What is customer due diligence (CDD)?
Customer due diligence (CDD) is the set of measures an obliged subject must apply to know and risk-assess a client: identify and verify the client, identify beneficial owners, understand the purpose and intended nature of the relationship, and monitor it on an ongoing basis. It has three intensities — simplified, standard and enhanced.
Written by Andréas Hobbelin · Last updated
The three levels
- Simplified (SDD) — reduced measures for demonstrably lower-risk situations. It is a reduction in intensity, never an exemption, and the justification must be documented.
- Standard — the default: identification, verification, beneficial ownership, purpose and nature, screening, and ongoing monitoring.
- Enhanced (EDD) — additional measures for higher-risk clients, products, channels or geographies.
The risk-based approach
CDD is not one fixed checklist. The law requires measures proportional to risk, which means you need a documented method for assessing that risk — factors, weightings, thresholds and outcomes — applied consistently across clients. A risk classification that cannot be explained is as much a finding as no classification at all.
Ongoing due diligence
CDD does not end at onboarding. Screening must be refreshed, documents must not be allowed to expire silently, and material changes — new beneficial owner, change of funding route, change of jurisdiction — must trigger a review. In property transactions that span months, this matters.
Frequently asked questions
Is CDD the same as KYC?
Effectively yes. CDD is the legal term in the directives and in Ley 10/2010; KYC is the common industry term for the same activity.
When can simplified due diligence be applied?
Only where lower risk is demonstrable and documented — for example certain regulated counterparties. It never removes the duty to identify the client or to monitor the relationship.
Sources and further reading
Put this into practice
PropComply structures KYC/CDD once per client and shares it securely with the parties in the transaction — each keeping their own independent decision.
Request access