#2.1 The Customer Due Diligence (CDD) Lifecycle

Customer Due Diligence (CDD) is the primary preventative barrier against illicit penetration into financial institutions. Compliant onboarding requires establishing verified identity, evaluating legal capacity, determining the beneficial ownership structure, and understanding the economic rationale for the business relationship.

Core CDD Tiers

1. Simplified Due Diligence (SDD): Applicable only to demonstrably low-risk relationships (e.g. regulated financial institutions, publicly listed companies on recognized exchanges). Requires standard identity verification without exhaustive ongoing refresh schedules.
2. Standard Customer Due Diligence (CDD): Standard retail consumers and domestic commercial entities. Involves independent government-issued photo ID verification, proof of address, tax identification cross-referencing, and baseline turnover estimation.
3. Enhanced Due Diligence (EDD): Statutorily mandated for Politically Exposed Persons (PEPs), family members and close associates (RCAs), high-net-worth cross-border accounts, relationships involving FATF high-risk jurisdictions, and complex multi-layered corporate holdings. Requires mandatory senior management onboarding approval and forensic Source of Wealth (SoW) corroboration.

#2.2 Remote Digital Onboarding & Biometric Liveness

In modern digital financial platforms, remote onboarding must satisfy strict cryptographic and biometric trust criteria:

• Document Authenticity Verification: Near-Field Communication (NFC) chip reading of e-passports and national identity cards, validating public key certificates (CSCA/DS) against ICAO PKD registries.
• Active & Passive Biometric Liveness: Anti-spoofing neural networks evaluating micro-movements, texture reflections, and depth disparities to defeat presentation attacks, deepfake video streams, and silicone masks.
• Continuous Session Risk Scoring: Behavioral telemetry analyzing device gyroscope movements, typing cadence, and network latency to distinguish legitimate applicants from bot farms and coerced victims.

#2.3 Ultimate Beneficial Ownership (UBO) Graph Traversal

Criminal networks systematically exploit shell companies, trusts, and nominee directors to sever ownership trails. Under FATF Recommendations 24 and 25, institutions must unwrap corporate holdings down to the natural persons who ultimately exercise control.

Deterministic Graph Unwrapping Algorithm

Let a corporate holding hierarchy be modeled as a directed acyclic graph $G = (V, E)$, where vertices $v \in V$ represent corporate entities or natural persons, and directed edges $e = (u, v, w) \in E$ represent shareholder $u$ owning percentage equity $w \in (0, 100]$ in entity $v$.

1. For an entity $X$, discover all directed paths $P = (u_k, \dots, u_1, X)$ connecting natural persons $u_k$ to $X$.
2. For each path $p \in P$, compute the effective indirect ownership stake:

1. Any natural person $u_k$ where $\text{Stake}(u_k, X) \ge 25\%$ (or $\ge 10\%$ for high-risk corporate vehicles) is statutorily classified as an Ultimate Beneficial Owner (UBO).
2. If no individual exceeds the threshold, or where doubt exists regarding true control, natural persons exercising executive control (e.g. CEO, Managing Director) must be documented as senior managing officials.