Units. From 2028, AMLA will directly supervise a number of large, high-risk financial institutions across the EU. As a result, banks and payment institutions increasingly align their EDD procedures with AMLA's supervisory expectations, not only with national regulatory guidance.

Who is considered a high-risk applicant?

Being classified as a high-risk applicant does not mean that a company has violated the law or will automatically be rejected. It simply indicates that more extensive due diligence is required.

Enhanced Due Diligence is most commonly applied to:

• Politically Exposed Persons (PEPs), their family members, and close associates;
• Crypto companies and VASPs;
• Fintech companies and payment institutions;
• Gambling and iGaming businesses;
• Companies with complex corporate structures;
• Customers whose activities require enhanced AML/CFT scrutiny.

For this reason, undergoing EDD has become a standard part of the onboarding process for many high-risk businesses when dealing with banks, licensing authorities, payment providers, and other financial institutions.

Why businesses fail EDD

Being classified as a high-risk applicant is rarely the reason for a rejection on its own. In practice, most issues arise because a company is insufficiently prepared for the review. If the information provided is incomplete, inconsistent, or does not allow the compliance team to properly assess the risk, the financial institution will usually request additional documentation or decide not to establish a business relationship.

Incomplete documentation

One of the most common causes of delays is an incomplete set of documents. Even if a company provides all mandatory registration documents, compliance specialists may still request additional information about its corporate structure, business activities, or sources of funding.

Unclear source of funds or wealth

Another key element of EDD is demonstrating the source of funds and, where applicable, the source of wealth of the beneficial owners. If a company cannot clearly explain the origin of its capital, investments, or significant transactions, its risk profile increases substantially, almost always resulting in additional scrutiny.

Weak compliance framework

Even a successful and profitable company may face difficulties if its compliance framework exists only on paper. Banks, EMIs, payment institutions, and other regulated entities increasingly assess not only whether internal policies exist but also how effectively they are implemented in practice.

The most common reasons for failing EDD include:

• Incomplete or inconsistent documentation;
• Insufficient evidence of the source of funds or funding structure;
• A non-transparent corporate or beneficial ownership structure;
• A generic or outdated AML/KYC framework;
• An inability to promptly provide additional documents requested by the compliance team.

In many cases, these issues can be addressed before the review begins. For this reason, preparation for Enhanced Due Diligence should be treated as a separate stage of compliance planning rather than a reaction to a request from a bank or regulator.

Documents and information you should prepare before EDD

The better prepared a company is for Enhanced Due Diligence, the faster the review process is likely to be. Most additional requests arise not because of the company's high-risk status itself, but because the financial institution lacks sufficient information to properly assess the risks. Preparing documentation in advance helps reduce the number of follow-up questions and demonstrates a serious commitment to compliance.

Corporate documents

The reviewing institution will first expect to receive a complete set of corporate documents. In addition to registration records, it may request information about the group structure, corporate governance, and the individuals responsible for key business decisions.

The documentation typically includes:

• Certificates of incorporation and corporate extracts;
• Constitutional documents;
• Information on directors and senior management;
• The corporate group structure.

Ownership and beneficial ownership

Particular attention is almost always given to the ownership structure and the ultimate beneficial owners (UBOs). The company should be prepared to explain who ultimately controls the business, how ownership is distributed, and whether any intermediary entities are involved.

In most frameworks, a beneficial owner is defined as any individual holding 25% plus one share, or an equivalent level of control, whether directly or through intermediary entities.

If the ownership structure appears overly complex or insufficiently transparent, the likelihood of additional requests increases significantly.

Business model and source of funds

It is equally important to clearly explain how the company generates revenue, who its customers are, which services it provides, and how its cash flows are structured. At the same time, the company should prepare documents demonstrating the source of its initial capital, investments, or other funds used to operate the business.

AML/KYC documentation

For businesses operating in regulated industries, robust AML/KYC documentation is particularly important. Compliance teams increasingly assess not only whether internal policies exist, but also whether they accurately reflect the company's actual operations.

It is generally advisable to prepare in advance:

• AML/KYC policies and internal procedures;

• Risk management and internal control documentation;
• A description of customer onboarding and ongoing monitoring procedures;
• Information on transaction monitoring, sanctions screening, and suspicious activity reporting procedures, where applicable.
• For crypto businesses and VASPs, evidence of Travel Rule compliance, including procedures for collecting and transmitting originator and beneficiary information.

A complete and well-organized set of documents significantly improves the likelihood of successfully passing Enhanced Due Diligence and helps build confidence in the company's corporate governance and compliance framework.

Demonstrating a strong compliance culture

Preparing a complete set of documents is only part of successfully passing Enhanced Due Diligence. It is equally important to demonstrate that compliance is not merely a formal requirement but an integral part of the company's day-to-day operations. Banks, payment institutions, and other financial organizations increasingly assess not only the content of internal policies but also how effectively they are implemented in practice.

Internal policies and procedures

During EDD, particular attention is paid to whether a company's internal policies reflect its actual business activities. Simply having AML/KYC documentation is no longer considered sufficient. Reviewing institutions may assess how customer identification is carried out, how employees apply internal procedures, how frequently policies are updated, and how the company responds to changes in legislation and regulatory requirements.

For this reason, internal documentation should be reviewed regularly, accurately reflect the company's actual business processes, and be clear to employees responsible for compliance functions.

Transaction monitoring and governance

In addition to internal policies, financial institutions assess a company's corporate governance framework and its ability to manage its own risks. For high-risk businesses, it is particularly important to demonstrate effective transaction monitoring mechanisms, clear allocation of responsibilities between management and compliance personnel, and procedures for identifying and escalating potentially suspicious activities.

When a company can demonstrate that its internal control framework operates in practice rather than existing only on paper, it significantly increases the confidence of banks, regulators, and other organizations conducting Enhanced Due Diligence. This approach helps establish the business as a transparent and well-managed client despite its higher risk profile.

What happens after Enhanced Due Diligence?

Completing Enhanced Due Diligence does not always result in an immediate decision. After reviewing the submitted documentation, the financial institution assesses the company's overall risk profile and determines whether the outcome meets its internal requirements and applicable regulatory standards. Depending on the results of the assessment, several outcomes are possible.

Following EDD, a company may encounter one of the following outcomes:

1. Approval. If the information provided is complete, consistent, and demonstrates an acceptable level of risk, the bank, payment institution, or other counterparty may approve the establishment of a business relationship.
2. Request for additional information. This is the most common outcome. The compliance team may request additional documents or ask for clarification regarding the ownership structure, source of funds, specific transactions, or the company's internal procedures.
3. Ongoing monitoring. Even after successfully completing EDD, high-risk customers are typically subject to enhanced ongoing monitoring. This may include periodic updates of corporate documentation, repeated beneficial ownership reviews, and monitoring of unusual transactions.
4. Refusal. If the financial institution concludes that the risk level exceeds its internal risk appetite or the company fails to provide sufficient supporting information, it may refuse to establish or continue the business relationship.

Successfully completing Enhanced Due Diligence should not be viewed as the end of the compliance process but as the beginning of a long-term relationship with the financial institution. Keeping documentation up to date, maintaining a transparent business structure, and operating an effective internal control framework not only facilitate the initial review but also make future compliance reviews significantly more efficient.

Enhanced due diligence requirements and triggers vary by jurisdiction and by the specific financial institution or regulator involved. This article provides a general overview and should not be treated as a substitute for jurisdiction-specific legal or compliance advice.

How Key2Law helps businesses prepare for Enhanced Due Diligence

For companies operating in high-risk industries, successfully passing Enhanced Due Diligence largely depends on the quality of their preparation. Well-organized corporate documentation, a transparent ownership structure, and an effective compliance framework can significantly reduce the number of follow-up requests and improve the likelihood of a positive decision by banks, payment institutions, and other financial organizations.

Key2Law team helps companies prepare for Enhanced Due Diligence by providing:

• EDD readiness reviews and preliminary risk assessments;
• Analysis of AML/CFT frameworks and internal compliance procedures;
• Preparation of corporate and supporting documentation;
• Assistance with ownership structure and beneficial ownership disclosures;
• Preparation of source of funds and source of wealth documentation;
• Support in communications with banks, EMIs, payment providers, and compliance departments;
• Ongoing advice on AML/CFT and regulatory compliance.

If your business is preparing to open a bank account, obtain a licence, raise investment, or undergo another process involving Enhanced Due Diligence, the Key2Law team can help you prepare the required documentation, identify potential risks, and develop an effective strategy for working with the reviewing institution. Contact us to improve your chances of successfully passing EDD and strengthen the confidence of financial institutions and regulators.