A customer completes identity verification successfully. Their NIN matches, their documents are valid, and there are no issues with their personal information. But during AML screening, their name matches a politically exposed person (PEP) record.

Do you approve the account, reject the customer, or send the case for further investigation?

Passing KYC confirms that a customer's identity checks were successful. It doesn't establish whether the customer presents an acceptable level of money laundering or financial crime risk.

For banks and fintechs, this is where enhanced due diligence (EDD) becomes necessary. The challenge is knowing when additional checks are required, what information to collect, who should approve the relationship, and how to manage the risk after onboarding.

A structured EDD workflow helps compliance teams move from a risk alert to an informed, documented decision without leaving legitimate customers stuck in review.

When Should Enhanced Due Diligence Be Triggered?

Enhanced due diligence applies when a customer, transaction or business relationship presents higher money laundering, terrorist financing or proliferation financing risk.

In Nigeria, the Money Laundering (Prevention and Prohibition) Act 2022 establishes the broader legal framework for customer due diligence and financial crime prevention.

Sector-specific requirements also apply. Banks and other CBN-regulated financial institutions must follow the CBN Customer Due Diligence Regulations 2023, while SEC-regulated capital market operators must comply with the applicable SEC AML/CFT/CPF regulations.

For CBN-regulated institutions, Regulation 17 requires enhanced customer due diligence where higher financial crime risks have been identified.

Common risk indicators include:

A potential sanctions match also requires immediate attention, but it must be handled differently from ordinary EDD risk indicators.

A confirmed applicable sanctions prohibition is not an EDD case that can be approved based on risk appetite. Once the institution establishes a true match against a relevant sanctions designation, it must follow the applicable restrictions, asset-freezing and reporting requirements. Potential matches must therefore be investigated promptly, with escalation to the institution's sanctions compliance process where necessary.

For a broader explanation of risk-based customer checks, read our guide to customer due diligence requirements for African fintechs.

Step 1: Review the Risk Flag Before Escalating the Customer

Not every screening alert is a confirmed risk.

Suppose a prospective customer shares the same name as someone identified in a PEP database. Before escalating the customer for enhanced due diligence, the compliance team must determine whether the records relate to the same person. Compare available identifiers such as date of birth, nationality, location, aliases and other reliable information.

The review should produce one of three outcomes:

• False positive: The evidence establishes that the customer is not the individual identified in the screening result.
• Confirmed match: The customer matches the relevant record and requires assessment under the applicable risk and compliance requirements.
• Unresolved match: Available information is insufficient to confirm or dismiss the alert, so further investigation is required.

Record the outcome and the evidence supporting it. This prevents compliance teams from investigating obvious false positives while ensuring genuine risk indicators receive appropriate attention.

Include PEP Family Members and Close Associates

PEP screening should not stop with the individual holding public office.

The CBN's Guidance Note on Politically Exposed Persons addresses the risks associated with PEP family members and close associates, including situations where those relationships are used to conceal ownership or financial interests.

For business customers, this also means examining whether a PEP is the ultimate beneficial owner or exercises control through another individual or entity.

A confirmed PEP relationship does not automatically establish criminal conduct or require the customer to be rejected. It determines which additional risk assessments and due diligence measures the institution must apply.

Our guide to PEP screening in Africa explains how compliance teams can investigate potential matches and assess associated risks.

Step 2: Collect the Additional Information the Risk Requires

Once a customer is classified as higher risk, the compliance team needs more information about the individual or business, the purpose of the relationship and the financial activity expected.

Regulation 17 of the CBN Customer Due Diligence Regulations identifies enhanced measures that include additional customer information, the intended nature of the business relationship, source of funds, source of wealth and reasons for transactions.

The evidence requested should address the specific risk identified during screening.

Source of Funds

Source of funds explains where the money involved in a particular transaction or business relationship originates.

For example, a customer receiving a large deposit may explain that the money came from a property sale, business revenue or employment income. Supporting evidence can include bank statements, sale agreements, invoices, payslips or relevant business records.

The compliance team must assess whether the explanation is consistent with the available information.

Source of Wealth

Source of wealth explains how a customer accumulated their overall wealth. This becomes particularly important when reviewing higher-risk customers whose financial circumstances require closer examination.

A customer may establish that a specific deposit came from an investment account, but that does not necessarily explain how the funds held in that account were originally accumulated.

Source of funds and source of wealth answer different questions. An effective EDD process considers both where required by the customer's risk profile.

Beneficial Ownership

For business customers, verifying the registered company is not enough.

Compliance teams need to identify the individuals who ultimately own or control the business, particularly where ownership involves multiple companies, trusts or other legal arrangements. Review corporate registration records, ownership structures and other reliable sources to determine who exercises effective control.

Where ownership information cannot be established or verified, the case must be escalated under the institution's due diligence procedures.

Avoid Tipping Off During an Investigation

Requesting additional documents is a normal part of EDD, but compliance teams must consider whether contacting the customer could reveal an existing suspicion of financial crime.

Under Regulation 22 of the CBN Customer Due Diligence Regulations 2023, where an institution suspects money laundering, terrorist financing or proliferation financing and believes conducting CDD could tip off the customer, it must not pursue that CDD process and must immediately file a Suspicious Transaction Report with the Nigerian Financial Intelligence Unit (NFIU).

Customer communication must therefore follow approved AML escalation and confidentiality procedures. The objective is to obtain sufficient evidence to assess the risk without compromising an investigation or breaching reporting obligations.

Step 3: Investigate the Evidence and Assess the Customer's Risk

The investigation should establish whether the customer's explanations, supporting documents and financial activity are consistent with their known profile.

Consider a business customer that declares expected annual revenue of ₦80 million but receives ₦40 million from several unfamiliar counterparties in a single month. Has the company secured a major contract? Has its operating model changed? The business may provide contracts and invoices to explain the increase, and the investigator should assess whether those records genuinely support the explanation rather than assuming unusual activity is automatically fraudulent.

A practical EDD assessment should establish:

1. Whether the customer's identity and beneficial ownership details have been verified.
2. Whether source-of-funds and source-of-wealth explanations are credible.
3. Whether the customer's financial activity matches the stated purpose of the relationship.
4. Whether PEP exposure, adverse media, or other findings increase financial crime risk.
5. Whether the identified risks can be managed under the institution's risk appetite and applicable legal requirements.

Where material inconsistencies remain unresolved, the case should be escalated for additional review.

The investigation must conclude with documented findings, outstanding concerns, and a recommended risk classification. That recommendation provides the basis for the approval decision.

Step 4: Escalate the Case and Record the Approval Decision

Completing an EDD investigation does not automatically mean the customer should be approved. The institution must decide whether the relationship can proceed, whether additional controls are required and who has authority to make that decision.

Under Regulation 17(2)(e) of the CBN Customer Due Diligence Regulations 2023, enhanced measures include obtaining senior management approval to commence or continue a higher-risk business relationship. The CBN also sets specific requirements for PEP relationships through its 2023 PEP Guidance Note.

Build these approval requirements into the EDD workflow instead of relying on informal conversations or undocumented exceptions.

What Should an EDD Decision Record Contain?

• The risk indicator that triggered the investigation.
• The screening results and additional documents reviewed.
• The investigator's findings and customer risk assessment.
• Any unresolved concerns and recommended control measures.
• The proposed decision and its justification.
• The authorised approver and approval date.
• The ongoing monitoring requirements.

The institution can then approve the relationship with appropriate controls, request further information or decline it in accordance with applicable requirements.

Where a confirmed sanctions designation imposes a prohibition or asset-freezing requirement, the case must follow the relevant sanctions process rather than an ordinary risk-based approval route. Where suspicious activity is identified, the compliance team must assess and fulfil its reporting obligations, including filing an STR with the NFIU when required.

Keep the Evidence Behind the Decision

An EDD decision must remain traceable after the case has been closed.

For CBN-regulated institutions, Regulation 23 requires CDD records, account files, business correspondence and related analyses to be retained for at least five years after the business relationship ends or the occasional transaction takes place.

Records should be securely stored, accessible to authorised personnel and available for regulatory examination. This makes the investigation history as important as the final approval status.

Step 5: Apply Enhanced Monitoring After Approval

Approving a higher-risk customer does not end the institution's EDD responsibilities. Customer circumstances change, transaction patterns evolve, and new screening information can alter the original risk assessment.

Under Regulation 17(2)(f), the CBN requires enhanced monitoring of higher-risk business relationships through additional controls and closer examination of transaction patterns. Regulation 23 also specifies that high-risk customer information must be reviewed every 12 months, or sooner when circumstances require.

Consider a business that normally receives domestic payments from a small group of customers but suddenly begins receiving large international transfers from unrelated counterparties. That change should trigger an investigation into the source and purpose of the funds, the counterparties involved and whether the activity remains consistent with the business relationship, with any new findings feeding back into the customer's risk assessment.

How Dojah Supports Enhanced Due Diligence

An effective EDD workflow depends on identifying risk indicators, investigating potential matches, and maintaining a reliable record of decisions. Dojah's AML screening and case management tools support these activities without requiring compliance teams to manage every investigation across separate spreadsheets, emails and manual trackers.

Identify High-Risk Customers With AML Screening

Dojah's AML screening capabilities allow businesses to screen individuals and entities against relevant PEP databases, sanctions lists, and adverse media sources. Screening results provide potential matches and associated risk information for compliance review.

Teams can perform individual or bulk screenings, while fuzzy matching helps identify name variations and possible matches that exact-name searches may miss.

Manage Investigations in One Workflow

Dojah's AML suite brings screening results and case management together. Compliance teams can assign cases, update match statuses, record comments, and maintain an audit trail of investigation activity.

The platform supports statuses such as No Match, Potential Match, False Positive and Confirmed Match (Suspicious), helping reviewers distinguish cases that require further investigation from those that have been resolved.

Teams can also assign risk levels, flag cases for ongoing monitoring, and download case reports for internal review or audit purposes. Role-based access controls and case management help restrict sensitive compliance information to authorised users.

These capabilities provide the operational structure needed to manage alerts and maintain visibility over screening decisions. They do not replace the institution's responsibility to collect additional EDD evidence, assess source of funds and source of wealth, approve higher-risk relationships or fulfil regulatory reporting obligations.

Transaction monitoring also remains a separate part of the institution's financial crime control framework. Screening and case management information should be considered alongside transaction activity, customer risk assessments and other internal records when determining the appropriate response.

Build an EDD Process That Moves From Alerts to Decisions

A higher-risk customer should not leave your compliance team guessing what happens next.

Every alert needs a review process. Every investigation needs supporting evidence. Every approval needs a record of who made the decision and why. The same discipline must continue after onboarding, with customer activity monitored and risk assessments updated when new information emerges.

A structured EDD workflow helps compliance teams distinguish false positives from genuine risks, focus investigations where they matter, and maintain accountability throughout the customer relationship.

Turn AML screening alerts into structured investigations.

Book a demo with Dojah to see how AML screening and case management can support your compliance workflow.

Frequently Asked Questions

• What Triggers Enhanced Due Diligence?

Enhanced due diligence is required when a customer, transaction, or business relationship presents higher money laundering, terrorist financing, or proliferation financing risk.

Triggers include high-risk PEP exposure, complex ownership structures, significant exposure to high-risk jurisdictions, unusual transaction activity, and other indicators identified through the institution's risk assessment.

• Is Enhanced Due Diligence Required for Every PEP?

No. The applicable measures depend on the PEP category and assessed risk.

Under Sections 4.6 and 4.8 of the CBN's 2023 PEP Guidance Note, foreign PEPs and high-risk PEPs require EDD. Medium- or low-risk domestic PEPs and international organisation PEPs are subject to risk-proportionate requirements, including minimum customer identification procedures.

Institutions must also consider relevant family members, close associates and beneficial ownership relationships, and comply with applicable approval and monitoring requirements.

• What Is the Difference Between Source of Funds and Source of Wealth?

Source of funds explains where the money involved in a particular transaction or business relationship originates. Source of wealth explains how the customer accumulated their overall financial resources.

Both help compliance teams assess whether a customer's financial circumstances and activity are consistent with their known profile.

• Who Approves an Enhanced Due Diligence Case?

Approval follows the institution's governance framework and the applicable regulatory requirements.

For higher-risk relationships covered by Regulation 17 of the CBN Customer Due Diligence Regulations 2023, senior management approval forms part of the enhanced due diligence measures. The institution must document the authorised decision and any conditions attached to approval.

• How Long Should Enhanced Due Diligence Records Be Retained?

For CBN-regulated financial institutions, Regulation 23 requires relevant CDD records and analyses to be retained for at least five years after the business relationship ends or an occasional transaction takes place.

Other applicable legal requirements or preservation obligations may require records to be kept longer.

• Can Enhanced Due Diligence Be Automated?

Parts of the process can be automated, including AML screening, matching, alert generation, case routing and record keeping.

Assessing complex evidence, resolving material inconsistencies and making approvals that require human authority remain the responsibility of the institution's compliance and risk functions.

This article provides general information and does not constitute legal or regulatory advice. Institutions should follow the requirements applicable to their activities and regulator.