US rule requiring covered financial institutions to identify and verify customers and beneficial owners and conduct ongoing monitoring. Its scope covers account opening and ongoing customer relationships.

The main requirements are to identify and verify customers and beneficial owners; understand relationship purpose; monitor and update risk information.

Customer due diligence builds a reliable picture of the person or organisation receiving a financial service. Collecting a name is different from verifying identity, and identifying a company's registered owner is different from understanding its ultimate beneficial owners or controllers. The purpose and expected use of the relationship provide context for assessing later transactions.

Risk-based treatment changes the depth and frequency of the work. Higher-risk circumstances can require additional information or enhanced review, while any simplified approach remains subject to the conditions of the governing framework. Customer information also changes over time: ownership, representatives, business activity and expected payment patterns can all affect the original assessment.

The operational outcome is a documented relationship between identity evidence, the risk decision and ongoing monitoring. Onboarding should feed the transaction-review process, and unusual activity should feed back into the customer assessment. Due diligence is therefore an ongoing information and decision-making process, rather than a one-time collection of documents or a name-screening result.

The instrument also addresses reporting and evidence: retain certification and verification records; support SAR obligations.