Customer Due Diligence in Banks: CDD Rules for KYC AML 2026
A customer walks in, hands over an Aadhaar card, a PAN card and two photographs, and the account is opened in eleven minutes. Job done? That is exactly where most bankers — and most exam candidates — get it wrong. Customer due diligence is not the act of collecting documents. Collecting documents is one visible step inside it. The rest of customer due diligence happens quietly: working out who the real person behind the account is, why the relationship is being opened, what the transactions should look like, and whether somebody else is pulling the strings.
This short kicks off a KYC, AML and CFT series, and part one deals with precisely that gap between "papers taken" and "customer known".
Customer Due Diligence | KYC AML · Watch on YouTube
What customer due diligence actually means
Strip away the jargon and customer due diligence is four questions a bank must be able to answer about every relationship on its books:
- Who is this? Identify the customer and verify that identity from an independent, reliable source.
- Who is really behind this? Identify the beneficial owner — the natural person who ultimately owns or controls the account, even when a company or a trust sits on the nameplate.
- Why is this account being opened? Understand the purpose and the intended nature of the business relationship.
- Does the money match the story? Build an expected transaction profile and keep watching it.
The legal spine is the Prevention of Money Laundering Act, 2002 read with the PML (Maintenance of Records) Rules, 2005, and the operating manual for banks is the RBI Master Direction on Know Your Customer. Every threshold quoted below comes from that Direction — worth bookmarking, because it is amended often and examiners quote the latest version.
When is CDD triggered?
CDD is not only an account-opening ritual. The Master Direction pins it to specific events, and this is the table examiners love to build MCQs from.
| Situation | What the bank must do |
|---|---|
| Commencement of an account-based relationship | Full CDD before the first transaction |
| Occasional cash transaction of Rs 50,000 and above — single, or several connected transactions | Full CDD even if the person is a walk-in, non-account holder |
| International money transfer for a non-account holder | CDD irrespective of the label on the transaction |
| Doubt about the veracity or adequacy of documents already held | Fresh CDD, regardless of any threshold |
| Suspicion of money laundering or terrorist financing | CDD plus a Suspicious Transaction Report to FIU-IND |
Notice the pattern: two triggers are amount-based, three are judgement-based. A candidate who memorises only "Rs 50,000" loses the other three marks.
Identifying the beneficial owner
This is the part of customer due diligence that separates a clerk from a compliance officer. When a non-individual opens an account, the bank must drill through the entity to the natural person behind it. The thresholds under the PML Rules are:
| Type of customer | Beneficial owner threshold |
|---|---|
| Company | More than 10% of shares, capital or profits |
| Partnership firm | More than 10% of capital or profits |
| Unincorporated association or body of individuals | More than 15% of the property, capital or profits |
| Trust | 10% or more interest in the trust (settlor, trustees, beneficiaries) |
If no natural person crosses the threshold, the senior managing official is treated as the beneficial owner. The company figure was tightened to 10% by amendment — if your notes still say 25%, they are out of date.
Documents are the entry ticket, not the destination
Identity is verified through an Officially Valid Document (OVD). The Master Direction recognises six: passport, driving licence, proof of possession of Aadhaar number, Voter's Identity Card, NREGA job card signed by a State Government officer, and the letter issued by the National Population Register containing name and address details.
Identification no longer needs a branch visit. The Video-based Customer Identification Process (V-CIP) is an accepted alternate method — a live, secure, consent-based audio-visual interaction with facial recognition, independent verification and a full audit trail. For low-risk customers a bank may apply simplified measures; for politically exposed persons, non-face-to-face onboarding and high-risk profiles it must apply enhanced due diligence, including source-of-funds checks and senior management approval.
CDD versus ongoing due diligence
The video ends on the distinction most candidates fumble. Customer due diligence is what a bank does to establish the relationship. Ongoing due diligence is what it does for as long as the relationship lasts: comparing actual transactions against the expected profile, escalating unusual activity for review, filing a Suspicious Transaction Report when the explanation does not hold, and refreshing the KYC record on a clock.
| Risk category | Periodic KYC updation |
|---|---|
| Low risk | At least once every 10 years |
| Medium risk | At least once every 8 years |
| High risk | At least once every 2 years |
Small accounts sit in their own box: aggregate credits capped at Rs 1 lakh in a financial year, aggregate withdrawals at Rs 10,000 a month, and balance at Rs 50,000 at any point in time. Cross a limit and the relaxation stops — full customer due diligence has to follow.
How this is asked in the exam
Questions in the KYC, AML and CFT certification, and in the compliance papers, rarely ask you to define CDD. They ask applied one-liners. A walk-in deposits Rs 48,000 today and Rs 40,000 tomorrow — is CDD required? Yes, because connected transactions cross Rs 50,000. A company account has four shareholders at 9% each and one at 64% — who is the beneficial owner? The 64% holder. A high-risk account was KYC-updated in 2024 — when is it next due? 2026.
Build the habit of reading every threshold as a trigger rather than as a number, and this whole module turns mechanical. Practise the applied pattern on our chapter-wise mock tests, revise the wider syllabus through the JAIIB course and the CAIIB course, and follow the rest of this KYC series as it lands on the Learning Sessions blog.
Is KYC the same as customer due diligence?
No. KYC is the overall framework; customer due diligence is the process inside it that identifies and verifies the customer, establishes the beneficial owner, understands the purpose of the relationship and builds the expected transaction profile. Collecting documents is only the first step of CDD.
What cash transaction threshold triggers CDD for a non-account holder?
Rs 50,000 and above, whether it is a single transaction or several transactions that appear to be connected. Banks must also run CDD on any international money transfer for a person who is not an account holder.
How often must KYC records be updated?
At least once every two years for high-risk customers, once every eight years for medium-risk customers and once every ten years for low-risk customers, as per the RBI Master Direction on KYC. Updation is part of ongoing due diligence, not a fresh account-opening exercise.
Who is a beneficial owner in a company account?
The natural person who, alone or together with others, holds more than 10% of the shares, capital or profits of the company, or otherwise exercises control over it. If no individual crosses that threshold, the senior managing official is treated as the beneficial owner.
Quick quiz on this topic
5 exam-style questions from our free test bank — check yourself before you move on.
Practice this topic
Take a free mock test, download chapter PDFs, or watch a video class — all included on iibf.store.
Keep reading
