Enhanced due diligence (EDD) is the heightened level of scrutiny that UK law firms must apply when dealing with clients or transactions that present a higher risk of money laundering or terrorist financing. While standard client due diligence provides a baseline level of verification, EDD goes further — requiring additional information, senior management approval, and more intensive ongoing monitoring.

For solicitors, misapplying or skipping EDD is one of the most common AML failings identified by the SRA. This guide explains exactly when EDD is required, what it must include, and how to document it effectively.

The Regulatory Basis for EDD

Enhanced due diligence is mandated by Regulation 33 of the Money Laundering Regulations 2017. The Regulation sets out specific circumstances in which EDD is automatically required regardless of the firm’s own risk assessment, and also establishes the principle that EDD must be applied whenever a higher risk of money laundering or terrorist financing is identified.

This dual framework — mandatory triggers plus a discretionary risk-based obligation — means that applying EDD only when one of the listed triggers is technically met is not sufficient. Firms must be alert to higher-risk scenarios and apply EDD proportionate to the specific risks identified.

When Enhanced Due Diligence Is Mandatory

Politically Exposed Persons

Any individual who is, or has been, a Politically Exposed Person (PEP), or who is an immediate family member or known close associate of a PEP, automatically triggers EDD.

Regulation 35 defines a PEP as an individual who is, or has been, entrusted with a prominent public function — including:

Heads of state or government
Senior politicians (ministers, members of parliament, members of governing bodies of political parties)
Senior judicial officers
Senior military officials
Senior executives of state-owned enterprises
Members of management bodies of international organisations

PEP status is not automatically lifted when someone leaves office. The Regulations require that a person who has ceased to hold a prominent public function must continue to be treated as a PEP for a period of at least 12 months after leaving the role. In practice, many compliance programmes treat ex-PEPs as higher risk for 18–24 months, depending on the role previously held and the jurisdiction.

What EDD for a PEP must include:

Adequate measures to establish the source of wealth and source of funds
Senior management approval before establishing (or continuing, where a client becomes a PEP) the business relationship
Enhanced ongoing monitoring of the relationship

“Senior management” means a member of the board or a senior partner with genuine authority — the Regulations contemplate sign-off by someone with the standing and information to make a meaningful decision, not just a more junior compliance officer.

High-Risk Third Countries

Transactions involving individuals or entities connected to countries designated by the UK Government as high-risk third countries under Regulation 33(1)(b) automatically require EDD. The UK’s list of high-risk third countries is updated periodically on GOV.UK and broadly tracks FATF’s list of jurisdictions under increased monitoring (the “grey list”) plus those subject to a call for action (the “black list”).

The connection to a high-risk third country may arise in several ways:

The client is established or resident in a high-risk third country
The transaction involves real property located in a high-risk third country
Funds are routed through a high-risk third country
A beneficial owner of the corporate client is connected to a high-risk third country

What EDD for a high-risk third country transaction must include:

Under LSAG guidance, EDD measures appropriate to high-risk third country scenarios include:

Obtaining additional information on the client and on the beneficial owners
Obtaining additional information on the intended nature of the business relationship
Obtaining information on the source of funds and source of wealth
Obtaining information on the reasons for the proposed transactions
Obtaining approval of senior management to establish or continue the business relationship
Conducting enhanced ongoing monitoring

The Regulations prohibit reliance on third-party CDD from entities in high-risk third countries.

Non-Face-to-Face Transactions

Where the business relationship or transaction is established without the physical presence of the client, the Regulations require measures to compensate for the reduced opportunity to verify identity. This is not labelled “EDD” in the Regulations but produces equivalent obligations in practice.

Measures to compensate for non-face-to-face identification include:

Requiring certified copies of identity documents
Requiring the first payment to be made from an account in the client’s name held with a UK-regulated financial institution
Using electronic verification against multiple data sources
Conducting video identification

Discretionary EDD: The Risk-Based Obligation

Beyond the mandatory triggers, Regulation 33(1)(a) requires EDD in any situation that “by its nature can present a higher risk of money laundering or terrorist financing.” This is the catch-all provision that requires firms to exercise genuine risk-based judgment.

Common Discretionary EDD Scenarios

Complex or unusual transaction structures. A transaction that has no obvious commercial rationale, involves unnecessary complexity, or appears structured to obscure the ownership of assets or the flow of funds warrants EDD. The question to ask is: why is this structured this way? If there is no clear legitimate answer, that is a red flag.

Unusually large transactions. A transaction that is disproportionate to the client’s stated business or financial profile warrants additional scrutiny. A sole trader purchasing a £2 million commercial property, for example, should prompt questions about the source of funds even if the client is not technically a PEP.

Clients using intermediaries without clear justification. Where a client instructs you through an intermediary and cannot or will not explain why, that creates risk. Legitimate principals generally have no objection to direct contact with their solicitors.

Transactions involving corporate vehicles in secrecy jurisdictions. Companies incorporated in offshore financial centres — the British Virgin Islands, Cayman Islands, Panama, and similar — are frequently used as vehicles for concealing beneficial ownership. Their use is not inherently suspicious, but it requires careful scrutiny of the ownership and control structure.

Cash transactions or unusual payment methods. Large cash payments, or payments from unexpected third parties, are classic red flags for money laundering. Where cash is involved, EDD is almost always warranted.

Clients referred through unusual channels. A client referred by someone outside the firm’s normal referral network, particularly from overseas, warrants more scrutiny than a client recommended by a trusted professional contact.

What EDD Must Achieve

Whether EDD is mandatory or discretionary, its purpose is the same: to give the firm a sufficient level of confidence — proportionate to the risk — that the client is who they say they are, that the funds involved are legitimate, and that the transaction has a genuine commercial or personal rationale.

EDD is not a formulaic checklist. The SRA expects firms to tailor EDD to the specific risks identified. A PEP who is a retired local councillor in a low-risk jurisdiction warrants different EDD from a former senior minister in a high-risk country with a history of corruption.

Source of Funds

Source of funds (SOF) verification is a core element of EDD. It means establishing where the specific funds being used in the transaction came from — not the client’s general financial background, but the actual money flowing through the transaction. For a property purchase, this means the deposit, the mortgage proceeds, and any bridging finance.

Acceptable SOF evidence includes:

Bank statements showing the accumulation of funds
Salary slips and employment evidence for funds derived from earnings
Completion statements from a previous property sale
Probate documents for inherited funds
Documentation of a business sale
Dividend records for investment income

The key question is: can you trace the funds back to a legitimate source? If the client cannot provide satisfactory SOF evidence, that is itself a significant red flag.

Source of Wealth

Source of wealth (SOW) is broader than source of funds — it addresses the client’s overall financial position and how they came to accumulate their wealth. SOW is particularly relevant for PEPs and high-net-worth clients in high-risk jurisdictions.

SOW evidence might include:

Employment history and salary history
Business ownership and valuation evidence
Investment portfolios
Property ownership history
Inheritance documentation

SOW verification can be challenging for clients in certain jurisdictions where documentary evidence is limited. Firms should document the steps taken and the judgment applied, even where perfect documentation cannot be obtained.

Senior Management Sign-Off

EDD for PEPs and for other higher-risk situations should involve senior management approval. In practice, this means a partner or senior manager reviewing the EDD file and making a recorded decision to proceed.

Senior management sign-off is not a rubber stamp. The person signing off must have read the EDD material, considered whether the explanation is plausible and the risk is acceptable, and recorded their reasoning. The SRA will look for evidence that sign-off was substantive rather than automatic.

Documenting EDD

Documentation is crucial. EDD must be documented in a way that demonstrates:

What risk factors triggered EDD
What additional information was obtained
How that information was verified
What the senior management sign-off said
What monitoring measures were put in place

A well-documented EDD file tells a coherent story: the firm identified the risk, sought appropriate information, verified it, and made a considered decision to proceed (or not). If the SRA or law enforcement asks to see the file, it should be clear from the documentation that the firm acted properly.

Enhanced Ongoing Monitoring

Where EDD is applied, the ongoing monitoring obligation is also heightened. For EDD clients, firms should:

Review the CDD file more frequently (e.g., annually rather than every three years for a standard client)
Be more alert to transactions that diverge from the client’s profile
Monitor for changes in PEP status, sanctions listings, and adverse press

Automated monitoring tools — which re-check clients against PEP lists, sanctions registers, and adverse media on an ongoing basis — are increasingly standard in firms handling significant volumes of higher-risk work.

EDD and the SAR Decision

Where EDD raises genuine concerns that are not fully resolved — where the source of funds cannot be adequately explained, or where the transaction structure seems designed to obscure rather than enable — the firm faces a decision about whether to file a Suspicious Activity Report (SAR) with the National Crime Agency.

The threshold for an SAR is suspicion, not proof. If, after completing EDD, the firm has grounds to suspect (not merely wonder) that the funds may be criminal property, an SAR must be filed before proceeding. Where a SAR is filed and a defence against money laundering requested, the firm must await NCA consent (or the expiry of the seven-day response window) before acting.

Obiter supports the EDD process by automatically flagging clients who match PEP and sanctions lists at onboarding and during ongoing monitoring, alerting the relevant fee earner and MLRO to complete enhanced checks before proceeding. This helps firms ensure that no higher-risk client slips through without the scrutiny the Regulations require.

Enhanced Due Diligence: A Guide for High-Risk Client Scenarios