Do you really know who you are doing business with?
For lawyers, accountants, company secretaries, trust companies and other professional service providers, accepting new clients is part of everyday business. However, not every customer relationship is as straightforward as it appears.
What if a client is acting on behalf of an undisclosed individual? What if a company has a complex ownership structure that conceals its true beneficial owner? What if a customer appears on a sanctions list?
These are situations where Customer Due Diligence (CDD) becomes essential.
In Malaysia, Customer Due Diligence is an important component of Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) requirements for relevant reporting institutions, including Designated Non-Financial Businesses and Professions (DNFBPs).
Understanding CDD helps businesses identify potential risks, support regulatory compliance and protect themselves from becoming unknowingly involved in financial crime.
What Is Customer Due Diligence (CDD)?
Customer Due Diligence (CDD) is the process of identifying and verifying customers, understanding the purpose of their business relationships and assessing potential risks associated with those relationships.
In simple terms, CDD helps businesses answer three important questions:
- Who is my customer? Have we verified their identity using reliable information?
- Who is behind the transaction? Do we know who ultimately owns or controls the business?
- What risks does this relationship present? Are there indicators of money laundering, terrorism financing or sanctions exposure?
CDD goes beyond collecting identification documents. Depending on the applicable requirements, it may involve beneficial ownership verification, risk screening and ongoing monitoring.
The objective is to help businesses make informed decisions before entering into or continuing potentially risky relationships.
Who Are DNFBPs in Malaysia?
DNFBPs are Designated Non-Financial Businesses and Professions. Although they are not traditional financial institutions, certain activities they perform can expose them to money laundering and terrorism financing risks.
Relevant sectors include:
- Lawyers: Handling specified property, financial or corporate transactions.
- Accountants: Providing certain services involving client assets or business structures.
- Company secretaries: Providing specified company formation and corporate services.
- Trust companies: Managing relevant trust arrangements and assets.
- Registered estate agents: Conducting covered property-related activities.
- Dealers in precious metals and precious stones: Undertaking transactions covered by applicable AML/CFT requirements.
Certain non-bank financial institutions, including moneylenders and leasing or factoring businesses, may also be subject to relevant AML/CFT obligations.
These businesses can be attractive to criminals seeking to conceal ownership, disguise illicit funds or use legitimate transactions to facilitate financial crime.
Why Is Customer Due Diligence Important for DNFBPs?
Customer Due Diligence is more than a regulatory responsibility. It is an important preventive measure that helps organizations identify risks before they become serious problems.
1. Reduce Money Laundering Risks
Criminals may attempt to use legitimate professional services to create companies, purchase property or move funds while concealing their unlawful origins.
For example, a newly incorporated company may receive unusually large capital injections that do not match its stated business activities.
CDD helps businesses understand customer profiles and recognize transactions that may require further investigation.
2. Identify Ultimate Beneficial Owners
The person approaching your business may not be the person who ultimately owns or controls the entity involved.
Some companies operate through multiple shareholders, nominee arrangements or complex corporate structures.
While these arrangements can be legitimate, they may also obscure ownership.
Customer Due Diligence helps reporting institutions identify relevant beneficial owners and understand who controls the business relationship.
3. Detect Sanctions, PEP and Adverse Media Risks
A customer may appear legitimate but have connections to sanctions, politically exposed persons (PEPs), watchlists or relevant adverse media.
Identifying these indicators early helps businesses determine whether additional investigation or enhanced due diligence is necessary.
For example, a PEP connection may require closer scrutiny under applicable risk-based requirements. PEP status alone does not establish wrongdoing.
Businesses can support this process through VERISafe instant risk screening, which helps identify relevant sanctions, watchlist, PEP and adverse media indicators during customer onboarding.
4. Support AMLA Compliance and Protect Reputation
Malaysia’s Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), together with applicable regulatory policies, establishes obligations for relevant reporting institutions.
These may include customer verification, risk assessment, recordkeeping and suspicious transaction reporting.
Businesses should refer to Bank Negara Malaysia’s official AML/CFT policy documents for requirements relevant to their activities.
Beyond compliance, proper CDD also helps protect an organization’s reputation and demonstrates its commitment to responsible business practices.
When Should Customer Due Diligence Be Conducted?
CDD is not limited to high-value transactions. Depending on applicable requirements, it may be necessary in several circumstances.
Before establishing a business relationship: Relevant customer identification and verification measures may need to be completed before accepting a new client.
During certain occasional transactions: CDD may be required when transactions meet specified regulatory conditions or thresholds.
When suspicious activity is identified: Suspicions of money laundering or terrorism financing may trigger CDD obligations regardless of the transaction amount.
When customer information becomes unreliable: Inconsistent identification details or unexplained ownership changes may require further verification.
The important principle is to perform the appropriate checks at the required stage rather than waiting until a problem occurs.
What Information Is Required for Customer Due Diligence?
The information collected depends on the customer type, business relationship and applicable regulatory requirements.
For individuals, relevant information may include:
- Full name and identification details
- Date of birth and nationality
- Residential or business address
- Occupation and employment information
- Purpose of the business relationship
For corporate customers, additional information may include company registration details, directors, authorized representatives, ownership structures and beneficial owners.
Depending on the circumstances, businesses may also need to understand the source of funds or source of wealth.
However, collecting customer information alone does not complete CDD. Appropriate verification, risk assessment and ongoing measures are also important.
Common Customer Due Diligence Red Flags Across Industries
Different industries face different risks. Recognizing warning signs helps professionals identify situations that may require closer examination.
| Industry | Potential Red Flags |
|---|---|
| Company Secretaries | Complex ownership structures, unexplained capital injections or unclear nominee arrangements |
| Accountants | Unexplained capital movements or transactions inconsistent with the client’s business profile |
| Trust Companies | Unusual withdrawals shortly after assets enter a trust or unclear beneficiaries |
| Moneylenders | Unexpected early loan repayments or repayments from unrelated third parties |
| Real Estate Professionals | Unclear beneficial ownership or unusual payment arrangements |
| Precious Metals Dealers | Unusual cash purchases or transaction patterns inconsistent with the customer’s profile |
These indicators do not automatically mean that financial crime has occurred.
However, they may justify additional documentation, closer investigation or enhanced due diligence.
A red flag is not proof of wrongdoing. It is a reason to look more carefully.
KYC vs. CDD vs. Enhanced Due Diligence: What’s the Difference?
These three concepts are closely related but serve different purposes.
| Process | Main Purpose |
|---|---|
| Know Your Customer (KYC) | Identify and verify the customer’s identity |
| Customer Due Diligence (CDD) | Understand the customer relationship and assess relevant risks |
| Enhanced Due Diligence (EDD) | Apply additional scrutiny where higher risks are identified |
For example, a company secretary may first verify a customer’s identity through KYC.
CDD then involves understanding the ownership structure, identifying beneficial owners and assessing relevant risk indicators.
If higher risks are identified, additional measures may be required under EDD.
Together, these processes support a more comprehensive AML/CFT framework.
Why Ongoing Customer Due Diligence Matters
Customer risk profiles can change after onboarding.
A customer may become a PEP, a company may change ownership, new adverse media may emerge, or a related party may become subject to sanctions.
This is why ongoing Customer Due Diligence is important.
Depending on the applicable requirements and risk level, businesses may need to update customer information, reassess risks, review transactions and conduct repeat screening.
A customer who presented a lower risk yesterday may require closer attention tomorrow.
How Background Screening Supports Customer Due Diligence
Risk-based background screening can help businesses identify relevant information that may not be apparent from customer declarations alone.
Depending on the screening scope, this may include sanctions exposure, PEP connections, adverse media and relevant regulatory or court information.
A structured background check helps compliance teams identify potential concerns requiring further assessment.
For organizations that need additional verification beyond instant database screening, Verity Intelligence’s comprehensive background check services provide broader verification options for appropriate business purposes.
However, background screening is only one component of CDD. It does not replace identity verification, beneficial ownership assessment, transaction monitoring or other applicable compliance obligations.
How VERISafe Helps DNFBPs Strengthen Customer Risk Screening
For DNFBPs managing multiple customers, conducting risk screening manually can be time-consuming.
VERISafe by Verity Intelligence provides instant risk screening to help organizations identify relevant indicators more efficiently.
Its screening sources include:
- Global and local sanctions lists
- Terrorism-related watchlists
- Politically exposed persons
- Adverse media
- Relevant Malaysian police postings and court records
VERISafe can support businesses by enabling faster initial screening, identifying potential red flags and facilitating repeat checks as part of ongoing due diligence.
It also helps compliance teams apply a more consistent approach to customer risk screening.
VERISafe supports the screening component of CDD. It does not independently fulfill every AML/CFT obligation or guarantee regulatory compliance.
Conclusion: Know Your Customer Before You Do Business
Customer Due Diligence is an important responsibility for DNFBPs and other relevant reporting institutions in Malaysia.
Whether you are a lawyer, accountant, company secretary, trust company or registered estate agent, understanding who you are doing business with helps reduce financial crime, compliance and reputational risks.
CDD is not simply about collecting identification documents. It involves verifying identities, understanding beneficial ownership, identifying potential risks and applying appropriate due diligence throughout the customer relationship.
Trust is important, but trust should be supported by verification.
Strengthen your customer risk screening with VERISafe. Discover how Verity Intelligence can support your organization’s screening and risk management needs.
