Recommendation 10 sets the core customer due-diligence standard. It requires identification and verification of the customer, identification of the beneficial owner with reasonable measures to verify that identity, understanding the purpose and intended nature of the relationship, and ongoing due diligence. Anonymous or obviously fictitious-name accounts are inconsistent with the standard.

CDD is triggered by establishing a relationship and by specified occasional transactions, suspicion or doubts about previously obtained identification data. The intensity of measures follows risk. Higher-risk relationships require enhanced attention; simplified measures are subject to the framework's conditions and are inappropriate when suspicion exists.

Ongoing due diligence means comparing activity with what is known about the customer, business and risk profile, and keeping relevant information current. Where required CDD cannot be completed, the institution must consider the prescribed consequences, including whether to decline or terminate the relationship and whether a suspicious transaction report is warranted. National implementing law determines the binding operational detail.