Prepare for CKYCA by mapping every syllabus topic to a decision point in the customer lifecycle: identify and verify the customer and its beneficial owners at onboarding, assess risk and apply CDD or EDD proportionately, keep the profile current through periodic and event-driven reviews, and escalate unresolved red flags with complete documentation. Drill the distinctions between paired concepts - CDD/EDD, source of funds/source of wealth, control person/beneficial owner, periodic/event-driven review - using worked scenarios rather than flashcard definitions.
Why KYC, CDD, and EDD Blur Together - and How to Separate Them
KYC is the umbrella process of knowing the customer; CDD is the baseline diligence applied to every customer; EDD is the deeper diligence applied when risk factors demand it. All three operate under a risk-based approach.
Practice holding the three terms as nested layers rather than synonyms. Identification and verification establish who the customer is; CDD builds the profile that monitoring depends on - expected activity, purpose of the relationship, beneficial ownership, and where relevant source of funds and source of wealth. EDD adds depth - enhanced information, closer scrutiny, stronger approval - only when risk factors justify it, not as a routine upgrade. Distinguish source of funds from source of wealth deliberately: funds asks where the money for a specific transaction came from, such as a salary or a property sale; wealth asks how the customer's overall fortune was accumulated. A file can state wealth correctly and still leave a particular deposit unexplained.
Anchor every topic to the chain: frontline KYC decisions feed the risk rating, the rating drives monitoring expectations, monitoring output drives investigations, and investigations depend on what the file captured at onboarding. When a scenario describes an incomplete file, a missing beneficial owner, or a weak escalation, trace the consequence downstream - screening the wrong parties, monitoring against a fictional activity profile, or an investigator working from stale information. Practicing this trace makes the boundaries between the concepts concrete rather than memorized.
- KYC: the overall framework for knowing and verifying the customer
- CDD: baseline identification, verification, and profiling for all customers
- EDD: enhanced measures triggered by elevated risk, with stronger documentation and approval
- Risk-based approach: diligence proportional to assessed risk, not uniform for everyone
Choosing Between Documentary and Non-Documentary Verification
Documentary verification relies on official documents such as passports or registry extracts; non-documentary verification uses independent data sources. Each method has limits, so a file should show why the chosen method was adequate for the gap.
Learn the limitations as well as the definitions. Documents can be forged, altered, or genuinely issued but stale; data-source checks can fail on thin-file customers, name variations, or outdated registries. A strong onboarding decision records which method was used, what it actually confirmed, and what remains unverified. Treat profile capture as part of verification rather than paperwork after it: expected activity, products, channel, geography, and purpose of the relationship are the baseline that later monitoring compares against, so a carelessly captured profile undermines every downstream control.
Adverse media checks, PEP determination, and sanctions screening are onboarding touchpoints whose outcomes belong in the file, and an exception such as a missing document needs a recorded decision: obtain it, restrict the account, or decline. Notice how the touchpoints interact - a sanctions or adverse-media hit is not just a checkbox; it changes the risk assessment and may trigger EDD or escalation. Drill onboarding scenarios with three questions: what was verified and how, what the profile says the customer will do, and whether every touchpoint result was resolved or left open.
Legal Entity Onboarding: Control Persons Are Not Automatically Beneficial Owners
Legal entity onboarding requires identifying the entity itself, the persons controlling it, and its beneficial owners. A director or signatory often is not a beneficial owner, and conflating the roles leaves the file incomplete.
Work through the distinction: a control person, such as a senior managing official or authorized signatory, is the individual who acts for the entity; a beneficial owner is the natural person who ultimately owns or controls it under your institution's ownership threshold and control criteria. Layered ownership, nominees, and trusts complicate the analysis, so the file should show the ownership structure traced to natural persons, not just the first corporate layer, with every individual identified, verified, and screened.
Scenario one: a small trading company onboards with articles of incorporation and the passport of its sole director, who is also the signatory, and the analyst marks the file complete. The plausible mistake is treating the signatory as the end of the ownership analysis; if an individual behind a holding company holds the ownership interest the policy threshold captures, the true beneficial owner was never identified, screened, or risk-rated. The better decision is to trace the chain to natural persons, verify and screen each beneficial owner, and document the structure. This matters because monitoring and screening keyed to the wrong individuals give a false picture of who benefits from the account, and any later investigation starts from a defective record.
- Verify the entity's legal existence and structure first
- Trace ownership through intermediate entities to natural persons
- Identify the control person separately from beneficial owners
- Screen and risk-rate every individual identified, not only the signatory
Risk Scoring, Overrides, and Where EDD Actually Begins
Customer risk ratings combine factors such as geography, products, channels, occupation, and entity type. Overrides move a customer off the score, so each override needs documented rationale and awareness of the EDD triggers it may bypass.
Treat scoring as an input, not a verdict. A score aggregates risk factors - high-risk jurisdictions, products with weaker transparency, non-face-to-face channels, cash-intensive occupations, complex entity structures - but it cannot weigh context the model never saw. That is why a risk override exists: an analyst may justify moving a customer up or down, and the quality of that decision lives entirely in the documented rationale. An override with no reasoning is a governance finding waiting to happen.
Connect ratings to risk appetite and to the financial-inclusion tension. Risk appetite defines what the institution will accept and under which mitigating controls; a high-risk customer is not automatically declined, but onboarding or retention requires EDD proportionate to the risk and an explicit acceptance decision. Blanket refusal of all elevated-risk customers is derisking, which can push activity into less transparent channels, so favor proportionate mitigation over reflexively rubber-stamping or exiting. Build a personal EDD trigger list - PEP status, adverse media, high-risk geography, unexplained wealth concerns, complex ownership - and check it against the scoring logic to see when a case calls for a rating action versus an escalation.
Periodic Versus Event-Driven Review: A Stale File Is an Active Risk
Periodic reviews follow scheduled refresh cycles scaled to risk rating; event-driven reviews respond to triggers such as profile changes or unusual activity. Both exist to keep the customer profile consistent with observed reality.
Keep the two review types distinct. A periodic review is calendar-driven and risk-tiered: higher-risk customers are refreshed sooner than lower-risk ones under most institutional frameworks. An event-driven review is trigger-driven - a change in beneficial ownership, a new product, adverse media, or a significant deviation between stated and observed activity. A useful drill: for any customer scenario, ask what has changed since onboarding, because a trigger can require an event-driven review even while the scheduled refresh is months away. Stale information degrades file quality in both types, so audit-ready records show what was collected, what was requested, what the customer failed to provide, and what decision followed.
Scenario two: a customer profiled at onboarding as a retiree with modest savings shows rapid, repeated third-party transfers far beyond expected activity. The analyst completes the scheduled document refresh, collects a new utility bill, and closes the review. The plausible mistake is treating the review as a document-collection exercise; the inconsistency between the stated profile and observed activity is itself the finding. The better decision is to treat it as an event-driven trigger: update expected activity only if the customer credibly explains it, escalate unexplained deviation, re-assess the risk rating, and document the rationale. This matters because monitoring rules compare transactions to the profile - quietly updating the profile to match activity without scrutiny neutralizes the control that should have caught the behavior.
| Review type | What starts it | Cadence driver | Typical actions | Documentation focus |
|---|---|---|---|---|
| Periodic review | Scheduled refresh cycle | Risk-rating tier | Refresh identity, ownership, and expected activity | Collection record and refresh outcome |
| Event-driven review | A specific trigger | The trigger itself | Re-assess risk, escalate unexplained change | Trigger, analysis, decision, and approver |
| Both | Profile must match observed reality | Risk-based framework | Update the rating only with credible support | Audit-ready trail of requests and decisions |
Escalation and Documentation: What Goes in the File, What Stays Quiet
Unresolved red flags move to compliance, monitoring, sanctions, fraud, or investigations through defined referral channels. Every decision, exception, and exit needs documentation, and tipping-off concerns restrict what may be shared with the customer.
Map referrals to the right recipient. A customer whose stated business does not match activity belongs with monitoring or investigations; a screening hit belongs with sanctions; suspected fraud follows the fraud team; broad relationship concerns follow compliance. A high-risk escalation should carry the evidence, the analysis, and a clear ask, not a vague note that something seems unusual. When you practice scenarios, name the correct function and the referral record for each concern - this builds the cross-functional handoff thinking the syllabus emphasizes.
Separate two documentation duties. The first is decision documentation: why a customer was accepted or retained despite risk, why an exception was granted, why the relationship was exited, and who approved each step. The second is confidentiality: escalation and reporting are internal, so discussing a referral with the customer in a way that could prompt them to alter behavior raises tipping-off concerns; routine profile questions are legitimate, questions that reveal an internal suspicion are not. Governance - metrics, quality assurance, training, issue management - closes the loop by sampling frontline judgments and feeding recurring gaps back into procedures. When reviewing practice files, treat a decision with no recorded approver, or an exception with no rationale or expiry, as incomplete: ask who decided, on what evidence, and what a reviewer would need to reconstruct it later.
A Worked Preparation Sequence with a Self-Check Rubric
Study the five syllabus areas as lifecycle stages, drill paired concepts with scenarios, and finish with a decision-map exercise. Use the rubric below as a learning milestone, not a pass prediction.
Exercise - build a one-page decision map: five columns labeled identify and verify, profile, assess risk, review, escalate. For each column, write the named concepts that belong there: beneficial owner and control person in column one; source of funds versus source of wealth in column two; risk factors, scoring, override, and risk appetite in column three; periodic versus event-driven review in column four; red flags, referral routes, tipping off, and customer exit in column five. Expected observations: you should hesitate only at boundaries - where profiling ends and assessment begins, where a refresh becomes an escalation. Hesitation marks the concept pairs to drill next.
Adaptable sequence: block one on definitions and the decision map for KYC, CDD, and EDD; block two on verification methods and legal-entity onboarding, writing out the ownership-tracing steps; block three on risk factors and EDD triggers, drafting your personal trigger list; block four on review types and the profile-inconsistency scenario; block five on escalation routing and documentation standards. Close each block by writing one fresh scenario from memory, including a plausible wrong answer and why it fails.
Self-check rubric - one point each, out of eight: you can state how CDD and EDD differ without using the word 'more'; you can explain source of funds versus source of wealth with a different example for each; you can trace a two-layer ownership chain to natural persons; you can list four risk-factor categories; you can name three event-driven review triggers; you can route a monitoring concern versus a sanctions hit to the correct teams; you can describe a tipping-off boundary in one sentence; your decision map has no concept filed under two columns without explanation. Seven or more suggests you are conceptually ready to move to full practice questions. Before exam day, rewrite each syllabus area's key concepts from memory, and check that every scenario you write includes a documented rationale, not just an action. For administrative details such as scheduling, consult the issuer's certification pages directly.
References and further reading
Use these references to explore the concepts and check the latest information from the relevant organizations.