FATF Recommendation 10 sets the due-diligence baseline: identify and verify customers and beneficial owners, understand purpose and monitor the relationship. Risk-based practice links onboarding evidence with ongoing review and concerns requiring suspicious-transaction reporting.
TL;DR:
- Identify and verify customers and beneficial owners, understand purpose and review relationships.
- Apply due diligence at specified triggers, including suspicion and unreliable earlier information.
- Risk-based measures and incomplete-check consequences become binding through national implementation.
Summary
Identify the customer and the people behind it
Recommendation 10 addresses the foundation of customer due diligence. Institutions identify and verify the customer using reliable information and identify the beneficial owner, taking reasonable measures to verify that person's identity. For an organisation, the registered name and the person giving instructions are not necessarily the natural persons who ultimately own or control it. Understanding those roles makes the relationship intelligible before transaction activity is assessed.
Purpose, triggers and proportionate measures
CDD also concerns the purpose and intended nature of the relationship. The standard identifies triggers including establishment of a relationship, specified occasional transactions, suspicion of money laundering or terrorist financing and doubts about previously obtained identification information. Risk affects the depth of measures. Higher-risk circumstances call for enhanced attention, while simplified measures are subject to conditions and cannot be used to avoid dealing with suspicion. Domestic law supplies the binding operational triggers and detail.
Due diligence continues after onboarding
Ongoing review considers whether activity is consistent with what the institution knows about the customer, business and risk profile and keeps relevant information current. Ownership, representatives, expected payment flows and the customer's business can all change. These updates connect the original identity assessment with later monitoring. CDD is therefore more than storing an identity document: it is the maintained understanding needed to interpret activity and decide when additional investigation is warranted.
Incomplete information and related reporting duties
Where required due diligence cannot be completed, Recommendation 10 addresses whether to begin or continue the relationship or transaction and whether a suspicious-transaction report should be considered. The response depends on the circumstances and applicable implementation, including the risk of tipping off. Record keeping and reporting are supported by other Recommendations. A payment provider should therefore connect onboarding, review, escalation and evidence, while distinguishing the international standard from the precise duties imposed by its national law.
Keywords
- Recommendation 10
- customer verification
- beneficial owners
- relationship purpose
- ongoing diligence
- risk-based measures
- simplified controls
- suspicion triggers
- incomplete checks
- national implementation