"KYC" and "CDD" are two of the most-used acronyms in compliance, and they are often treated as synonyms. They are closely related, but they are not the same thing. Getting the distinction right helps you understand what your obligations actually are — and the difference is more than pedantry, because CDD is what the UK regulations actually require.
The short version
| KYC | CDD | |
|---|---|---|
| What it is | A broad concept: knowing your customer | A specific regulated obligation |
| Where it comes from | Industry practice, general usage | The Money Laundering Regulations 2017 |
| Scope | Often used loosely for onboarding/identity | Identify, verify, beneficial owners, purpose, monitor |
| Tiers | Not formally tiered | Simplified, standard, enhanced |
Think of KYC as the goal (know who you are dealing with) and CDD as the defined process the law requires to achieve it.
What CDD requires
Under regulations 27–37 of the MLRs, CDD has a defined shape:
- Identify the customerEstablish who the customer is.
- Verify identityConfirm it from a reliable, independent source.
- Identify beneficial ownersFor entities, find and verify who ultimately owns or controls them.
- Understand purposeEstablish the intended purpose and nature of the relationship.
- Monitor ongoingKeep the relationship under review and information up to date.
The three tiers
CDD is not one-size-fits-all. The risk-based approach sets three levels.
Three tiers of CDD, matched to risk. Pair each with its trigger.
When does CDD kick in?
CDD is triggered at the moments set out in the MLRs: a new business relationship, occasional transactions over the thresholds, certain transfers, on suspicion, and when you doubt earlier information. (The triggers are covered in detail in the MLR 2017 guide.)
What about KYB?
"KYB" — Know Your Business — is KYC applied to corporate customers. Because a company can hide its true owners, KYB places special weight on beneficial ownership: identifying and verifying the real humans behind the entity, not just the company on paper. It is the same instinct as KYC, with ownership analysis added.
The international anchor
The global standard is FATF Recommendation 10, which sets out the CDD obligation that national regimes — including the UK's MLRs — implement. So when you do CDD, you are applying a globally consistent standard.
Where Probitas fits
Probitas supports the screening and beneficial-ownership parts of CDD/KYB: it checks names and companies against sanctions, PEP and adverse media sources and surfaces ownership signals from the public record, with every finding linked to its source. It does the evidence-gathering; the tiering and risk decisions remain yours.
Four questions to lock it in.
KYC
Are KYC and CDD the same thing?
Not quite. KYC (Know Your Customer) is the broad concept of knowing who you deal with. CDD (Customer Due Diligence) is the specific obligation defined in the Money Laundering Regulations 2017. KYC is the goal; CDD is the regulated process.
What are the three levels of CDD?
Simplified due diligence (for lower-risk situations), standard CDD (the default), and enhanced due diligence (for higher-risk situations such as PEPs, high-risk countries, or unusual structures).
Does customer due diligence end after onboarding?
No. Ongoing monitoring is part of CDD — you keep the relationship under review and keep customer information up to date throughout, applying more or less scrutiny as risk dictates.
What is KYB?
Know Your Business — KYC applied to corporate customers. It adds a focus on beneficial ownership: identifying and verifying the real individuals who ultimately own or control the company, not just the entity on paper.
Which standard does UK CDD follow internationally?
FATF Recommendation 10 sets the global CDD standard, which the UK's Money Laundering Regulations 2017 implement. So UK CDD reflects an internationally consistent approach.
Sources
This guide is written from primary sources. Each is linked below; claims in the text link to the specific reference they rely on.