Risk-Based CDD: From Onboarding to Monitoring

Effective Customer Due Diligence (CDD) remains at the core of any AML/CFT framework, yet it continues to be one of the most common areas of weakness identified during regulatory examinations in Malta. While many subject persons have established CDD procedures, challenges often arise in the consistent application of a risk based approach, particularly in areas such as beneficial ownership identification, Source of Funds and Source of Wealth assessments, and the application of Enhanced Due Diligence (EDD).

This course is designed to establish how CDD and EDD should be applied in real operational settings — from initial onboarding through to ongoing monitoring. Participants will explore how customer risk is assessed, how documentation should be evaluated, and how CDD measures should evolve over the lifecycle of a business relationship.

The course also addresses common implementation challenges, including insufficient documentation of rationale, and gaps in ongoing monitoring processes. Through practical examples and case-based discussions, participants will gain a clearer understanding of how to apply proportionate and defensible CDD measures in line with regulatory expectations.

Course Agenda

Day 1 – CDD Foundations & Risk-Based Approach
- Overview of AML/CFT obligations in Malta
- Role of CDD within the AML framework
- Applying the risk-based approach in practice
- Customer risk assessment factors
- Common weaknesses in risk assessment

Day 2 – Beneficial Ownership and Customer Understanding
- Identifying beneficial owners
- Complex ownership structures
- Control considerations
- Practical case scenarios

Day 3 – Source of Funds vs Source of Wealth
- Key distinctions and regulatory expectations
- Evidence requirements and documentation standards
- Plausibility assessments
- High-risk scenarios (PEPs, HNWIs)
- Common errors and red flags

Day 4 – Enhanced Due Diligence in practice
- When EDD is required
- Applying proportionality
- EDD for high-risk customers and jurisdictions
- Ongoing monitoring for high-risk relationships
- Escalation and internal decision-making

Day 5 – Ongoing Monitoring and Control Effectiveness
- Trigger events and periodic reviews
- Updating customer risk profiles
- Linking CDD to transaction monitoring
- Identifying inconsistencies and red flags
- Common inspection findings in Malta