Enhanced due diligence has a simple test: two years from now, someone who has never met the client opens the file and asks, “Why did we onboard this, and who agreed?” If the file answers that on its own, it’s an EDD pack. If it needs you in the room to explain it, it’s a folder of PDFs.
What triggers it
Higher-risk ratings do: PEP involvement, higher-risk jurisdictions, complex ownership, unusual source-of-wealth stories, adverse news that needs resolving. The trigger itself belongs in the file: what raised the risk rating, and when.
The pack, in order
- The trigger note. One paragraph: what made this EDD, dated.
- Identity and structure. The usual CDD set, plus the ownership chain drawn to the ultimate beneficial owners. If the chain took effort, keep the workings: effort is proof of diligence.
- Screening records, per name. Target, beneficial owners, connected parties, family names where warranted, screened against the MAS designated lists, the UN Security Council Consolidated List, US OFAC, and TSOFA. Keep the search capture and the date, not just a “cleared” note. A hit you dispositioned honestly reads far better in audit than a suspiciously clean file.
- Source of wealth and source of funds, corroborated. The story plus the documents that support it, and a sentence on whether they actually match. “SOW: business income” without corroboration is a description, not diligence.
- Adverse news, in the client’s languages. English-only searches on a name that lives in Chinese-language media is half a search. Capture the queries, the dates, the results, including the empty ones.
- The disposition note. The heart of the pack: risks identified, mitigants applied, residual risk, recommendation. Written so a reviewer can disagree with it: specifics, not adjectives.
- Approvals. Compliance sign-off and, where required, senior management approval, dated, with names. An approval trail that ends in an unsigned template is worse than none; it proves the control exists and wasn’t used.
- The review date. EDD isn’t an event. Higher-risk means shorter cycles, and the next review date should exist the day the pack closes.
Common mistake
Collecting documents instead of answering questions. Ten certified documents that don’t address the actual risk lose to three documents plus one honest paragraph that does. Auditors read the disposition note first. Write it like you know that.
General information, not legal or regulatory advice. Instruments are version-sensitive. Verify against mas.gov.sg and sso.agc.gov.sg before relying.