Due diligence in a high-risk financial sector is not a larger version of a generic background check. It is a documented, risk-based process for deciding whether to enter, price, restrict, monitor or exit a relationship. “High risk” should describe specific exposure—not act as a label for rejecting an entire country, industry or customer class.
Define the decision and risk
State what is being assessed: a customer, acquisition, lender, investor, payment provider, fund, licence applicant or transaction corridor. Then identify the relevant risks—credit, liquidity, market, fraud, sanctions, money laundering, bribery, conduct, cyber, legal, operational and reputational.
FATF describes the risk-based approach as central to effective AML/CFT controls. The intensity of verification and monitoring should follow the assessed risk. It should not be based solely on a sector name or nationality.
Verify identity, ownership and control
For a company, collect incorporation records, directors, shareholders, voting rights, beneficial owners, group structure and regulatory licences. Identify trustees, nominees, protectors, lenders or contractual rights that can change practical control. Confirm important facts through authoritative registers and independent documents.
Trider’s guide to triangulating beneficial-ownership evidence explains why no single database should be treated as conclusive. Record gaps and conflicts rather than filling them with assumptions.
Understand the economic purpose
Document the product, customers, jurisdictions, expected volumes, counterparties, sources of revenue and reason for the structure. Compare the stated model with websites, contracts, invoices, accounts, tax filings, licences and payment flows. A legitimate structure should have a coherent purpose even when it is complex.
Brannon.eu’s overview of offshore banking scrutiny illustrates common documentation questions. Its examples are contextual; current law, regulator guidance and the facts of the relationship must control the assessment.
Test source of funds and source of wealth
Source of funds concerns the origin of money used in the specific relationship or transaction. Source of wealth explains how the person accumulated overall assets. Obtain evidence proportionate to the risk, such as audited accounts, sale agreements, payroll records, tax documents, inheritance records, investment statements or loan contracts.
Trace funds far enough to identify the true origin and intermediaries. A bank statement showing receipt from a company does not prove how that company obtained the money. Trider’s transaction-chain workflow can be adapted to map each payment hop.
Screen, then investigate the result
Sanctions, politically exposed person and adverse-media screening generate matches, not findings. Resolve names, dates of birth, addresses, aliases and ownership before escalating. Examine the credibility, recency and relevance of media reports and seek primary records.
A FATF monitored-jurisdiction listing also requires careful interpretation. FATF’s February 2026 statement says increased monitoring does not itself call for enhanced due diligence against every relationship and rejects indiscriminate de-risking. Country risk should be one factor in a broader assessment.
Assess controls and regulatory history
For regulated businesses, verify licence scope, authorised activities, approved domains, enforcement history, complaints, audit findings, safeguarding, capital, governance and outsourcing. Review policies, but test whether they operate in practice through samples, interviews, alerts and remediation records.
The EBA’s ML/TF risk-factor guidance addresses customer, beneficial-owner and enhanced-due-diligence factors across financial services. Apply the version and legal framework relevant to the institution and date.
Convert findings into controls
Grade each risk by likelihood, impact, evidence quality and mitigation. Possible responses include senior approval, transaction limits, restricted products, independent verification, enhanced monitoring, contractual audit rights, collateral, staged funding or rejection. Assign an owner and review date.
Trider’s investigative due-diligence framework provides a way to separate verified red flags from unresolved questions.
Good due diligence does not promise zero risk. It creates a reproducible record of what was checked, what remains uncertain, why the risk was accepted or declined, and how changes will be detected after onboarding.