Before our recent webinar even began, the presenters were reminiscing about decade-old AML email threads. They’ve been working in this industry for a long time. That perspective matters. Enhanced Due Diligence (EDD) today is not what it was even a few years ago. Regulatory expectations are clearer, the risk landscape is broader and crucially, technology is now mature enough to deliver depth at speed. This post distills the discussion: what EDD really requires, why it’s challenging, how AI and automation are changing the game, and how compliance teams can modernize without ripping up their existing processes.
EDD starts where KYC stops
Most institutions have mastered the basics: sanctions screening and PEP checks. These are table stakes. The real fork in the road comes after that first pass. Some customers, by jurisdiction, product, behavior, or profile, are flagged as higher risk. Regulators have been clear: this shouldn’t trigger de-risking by default. It should trigger EDD. EDD means a deeper, risk-based examination of source of funds and source of wealth, ownership and control, and the network of associates and related entities. This is where the hard work begins. Analysts must answer sharper questions:- Where did the wealth originate, and does the timeline make sense?
- Do shell companies or nominee structures obscure ownership?
- Who are the ultimate beneficial owners (UBOs), and who are the people around them?
- What does litigation, regulatory action, or adverse media reveal about reputation over time?
What’s changed: AI, automation, and explainability
The shift isn’t that AI replaces analysts. It’s that AI and automation now take on 70–90% of the assembly work that used to consume analysts’ time.- Data collection at scale: Modern platforms ingest and normalize data from registries, courts, regulators, and multilingual media across 100+ countries.
- Network mapping: Automated discovery surfaces directors, shareholders, familial ties, business associates, and layered structures. Analysts start with a map instead of a blank page.
- Source-of-wealth narratives: Systems synthesize holdings, roles, assets, and disclosures into structured wealth stories, ready for analyst review.
- Continuous refresh: Reports are no longer static snapshots; they can be regenerated with the latest data.
- Grounded citations: Every assertion, an asset, a case, a relationship, must link back to a primary or trustworthy source.
- Human review: Analysts still make the final calls, applying context and judgment to what automation surfaces.
Governance in the AI era
As adoption grows, governance questions are catching up. Vendor due-diligence questionnaires increasingly ask:- How do you ensure explainability and prevent hallucinations?
- What guardrails, source lists, and redlining processes are in place?
- How do you log prompts, outputs, and reviewer actions for audit?
Case study: Global retailer with 25,000 suppliers
Consider a retailer sourcing across Southeast Asia, China, and Latin America. With 25,000+ suppliers, every partnership carried reputational and sanctions risk. During one review, Alessa’s EDD partner, RZOLUT, surfaced a familial link: the counterparty was a nephew of a cabinet minister in a high-risk jurisdiction. The impact wasn’t just the discovery, it was the explainability. Public records, relationships, and media references were all cited in context. The board could see why the risk mattered, not just what it was. Operationally, the process didn’t require armies of consultants. It relied on automation, scoped EDD tiers, litigation and regulatory checks, association mapping, and source-of-wealth analysis—delivered at speed.Beyond banks: why every sector must care
EDD is no longer confined to banks. In many jurisdictions, utilities, telecoms, real estate, and other sectors now face AML and sanctions obligations. These firms often hit two gaps:- Skills: They lack the AML staffing banks have built over decades.
- Budgets: Few had line items for EDD tooling or outsourced research.
What “good” looks like in 2025
Not every EDD need requires the same depth. Many teams adopt a tiered model:- Self-serve pulls (minutes): Quick source-of-wealth snapshots with citations.
- Standard EDD (24–48 hours): Screening + litigation/regulatory checks + network mapping + structured wealth narrative.
- Extended scope (4–5 days): Complex ownership, deep litigation, associate networks, and richer profiling—work that once took weeks.
Integrating EDD without disruption
Successful programs don’t chase a “big bang” transformation. They plug in capabilities step by step:- Triggers: Embed “Order EDD” actions directly into sanctions/PEP workflows.
- Templates: Standardize report structures for consistency.
- Citations: Keep all sources live and auditable.
- Review loop: Define what humans verify and how they record judgments.
- Refresh: Re-run reports when cases stay active.
Getting started or scaling up
- Define use cases (onboarding, periodic reviews, vendor onboarding, M&A, etc.).
- Right-size tiers. Reserve deep dives for the riskiest cases.
- Codify what counts as “enough” evidence for each scenario.
- Measure outcomes: turnaround time, rework, audit findings, and meaningful escalations.
