Enhanced Customer Due Diligence — When Standard ID Isn’t Enough
ECDD is the point where AML/CTF compliance gets uncomfortable for venue staff — asking patrons about their income, their source of funds, and their background. It is also the point where most compliance programs fall short. Here is what ECDD actually requires, when it applies, and how to handle it professionally.
The Difference Between CDD and ECDD
Customer Due Diligence (CDD) is the standard identification process — sight a photo ID, record the required details, retain the record for seven years. It applies to every patron who meets the identification trigger in your AML/CTF program.
Enhanced Customer Due Diligence (ECDD) is a deeper overlay. It applies to patrons whose risk profile — the combination of who they are, what they are doing, and the context around the transaction — warrants more than the standard process. ECDD asks more questions, requires more evidence, and produces a more substantial record.
The distinction is not that ECDD is “better.” It is that standard CDD is insufficient for higher-risk situations. Applying ECDD to every patron would be disproportionate. Applying it to no patron leaves higher-risk cases unaddressed.
When ECDD Applies
Your AML/CTF program sets the specific ECDD triggers. The Act and AUSTRAC guidance point to several categories that typically require ECDD:
ECDD Triggers
- MEDIUM or HIGH patron risk rating in your risk assessment
- PEP match — Politically Exposed Person status confirmed
- Sanctions-adjacent match — close association with a sanctioned party (a genuine sanctions match typically requires service refusal, not ECDD)
- Unusual transaction patterns — sudden changes in payout frequency or volume
- Apparent means inconsistent with transactions — claimed income and observed gaming activity diverge significantly
- Third-party collection indicators — patterns suggesting funds belong to someone other than the person present
- Prior SMR history — patrons who have been subjects of prior SMRs and continue transacting
- Identification inconsistency — documents that do not match observable facts
Triggers are not absolute. A single trigger does not always require ECDD; a combination often does. Your program should describe how your venue weighs the triggers in practice.
What ECDD Actually Requires
ECDD is an umbrella term. The specific procedures vary depending on which triggers apply and how strong they are. The full toolkit includes:
1. Additional Identity Verification
A second form of identity document — typically from a different category — corroborating the primary identification. For example, a driver licence (photo ID) plus a utility bill or bank statement (address corroboration). Not volume for volume’s sake — corroboration.
2. Source of Funds Enquiry
Ask the patron where the funds being gamed came from. Record the answer. Implausible or evasive answers are themselves data points. A plausible answer (salary, inheritance, business proceeds) reduces risk; an implausible answer (vague, shifting, defensive) increases it.
3. Source of Wealth Enquiry
For higher-risk patrons, a broader enquiry into overall financial background. Occupation, business interests, major assets, investments, inheritance history. This is typically compliance-officer-led, not front-line.
4. Compliance Officer Review
Escalation to the compliance officer for review of the full risk picture. The officer decides whether additional measures are warranted, whether service continues with enhanced monitoring, or whether service should be restricted.
5. Senior Management Approval
For the highest-risk patrons, senior management is informed and approves continued service. This creates executive awareness of the risk and a decision trail that protects the venue.
6. Enhanced Ongoing Monitoring
Every transaction by an ECDD patron receives heightened attention — lower thresholds for alerts, more frequent review of patterns, tighter limits on cumulative activity before re-assessment.
The Awkwardness Problem
ECDD in a pub or club context can feel intrusive. Asking a patron where their money came from — in a casual venue where most interactions are transactional and friendly — feels like a breach of hospitality etiquette.
It is not. ECDD is a legal obligation. Staff must be trained to ask the questions professionally, confidently, and without apology. Patrons who become hostile or evasive when asked have often just generated their own additional risk indicator.
“This is part of our standard process under AUSTRAC rules for payouts above a certain level. Can I just confirm a couple of details?” works better than apologetic over-explanation. Patrons who have legitimate income answer calmly; patrons who do not often give themselves away.
What Staff Should Not Do
- Apologise excessively or imply the patron is suspected of wrongdoing
- Waive the questions because the patron is a regular or a member
- Accept vague answers without probing further
- Pre-warn patrons that ECDD is coming before it is triggered
- Discuss the ECDD outcome with other staff beyond a need-to-know basis
Recording ECDD — The Record Is the Defence
ECDD records must demonstrate that the enhanced procedures were actually performed. A program that describes ECDD but produces records indistinguishable from Standard CDD has not done ECDD.
What an ECDD Record Must Include
- The ECDD trigger(s) that applied
- Additional documents sighted and their details
- Source of funds enquiry — the question asked and the patron’s response
- Source of wealth enquiry where conducted
- Compliance officer review record — name, date, decision, reasoning
- Senior management approval where applicable
- Enhanced monitoring settings applied to the patron’s account
- Any service restrictions imposed
- Follow-up review schedule
These records are your evidence in any AUSTRAC assessment. A well-populated ECDD record for each HIGH risk patron is more defensible than a hundred thin Standard CDD records.
Common ECDD Failures
“ECDD” That Is Indistinguishable from Standard CDD
Venues claim to do ECDD but the recorded procedure is identical to Standard CDD — one photo ID, basic details, no source of funds enquiry, no compliance officer review. This is not ECDD, regardless of the label.
No Source of Funds Enquiry
Staff feel uncomfortable asking about income and default to skipping it. The Source of Funds question is core to ECDD and missing it leaves the record incomplete.
Compliance Officer Review Not Documented
The compliance officer reviews a case informally and approves continuing service, but the review is not recorded with reasoning. An undocumented review is, from an evidential standpoint, no review at all.
No Periodic Re-Review
A patron is moved to MEDIUM risk with ECDD applied, and then the tier is never revisited. Risk changes over time — tiers must be reviewed regularly.
Uniform ECDD Regardless of Trigger
Every ECDD case receives identical treatment — one extra document, one pro-forma enquiry — regardless of which trigger activated ECDD. ECDD should be proportionate to the trigger: a PEP match requires different handling from a structuring indicator.
ECDD Treated As a One-Off Event
ECDD is performed once and then the patron is treated as Standard CDD going forward. ECDD status should persist — with enhanced ongoing monitoring — until the risk profile materially changes.
Where ComplyIQ Fits
ComplyIQ guides ECDD as a structured workflow — presenting the trigger, prompting for additional identity evidence, capturing source of funds and source of wealth enquiries, routing to the compliance officer, recording the review decision, and setting ongoing monitoring parameters automatically. The full ECDD record, retained for seven years, produces the evidence AUSTRAC expects to see.
For the full CDD picture, see our Customer Identification for Gaming Venues Pillar Guide.
ECDD Without the Awkwardness.
ComplyIQ structures the ECDD workflow so staff know what to ask, the compliance officer sees the full picture, and the record writes itself. Plus PEP screening, sanctions checks, and state self-exclusion checks in the same interaction. One platform for AUSTRAC and state gaming compliance. One audit trail. Support from a team who know pubs and clubs.