Module 5: KYC, CDD, EDD, PEPs and the risk-based approach - Certificate in Anti-Money Laundering Fundamentals

← Course home · Free lesson

What you will learn

Explain KYC, CDD and EDD
Identify politically exposed persons and other high-risk cases
Apply the risk-based approach to customers, products and channels

KYC and CDD

Know Your Customer (KYC) and Customer Due Diligence (CDD) mean that an institution must:

identify the customer and verify the identity from reliable documents;
identify the beneficial owner (the real person who owns or controls the customer);
understand the purpose of the relationship and the expected activity;
monitor the relationship on an ongoing basis.

No anonymous, fictitious or number-only accounts are allowed.

Enhanced due diligence (EDD)

EDD means deeper checks and closer monitoring for higher-risk cases, such as:

politically exposed persons (PEPs), their family members and close associates;
customers connected to FATF high-risk jurisdictions;
non-face-to-face customers;
small or unsupervised grantees and partners (for NGOs).

A PEP is a person who holds or has held a prominent public function. A PEP is not a criminal, but the position creates a higher risk of corruption, so senior approval and a check on the source of funds are expected. BFIU's PEP instructions date from AML Circular No. 14 (25 September 2007), and bank-specific rules are in Circular No. 26.

The risk-based approach (RBA)

Not all customers carry the same risk. Under the RBA an institution assesses risk by customer, country or geography, product, service and delivery channel, then applies stronger measures where risk is higher and may simplify where it is demonstrably lower. Risk must also be assessed before launching a new product or technology (for example digital savings or mobile-wallet repayment).

Records and ongoing monitoring

CDD is not a one-time form. Institutions update information, watch for activity that does not fit the customer's profile, and keep identity and transaction records for at least 5 years.

Bangladesh lens: NGO-MFI thresholds in Circular 33

Any beneficiary receiving more than Tk 20,000 in cash, goods or services in a year: collect full identity information with supporting documents.
MFI clients with a loan sanctioned or a deposit balance of Tk 1,00,000 or more: full name and alias, parents' names, photograph, date of birth, nationality, occupation, and permanent and present address, verified including by field visits.
Any transaction of Tk 1,00,000 or more should go through a bank; an exception needs management approval.

In practice for an MFI: the field officer sees the client in person, so the officer's file (photograph, address, field visit, source of the loan repayment) is the first line of KYC. Large savings or a larger loan than the client's business suggests should be noted. These figures apply to NGOs/NPOs, including MFIs, under Circular 33 (30 September 2026). They are not general limits for every sector: banks follow Circular 26, financial institutions Circular 28, insurers Circular 27, capital market intermediaries Circular 31 and mobile financial services Circular 20. BFIU's e-KYC guidelines (Circular 25, 2020) apply to digital onboarding, with Circular 29 (30 March 2026) for insurers and capital market intermediaries.

Key takeaways

CDD: identify, verify, find the beneficial owner, understand the purpose, monitor.
EDD applies to PEPs, high-risk countries, non-face-to-face and unsupervised partners.
The risk-based approach assesses customer, geography, product, service and channel.
NGO-MFI KYC with photograph is required from Tk 1 lakh loans or deposits.

Practice quiz

Five questions, instant feedback. Not graded for the certificate.

Based on the Money Laundering Prevention Act 2012 (as amended 2015), the Anti-Terrorism Act 2009 and BFIU circulars, as understood on 16 October 2026. Laws and circulars change: always check the latest text on bfiu.org.bd. This course is general education, not legal advice. Cases marked "illustrative" are fictional.