The FCA has published a report following its 2025 review of CDD, EDD and ongoing due diligence controls within a range of asset management, crowdfunding, wholesale banking, CfD and non-bank lending firms. Its high level findings, as usual, were mixed. They included:
- many firms did distinguish between CDD and EDD, and had incorporated into their policies and procedures the updated PEP identification guidance – and of these most firms did tailor their CDD approaches to customer risk profile and the best firms documented each stage of the EDD process;
- most firms had procedures for verifying customer identity, but generally these were not detailed enough and did not provide helpful guidance for staff;
- some firms had not addressed what to do when customers can’t provide standard evidence;
- some firms did not explain when periodic or event-driven reviews should take place;
- while some firms had in place approval matrices, others were unclear on when senior management needed to sign off on due diligence or did not give examples of when it was required, and some also lacked document version control procedures;
- some firms did not gather or record relevant information and others did not evidence or document EDD measures, or explain clearly how the approach between low and high risk customers differed;
- most firms had some compliance monitoring and audit, but the level and independence varied – the FCA saw good practices in regularly reviewed frameworks including by external advisers or internal audit, and good use of sample based compliance monitoring. The strongest firms used independent third line testing and acted on the results, but other firms had the same staff doing both onboarding and customer reviews.
The FCA now wants all firms to review its conclusions, and is working with firms who were part of the review who it has identified need to strengthen their controls.