Customer Due Diligence Policy

Customer Due Diligence Policy

This Customer Due Diligence Policy (the Policy) is entered into by and between Company Name: and Approving Authority: Effective Date:

Recitals

WHEREAS, the Company provides financial products and services that require procedures to verify customer identity, assess risk, and detect suspicious activity in order to comply with applicable anti-money laundering and counter-financing of terrorism obligations; and

WHEREAS, the Approving Authority is responsible for oversight and approval of policies that govern customer onboarding, monitoring, recordkeeping, and escalation procedures; and

WHEREAS, the parties intend to establish a uniform, risk-based framework for Customer Due Diligence that assigns responsibilities, sets minimum controls, and documents retention and escalation practices;

NOW, THEREFORE, in consideration of the mutual covenants set forth herein, the parties adopt the following Policy.

1. Purpose

The purpose of this Policy is to require the implementation of risk-based customer due diligence procedures to: (a) verify the identity of customers and beneficial owners; (b) assess money laundering and terrorism financing risk; (c) provide for enhanced due diligence where risk indicators are present; (d) establish ongoing monitoring and suspicious activity reporting; and (e) maintain records sufficient to demonstrate compliance with applicable legal and regulatory obligations.

2. Scope

This Policy applies to all business units, branches, subsidiaries, and affiliates of the Company that open accounts, originate transactions, or provide ongoing services to customers, including retail, commercial, institutional, and intermediary relationships. Business units subject to this Policy include:

Applicable Business Units: Retail Banking Commercial Banking Wealth Management Brokerage / Capital Markets

3. Definitions

For purposes of this Policy, the following definitions apply in addition to any statutory definitions:

"Customer Due Diligence" means the set of procedures used to collect and verify identifying information about a customer and any beneficial owners, to assess the customer's risk profile, and to monitor transactions on an ongoing basis.

"Beneficial Owner" means any natural person who, directly or indirectly, owns or controls a customer, including any person who exercises ultimate effective control over a legal entity client, according to the procedures in Section 4.3.

"Politically Exposed Person (PEP)" means an individual who is or has been entrusted with a prominent public function, and their immediate family members and close associates, requiring enhanced scrutiny under this Policy.

4. Customer Identification and Verification

4.1 Customer Identification Program. The Company shall implement a Customer Identification Program (CIP) requiring that, at account opening or initial engagement, the Company obtain and verify the customer's name, date of birth (for individuals), legal form (for entities), address, and an identifier such as a taxpayer identification number or government-issued identifier. Verification shall be conducted using documentary and non-documentary methods consistent with the customer's risk rating.

4.2 Acceptable Identity Evidence. Documentary evidence shall include government-issued photo identification, certified corporate formation documents, and certified copies of beneficial owner identification where required. Where documentary verification is not feasible, non-documentary verification shall include independent third-party sources, reliable public records, and corroborating information from customer-supplied data.

4.3 Beneficial Ownership Identification. For all legal entity customers, the Company shall identify and verify the natural persons who are beneficial owners pursuant to the Company’s risk-based thresholds. Where ownership or control is not transparent, the Company shall apply enhanced due diligence, obtain additional documentation, and escalate to the Compliance Officer.

5. Risk Assessment and Customer Risk Rating

5.1 Risk-Based Approach. The Company shall apply a risk-based approach to categorize customers as Low, Medium, or High risk based on factors including product and service type, delivery channel, customer type, geographic risk, expected transaction activity, and adverse information.

5.2 Risk Criteria. The Compliance function shall maintain objective criteria and scoring for each risk factor. Examples of criteria and illustrative risk indicators are maintained in the Risk Criteria Appendix and include high-value cash transactions, offshore counterparties, and customers subject to negative media.

6. Enhanced Due Diligence (EDD)

6.1 Triggers for EDD. Enhanced Due Diligence shall be performed for customers assessed as High risk, PEPs, non-resident customers in high-risk jurisdictions, correspondent banking relationships with payable-through accounts, and any relationship where the source of wealth or funds cannot be reasonably determined.

6.2 EDD Procedures. EDD requires corroboration of identity, independent source verification of beneficial ownership, documented senior management approval prior to account opening, more frequent reviews, and, where appropriate, independent approval for transactions above designated thresholds.

7. Ongoing Monitoring and Transaction Surveillance

7.1 Ongoing Monitoring. Customer relationships shall be subject to ongoing monitoring proportional to the customer's risk rating. Monitoring includes review of transactions against expected activity, periodic updating of customer information, and timely investigation of anomalies.

8. Recordkeeping

The Company shall retain copies of customer identification, verification records, beneficial ownership information, transaction records, and risk assessments for a minimum period specified by applicable law and in any event for not less than the retention period set forth below.

9. Training and Personnel

The Company shall provide mandatory AML/CFT and customer due diligence training to all employees within customer-facing and compliance functions at least as frequently as set forth below. Training shall be documented and refreshed upon material changes to this Policy or related procedures.

10. Third-Party Reliance and Outsourcing

Where the Company relies on third parties to perform due diligence, the Company shall ensure that contractual arrangements require the third party to apply equivalent standards of identification, verification, and recordkeeping. The Company remains ultimately responsible for compliance and must retain sufficient evidence of the third party’s performance.

11. Reporting and Escalation

Employees shall promptly report suspicious activity to the designated Compliance Officer. The Company will maintain clear escalation paths for high-risk or suspicious matters and will determine whether and when to file internal or external reports as required by law and this Policy.

12. Internal Controls, Audit and Review

The Company shall maintain internal controls, periodic independent testing, and audit procedures to assess compliance with this Policy. The Compliance function shall produce periodic reports to senior management and the Approving Authority documenting program effectiveness and remedial actions.

13. Data Protection and Confidentiality

Customer information gathered under this Policy shall be handled in accordance with the Company’s data protection requirements. Access to CDD documentation shall be limited to personnel with a legitimate business need, and disclosures shall be governed by applicable confidentiality and legal disclosure obligations.

14. Breach Response

Any breach of this Policy or failure to follow prescribed CDD procedures must be reported immediately to the Compliance Officer and appropriate corrective measures shall be taken, including retraining, disciplinary action, and remediation of deficient controls.

15. Governing Law

This Policy shall be governed by and construed in accordance with the laws of:

16. Notices

All notices required or permitted under this Policy shall be in writing and shall be delivered to the addresses set forth below or to such other address as a party designates by written notice.

17. Amendments; Waiver; Severability; Entire Agreement; Counterparts

17.1 Amendments. This Policy may be amended only by a written instrument signed by both the Company and the Approving Authority.

17.2 Waiver. No failure or delay by either party in exercising any right under this Policy shall operate as a waiver of that right, and any waiver must be in writing and signed by the waiving party.

17.3 Severability. If any provision of this Policy is held to be invalid or unenforceable in any jurisdiction, the remainder of this Policy shall remain in full force and effect and the invalid provision shall be reformed only to the extent necessary to make it enforceable.

17.4 Entire Agreement. This Policy constitutes the entire agreement of the parties with respect to its subject matter and supersedes all prior agreements and understandings, whether written or oral, relating to the subject matter hereof.

17.5 Counterparts. This Policy may be executed in counterparts, each of which shall be deemed an original, and all of which together shall constitute one and the same instrument.

Acknowledgment

The undersigned represent and warrant that they are duly authorized to execute and deliver this Policy on behalf of their respective parties and that by signing below the parties agree to be bound by the terms and procedures set forth herein.

Sign Now