Table of Contents
Fraud risk in Customer Due Diligence (CDD) should be assessed alongside identity verification and AML checks, rather than treated as a separate downstream concern. In customer due diligence, fraud risk means assessing fraud-related signals, such as identity inconsistencies, suspicious relationships, device and digital intelligence, unusual onboarding behaviour and relevant external fraud intelligence, alongside traditional AML and customer risk factors to build a more complete risk assessment at onboarding.
For risk and compliance officers, chief compliance officers, AML teams and legal departments at banks, fintechs, crypto platforms, insurance firms and capital markets institutions, this gives a clearer basis for deciding whether standard CDD is sufficient, whether additional verification is required, whether Enhanced Due Diligence (EDD) should be considered, or whether a case needs escalation. That is why unifying fraud and AML risk management matters in practice: verifying a customer’s identity alone does not show that the customer presents low fraud risk, while detecting fraud signals early strengthens both onboarding decisions and ongoing financial crime controls.
The objective is not to treat fraud and AML as identical risks. It is to ensure that relevant intelligence from both contributes to a more complete customer risk assessment, and the discussion here focuses on the fraud indicators that matter in CDD, how fraud and AML risk management fit together, and how automation and ongoing monitoring improve fraud detection over time.
Why Fraud Risk Should Be Part of Customer Due Diligence
Traditional CDD establishes who the customer is and assesses risks associated with the relationship. Fraud risk adds another important question: Does the information and behaviour observed during onboarding indicate a level of risk that requires further attention?
Three factors make this important.
A verified customer is not automatically a low-risk customer
Identity verification confirms that customer information can be validated against relevant sources. It may not, however, reveal every fraud-related risk associated with the customer’s application, digital footprint, relationships or method of onboarding.
A customer may pass an individual verification check while other signals raise questions that require additional review.
Fraud risk can emerge from multiple signals
An isolated indicator may not be sufficient to establish meaningful risk. However, multiple signals considered together can provide a more complete picture.
These may include:
Inconsistent information across relevant sources
Unusual relationships between customer identifiers
Repeated or abnormal onboarding activity
Suspicious device associations
Relevant external fraud intelligence
Connections with other customers or entities requiring investigation
The purpose is therefore not to search for one definitive sign of fraud. It is to assess whether the available signals materially affect the institution’s overall understanding of customer risk.
Early detection improves downstream controls
CDD establishes the initial risk context for a customer relationship. Identifying relevant fraud risk during onboarding can help institutions apply proportionate verification from the outset and provide useful context for fraud monitoring across the customer lifecycle.
The earlier material risk is identified, the earlier it can inform customer treatment and downstream monitoring.
Key Fraud Risk Indicators to Assess During CDD
Fraud risk indicators should reflect an institution’s products, customers, delivery channels, geographies and relevant fraud typologies. There is no universal checklist that should be applied identically to every institution or customer.
The most effective approach is to assess relevant signals in context and consider how they affect the overall customer risk profile.
Identity and Data Inconsistencies
CDD relies on customer information being reliable and internally consistent. Material discrepancies may warrant additional verification or investigation.
Relevant indicators may include:
Inconsistent information across submitted records and reliable verification sources
Repeated changes to key information during onboarding
Unusual associations between identity attributes
Information that cannot be independently corroborated
Material discrepancies requiring clarification
For legal entities, inconsistencies in ownership or control information can also affect the risk assessment. Complex structures are not inherently suspicious, but unexplained discrepancies or information that cannot be reasonably verified may justify additional due diligence.
The key question is not simply whether an inconsistency exists. Institutions should assess whether it is material, explainable and relevant to the overall customer risk assessment.
Device and Digital Intelligence
Digital onboarding creates additional sources of intelligence that may provide context beyond conventional identity checks.
Device and digital intelligence can help identify patterns such as:
Unusual device-account relationships
Multiple applications associated with common technical identifiers
Repeated account creation attempts
Inconsistent digital or location patterns
Technical signals associated with elevated risk
These signals should be assessed contextually. For example, the presence of a particular network configuration or technical attribute should not automatically be treated as evidence of fraud.
Instead, institutions should determine whether a combination of signals creates a meaningful inconsistency with the customer’s expected profile or onboarding behaviour.
Digital identity and authentication information can also support broader financial crime controls when used within an appropriate risk-based framework. FATF Guidance on Digital Identity
Onboarding Behaviour
How a customer moves through the onboarding process can provide additional risk context.
Relevant patterns may include:
Repeated failed verification attempts
Multiple attempts to submit or modify information
Abnormal application velocity
Unusual changes to customer details
Repeated applications associated with linked identifiers
Again, individual signals should not necessarily determine the outcome. The value comes from assessing behaviour alongside identity, customer and fraud intelligence.
This approach can help distinguish between an isolated onboarding issue and a pattern that requires further review.
External and Network Intelligence
External fraud intelligence can add information that is not available through customer-provided data alone.
For example, institutions may use relevant and appropriately governed intelligence relating to known fraud-linked identifiers, suspicious relationships or emerging risk patterns. India’s Financial Fraud Risk Indicator provides an example of how fraud-related intelligence can be translated into actionable risk categories.
Network relationships can provide further context. Shared identifiers or previously identified connections between accounts and entities may reveal patterns that are difficult to identify when each customer is assessed in isolation.
In more complex cases, hidden fraud networks and connected risk can help institutions examine relationships between entities, accounts and other relevant identifiers.
How to Build a Unified Fraud and AML Customer Risk Assessment
Fraud risk should not sit entirely outside the CDD process. Relevant fraud intelligence should contribute to the institution’s understanding of the customer.
A fraud-informed customer risk assessment can consider four broad dimensions:
Identity risk: How reliable, consistent and verifiable is the customer information?
AML and customer risk: What risks arise from different customer types, the customer’s business, geographic location, legal entity structure, beneficial ownership requirements, and whether the customer is a politically exposed person or among other high-risk customers?
Fraud risk: Are there material indicators associated with known or potential fraud?
Digital and behavioural risk: Does the customer’s onboarding activity create additional risk context?
A CDD program should use risk-based CDD policies to ensure compliance with regulatory requirements, including anti-money laundering and know-your-customer standards, and support identifying risks from money laundering and terrorist financing, particularly those linked to high-risk or risk customers. The Financial Crimes Enforcement Network set the framework for such compliance efforts, and its CDD final rule became effective on July 11, 2016. The Corporate Transparency Act requires beneficial ownership reporting by January 1, 2024. In the European Union, the EU’s Fifth Anti-Money Laundering Directive added new AML rules in 2020, while eIDAS governs electronic identification.
Together, these inputs can support an overall customer risk assessment.
However, institutions do not necessarily need to combine every fraud and AML model into one mathematical score. Fraud and AML systems may retain separate specialist models while their relevant outputs feed a unified decisioning framework.
The practical question is:
Given everything known about this customer, what level of due diligence and control is appropriate?
An adaptive AML risk scoring model for fraud and AML can help organisations develop a more dynamic approach to assessing changing financial crime risks.
How Fraud Risk Should Influence CDD and EDD
Fraud risk should influence the depth of due diligence when relevant indicators materially increase the institution’s overall assessment of customer risk.
Depending on the documented risk framework, elevated fraud risk may lead to more documentation than standard Customer Due Diligence, including:
Additional verification
Requests for clarification or supporting information
Enhanced information gathering
Deeper investigation
Senior or specialist review
Escalation under applicable internal procedures
The appropriate response should depend on the combined risk picture, rather than treating every fraud indicator as an automatic trigger for EDD.
Combined Risk Assessment | Potential Response |
|---|---|
Low AML risk + low fraud risk | Standard CDD |
Elevated fraud indicators | Additional verification or targeted review |
Elevated AML risk | Risk-based EDD |
Elevated AML + fraud risk | Enhanced investigation and appropriate escalation |
Material unresolved risk | Follow internal risk and regulatory procedures |
Importantly, fraud risk alone should not automatically trigger full EDD.
A fraud-related signal may justify a targeted verification step without changing the entire customer treatment. Conversely, multiple unresolved fraud indicators combined with elevated AML or customer risk may materially change the overall assessment. For high-risk customers, EDD also involves ongoing monitoring of financial transactions.
This is consistent with a risk-based approach: institutions should understand relevant risks and apply controls proportionately rather than applying identical measures to every customer. FATF Recommendations: This added scrutiny helps address significant risk and helps prevent large-scale financial crimes and money laundering.
Automate Fraud Intelligence From Onboarding to Ongoing Monitoring
Fraud intelligence is most useful when it does not remain isolated within the onboarding process.
A connected workflow can follow five steps.
1. Capture
Collect relevant identity, AML, fraud, digital and external intelligence during onboarding.
2. Assess
Evaluate how the available information affects the overall customer risk profile. Automation and AI-powered due diligence for fraud detection and risk management can help analyse large volumes of information, identify relevant patterns and prioritise review cases.
3. Decide
Use the documented risk framework to determine the appropriate response, including standard CDD, additional verification, EDD or escalation.
4. Share
Relevant intelligence should be available to downstream systems where appropriate. This requires addressing the operational challenges of integrating fraud and AML data silos.
Customer risk context can then support AML transaction monitoring by helping institutions assess whether subsequent activity is consistent with the known customer profile.
5. Reassess
Customer risk should not remain static when material new intelligence emerges. Relevant fraud alerts, suspicious activity, new relationships or other significant information may require the institution to reassess the customer risk profile according to its established methodology.
This creates a feedback loop between onboarding, fraud detection and AML monitoring.
7-Step Framework for Fraud-Informed CDD
Financial institutions can use a simple framework to integrate relevant fraud intelligence into customer due diligence:
Verify → Enrich → Detect → Score → Decide → Monitor → Reassess
Verify — Establish and validate core customer and beneficial ownership information.
Enrich — Add relevant AML, fraud, digital and external intelligence.
Detect — Identify material inconsistencies, suspicious relationships and other relevant risk indicators.
Score — Assess how these signals affect the overall customer risk profile.
Decide — Apply standard CDD, additional verification, EDD or escalation according to the institution’s documented risk framework.
Monitor — Use the initial risk context to support relevant downstream fraud and AML monitoring.
Reassess — Update the customer risk assessment when material new intelligence emerges.
The strength of this framework is that it connects individual controls rather than treating them as separate processes. Onboarding intelligence establishes an initial understanding of risk, while ongoing monitoring provides new information that can refine that assessment over time.
How ZIGRAM Identifies Fraud Risk in Customer Due Diligence
ZIGRAM helps organisations strengthen financial crime risk assessments through data-driven due diligence and risk intelligence.
Relevant capabilities, including due diligence, name screening, adverse information and broader entity risk intelligence, can help institutions develop a more complete understanding of customers and entities. By connecting relevant fraud and AML intelligence within customer risk workflows, organisations can support more informed onboarding, review and monitoring decisions.
The objective is not simply to collect more data. It is to ensure that relevant intelligence is available at the point where customer risk decisions are made.
Conclusion
Fraud prevention is more effective when relevant risk is assessed before a customer relationship is fully established.
Integrating fraud risk indicators into CDD helps institutions move beyond isolated identity and compliance checks toward a more complete customer risk assessment. Relevant fraud intelligence can inform the depth of verification, influence whether additional due diligence is required and provide valuable context for downstream monitoring.
The goal is not to merge fraud and AML into the same risk category. It is to ensure that relevant intelligence from both contributes to better, proportionate financial crime decisions throughout the customer lifecycle.
Frequently Asked Questions
What are fraud risk indicators in CDD?
Fraud risk indicators are data points or patterns that may indicate elevated fraud-related risk during customer onboarding. Examples can include material identity inconsistencies, unusual device or behavioural patterns, relevant external fraud intelligence and suspicious relationships.
Can fraud risk trigger Enhanced Due Diligence?
Fraud risk can contribute to a decision to apply additional due diligence when it materially increases the overall customer risk assessment. However, fraud indicators should be assessed alongside other relevant factors and according to the institution’s documented risk methodology.
Can device intelligence be used in customer due diligence?
Yes. Device and digital intelligence can provide additional context during digital onboarding, including information about unusual device relationships or behavioural patterns. Such signals should be assessed in context rather than treated as automatic evidence of fraud.
How does fraud intelligence improve ongoing monitoring?
Fraud intelligence collected during onboarding can establish an initial customer risk context. When relevant information is shared with downstream systems, it can help fraud and AML monitoring teams assess subsequent activity against a more complete understanding of the customer.
