Reviewed by: Tom Devlin, Managing Director at KYC360 
Last Updated 19/10/26

A new corporate customer is ready to do business. Initial checks identify a holding company overseas and adverse media involving someone who may be connected to it. The commercial team wants a decision. The analyst still has three questions: Who ultimately controls the business? Is the media finding relevant to this customer? And can the answers be supported by current evidence? 

That is the point at which a straightforward onboarding journey can become an enhanced due diligence (EDD) investigation. The same questions arise when an existing high-risk customer comes up for review or an older file needs remediation. Answering them well matters. Answering them manually can take weeks. 

EDD Requires Clear Judgement

EDD is a risk-based response to a higher-risk relationship, rather than a fixed list of extra documents. The FATF Recommendations call for enhanced measures where higher risks are identified. The UK Financial Conduct Authority’s guidance on EDD explains that the extent of those measures should reflect the risk. Depending on the case, they may involve more robust verification of beneficial ownership, a closer examination of the business and the people controlling it, enquiries into source of wealth or funds, and enhanced monitoring.  

Compliance teams must answer the questions that prompted the review and preserve the evidence behind the decision. A sanctions or politically exposed person (PEP) match, for example, may require an analyst to establish whether it concerns the right person, how that person is connected to the customer and what the connection means under the firm’s policy. A name match alone cannot make that judgement. 

Where EDD Reviews Become More Demanding

Complex ownership structures
A multi-layered group may involve several registers and both corporate and individual owners. The team needs to distinguish legal ownership from effective control, establish the ultimate beneficial owner (UBO) where possible and explain any opaque link. Complexity alone is not proof of wrongdoing; it can make the structure harder to understand and evidence. 

High-risk periodic reviews
A previous risk rating is a starting point, not a current answer. Ownership may have changed, new adverse information may have emerged or an earlier gap may remain unresolved. The reviewer needs to establish what has changed since the last assessment and whether the firm’s monitoring and controls remain appropriate. 

Remediation at scale
When a portfolio of customer files lacks adequate ownership evidence or a documented EDD rationale, each case still needs a risk-based answer. Teams must prioritise the most significant gaps, obtain missing evidence and record what has been resolved across the population. Repeating an unstructured manual investigation for every file can quickly create a backlog. 

Why Manual EDD Becomes a Compliance Bottleneck

EDD can be resource-intensive before an analyst reaches the difficult judgement. A case may require paid registry extracts, filings from several jurisdictions, specialist enquiries and follow-up with the customer. Analysts spend time locating records, checking that they are current, resolving differences between sources and assembling an evidence trail. Those tasks have a cost, and each dependency can leave an onboarding decision or review waiting in a queue. 

Following Ownership Across Borders

An analyst may find a customer’s direct shareholder in one company register, only to discover that the shareholder is another company. That creates a new search, perhaps in a different jurisdiction, using records with different disclosure rules, languages, dates and definitions of control. A group chart supplied by the customer may help, but its links still need to be tested against independent evidence. Ownership percentages may explain one part of the picture while voting rights or other forms of control explain another. 

Sometimes the trail stops at a record that is unavailable or does not identify a natural person. The analyst may need to find another source, ask the customer for targeted evidence or seek specialist research. Each route adds waiting and validation. The useful result is a clear account of what has been established, what remains unverified and what further evidence is needed, not a guessed UBO. FATF guidance on beneficial ownership supports using information from multiple sources rather than relying on a single route to the answer. 

Turning Findings into a Current Risk Assessment

Collecting records is only the first pass. An analyst must reconcile different names, company identifiers and filing dates, distinguish current ownership from historical ownership, and investigate screening or adverse-media results in context. They may also need to test whether the customer’s stated business activity, operating footprint and online presence match independent evidence. An article about a parent company, a possible PEP connection or a discrepancy in where the business operates may each affect the assessment differently. Some findings call for more evidence from the customer or another source. Others may prove irrelevant, but the file still needs to explain why. 

This work often happens in sequence. A newly identified shareholder creates another ownership check. That check reveals another connected person who needs screening. A material discrepancy leads to customer outreach, and the answer may require the original assessment to be revisited. Waiting, rework and evidence gaps can add as much elapsed time as the searches themselves. 

Making the Decision Auditable

The final task is to show what was checked, which sources were used, what gaps remain, how risk was assessed and who approved the next step. This is easy to underestimate when evidence lives across browser tabs, email threads and spreadsheets. If the sources and reasoning were not recorded as the investigation progressed, reproducing the rationale for a supervisor, audit or future review can become another research project. 

In its 2026 review of customer due diligence and EDD controls, the FCA found cases where firms had not documented the EDD measures taken for high-risk customers. It also identified unclear review procedures and weaknesses in document version control. A conclusion is harder to challenge or revisit when the evidence trail cannot be reconstructed. 

The Operational Impact on Firms

The demanding part of EDD should be professional judgement: weighing contradictory facts, deciding what further enquiry is proportionate and explaining a risk recommendation. In a manual process, an analyst may instead spend much of their time locating records, copying names between systems, checking whether an earlier extract is still current and rebuilding a chain of sources for someone else’s review. 

The depth of the investigation can also depend on an analyst’s experience: knowing what to investigate, where to focus effort and how far to pursue an uncertain lead. Without a consistent method, similar cases may receive different levels of scrutiny. A supervisor can then find a missing link or an unexplained conclusion and send the case back through another round of research. 

A Better Path From Investigation to Decision 

An effective EDD review starts with a specific question: what risk is uncertain, and what evidence would change the decision? A repeatable process then gathers relevant information, checks it across sources, interprets material findings and records both the evidence and its limits. Global data and AI orchestration can reduce repetitive research and help apply those steps consistently. Explainable analysis should show why an ownership link, discrepancy or adverse finding may matter for financial crime risk, not simply present another data point. 

A source-backed report with time-stamped evidence links, quality assurance checks, risk-factor scoring and a structured risk review can give analysts an auditable starting point. They still need to challenge unreliable sources, seek further evidence where necessary and apply their firm’s policy and risk appetite.  

Conclusion

A clearly evidenced review helps appropriate relationships progress sooner, gives higher-risk cases the scrutiny they require and tells stakeholders what remains to be resolved. This leads to a faster route to a well-supported decision, and allows compliance to enable business.     

Experian Enhanced Due Diligence reports apply a consistent investigation method to global commercial, registry and public-source information. With access to more than 350 corporate registries, they bring ownership, business verification and relevant risk indicators into a structured, source-backed report, with reports ready in 48 hours or less.