Customer Due Diligence (CDD) Policy¶


Code	`AML-002`
Domain	AML / Financial Crime
Owner	Chief Compliance Officer
Status	Draft
Applicability	Platform
Jurisdiction	NZ + AU
Business domain	BD07
Review date	2027-03-25

Regulations: AML/CFT Act 2009 · AML/CTF Act 2006 ¶

Purpose¶

Define the customer due diligence tiers applied by the platform — Standard CDD, Simplified CDD, and Enhanced Due Diligence (EDD) — and the criteria that trigger movement between tiers. Ensures every customer relationship carries a documented, evidence-backed level of identity verification and ongoing monitoring proportionate to assessed risk.

Scope¶

All customers onboarded or maintained on the platform, across all products and jurisdictions (NZ and AU). Applies at initial onboarding and at each triggered review event.

Policy statements¶

Every customer relationship SHALL be assigned a CDD tier at onboarding. The assigned tier SHALL be recorded and linked to the customer risk profile.

Standard CDD applies to customers who do not meet criteria for simplified or enhanced treatment. Standard CDD SHALL require: verified government-issued identity document, verified residential address, confirmed beneficial ownership where applicable, and a completed risk-scoring assessment.

Simplified CDD MAY be applied where the customer type and product combination meets defined low-risk criteria approved by the Chief Compliance Officer. Simplified CDD SHALL NOT be applied where any adverse screening signal, PEP match, or elevated risk indicator is present. Simplified CDD SHALL be documented with the rationale recorded.

Enhanced Due Diligence (EDD) SHALL be applied where one or more of the following triggers is present: - Customer is identified as a Politically Exposed Person (PEP) or close associate - Customer risk score exceeds the EDD threshold defined in the risk rating framework - Transaction pattern or onboarding behaviour matches a typology flag - Adverse media or sanctions screening result is returned - Correspondent banking relationship is involved - Any manual override by a compliance officer

EDD SHALL require: source of funds documentation, source of wealth documentation where proportionate, senior management sign-off for PEPs, and an enhanced monitoring flag activated in the monitoring system.

The platform SHALL NOT allow a customer to be activated for transactional products until the required CDD tier has been completed and all mandatory checks have passed.

CDD records SHALL be refreshed on a risk-based schedule. High-risk customers SHALL be reviewed at least annually. Standard-risk customers SHALL be reviewed at least every three years or upon a material change to the relationship.

Where CDD cannot be completed, the platform SHALL reject the application or restrict the account. Silent acceptance of incomplete CDD is prohibited.

All CDD outcomes, tier assignments, evidence references, and review events SHALL be logged in the immutable system decision log.

Satisfying modules¶

Module	Name	Mode	Description
MOD-007	Account state machine	`GATE`	Account cannot be activated until KYC status is Verified — GATE enforced at state machine level
MOD-009	eIDV & document verification	`AUTO`	CDD tier determined automatically from eIDV confidence score — not agent discretion
MOD-010	CDD tier assignment engine	`AUTO`	CDD tier set by rule engine — not agent discretion. EDD triggered automatically for PEPs and high-risk jurisdictions
MOD-011	KYC periodic review scheduler	`AUTO`	Periodic CDD review completed within required timeframe — no manual calendar management
MOD-012	KYC audit trail store	`LOG`	CDD decisions are auditable — regulator can reconstruct any customer's onboarding decision
MOD-039	Customer risk score model	`AUTO`	CDD tier informed by live customer risk score — not a static assessment at onboarding
MOD-096	Multi-entity party graph manager	`GATE`	Each entity in the party graph must have its own CDD profile; MOD-096 cannot link a new entity to a party graph without triggering the appropriate KYC/CDD check for that entity type.
MOD-125	Joint account management	`GATE`	All joint account holders must individually pass eIDV and CDD tier assignment before the account activates — partial KYC completion does not allow the account to open.
MOD-126	Power of attorney and third-party authority	`GATE`	Any new third-party authority — whether PoA, EPoA, or informal authority — requires a KYC check on the appointed person before they can transact on the account.
MOD-133	Trust account management	`GATE`	All trustees and beneficial owners with ≥ 25% interest must individually pass eIDV and CDD before the trust account activates — the account cannot open with partial KYC completion.
MOD-134	Community account management	`GATE`	All authorised signatories must pass eIDV before the account activates; the account does not open with partial signatory KYC.
MOD-138	Deceased customer and estate management	`LOG`	The LPR must pass KYC before being granted account access; the LPR's identity and authority are recorded and available for AML audit.
MOD-153	Customer acceptance engine	`GATE`	Acceptance enforces the CDD tier required for each product type — a customer who has not completed the required CDD level cannot be accepted regardless of KYC pass status.

Part of AML / Financial Crime · Governance overview Compiled 2026-05-22 from source/entities/policies/AML-002.yaml