If you’re responsible for AML compliance at a UK-regulated firm, EDD is probably something you’ll deal with regularly, and the decisions you make carry weight. When EDD processes are well defined and properly applied, they protect your firm from regulatory penalties and serious reputational damage. When they’re not, it’s usually where things start to unravel.

The starting point is knowing when to apply EDD, and that means your risk assessment framework has to be genuinely effective. It should flag PEPs, clients in jurisdictions with weak AML controls, high-value or complex transactions, and industries known for corruption risk. But the decision to trigger EDD should be dynamic, not static – risk can change, and your controls need to be able to respond to that.

From a practical perspective, the most useful thing you can do is make your EDD process repeatable and auditable. It’s about asking the right questions and having a documented rationale for the outcome. If you decide to proceed with a relationship after EDD, you should be able to explain exactly why, backed by evidence.

It’s also worth noting that EDD isn’t a one-time event. Monitoring has to continue throughout the business relationship. Periodic reviews should reflect the initial risk rating, and monitoring should feed back into the risk picture. If something shifts – like new sanctions, or a client suddenly sending funds to high-risk jurisdictions – EDD might need to be reapplied.

Technology can help, but it’s not a replacement for judgement. Automated screening tools can flag adverse media or sanctions exposure, but it takes human analysis to put that into context. 

Your senior management team also has a role to play. They need to be kept in the loop when EDD is triggered, especially in high-risk or politically sensitive cases. Getting their sign-off on higher-risk clients gives weight to the decision and brings accountability to the process.

In the end, EDD should be treated as a critical line of defence, not an optional hurdle. It’s your opportunity to spot financial crime before it embeds itself in your organisation, and to demonstrate to regulators that your controls work in practice, not just on paper.