Initial Client Due Diligence

Initial client due diligence (CDD) is where you assess a client's money laundering and terrorism financing (ML/TF) risk, verify the client and their related parties, and decide whether to proceed with the relationship. Firm Verify guides you through this in a five-step wizard and generates an Initial CDD record when you finish.

1. Start an initial CDD

From the main toolbar, select Clients . You can then start an initial CDD in any of these ways:

• From the client list: search for the client, select the three dots in the Actions column, then select Start Initial CDD.
• From Start: select Start at the upper left of the Clients screen. On Starting initial CDD check for a client, select Start, then search for the client.
• From the client details screen: search for the client, open their client details screen, select Start Workflow, then choose Start Initial CDD.

This opens the Initiate CDD wizard, which has five steps:

1. Summary & Initiation
2. Risk Assessment
3. Identity Verification
4. Related Parties
5. Determination

Select the image to enlarge it.

Use Next and Previous to move between steps. Select Cancel to leave the wizard.

To save your progress and come back to an in-progress CDD later, select Save for later.

2. Step 1: Summary & initiation

This step shows the client's details as entered on the client entity details screen or during onboarding. Review the details, then complete the services profile. This step shows:

• Client details – to make changes, select Open Client Info to go back to the client details screen.
• Related parties (if any)
• Documents
• Services profile (required) – select the designated services you'll provide and the delivery channels you'll use. These come from the services and delivery channels identified in your firm's current risk assessment. If your firm's risk assessment wasn't generated in Firm Verify (for example, you uploaded it), a default list of services and delivery channels shows instead. To work out which services apply, see Designated services and who is the customer.
• Initial CDD commenced date – defaults to today's date.

3. Step 2: Risk assessment

Assess the client's inherent risk across four areas. Firm Verify prefills the risk assessment based on the information you've entered, but you can change any rating and add notes or mitigation for each factor. You must set an inherent risk for every risk factor.

For clients imported from the Interim Verification tool, the answers from the import are already filled in. You can change them here.

The risk factors come from the risk factors in your firm's current risk assessment in Firm > Program. If your firm's risk assessment was uploaded, a set list of questions shows instead.

Risk dimension summary

Below the risk factor tables, each of the four dimensions (client, service, delivery channel and country) is summarised into a single rating. Confirm each dimension rating.

Derived rating and CDD level

Firm Verify calculates the derived risk rating automatically from the four dimension ratings in the risk dimension summary. It takes the highest of the four ratings, in this order: High, then Medium, then Low. The derived risk rating then sets the required CDD level.

4. Step 3: Identity verification

Confirm the client's identity and record how it was verified. You must complete this step before you can continue.

Complete these fields:

Add supporting documents (optional)

Supporting documents are optional. You don't need to attach a copy of the client's ID to complete this step. To add one, select Add document, then choose Select from Client documents or Upload new file from device.

Document Name and Document Type are prefilled from the document you added. A file you upload is also saved to the client's documents.

Select from Client documents only lists documents whose Document Type is accepted for the client type:

If a document you've already uploaded isn't listed, it was saved with a different Document Type. Select Upload new file from device and choose an accepted type instead.

5. Step 4: Related parties

Verify each beneficial owner, key position holder and representative linked to the client. Related parties already linked to the client appear here automatically. You can't remove them from this step.

Add a related party

To add another related party, select Add Related Party.

Then enter the party's details:

• Name – the related party's full name, or entity name.
• Relationship to Client – how the party is related to the client, for example trustee, beneficiary or representative. Select all that apply.
• Ownership % – the party's ownership share in the client.
• Authority confirmed? (required for representatives) – appears when you select Representative. Select whether the representative's authority to act for the client is confirmed. If you select No, the Details of Authority to Act field appears and you must complete it.

When you add a new related party, a message reminds you that the ML/TF risk assessment may be affected. Go back to Step 2 and review it.

Verify each related party

For each related party, complete:

• Identity verification (required) – record how the party's identity was verified, using the same fields as Step 3. Verification Method and Verified Outcome are required, and Verified Outcome can't be left as Pending.
• Supporting documents (optional) – select Add document, then choose Select from Client documents or Upload new file from device. Select from Client documents lists the related party's own documents, with the same document type rules as Step 3.
• Screening (required) – screening is manual. Record a result for each of PEP match, Sanctions match and Adverse media: No match, Potential match or Confirmed match. All three are required for every related party.

6. Step 5: Determination

This is where you decide whether to proceed with the client. Review the outputs of the previous steps, confirm the risk rating and CDD level, then record your determination.

Confirm the risk rating and CDD level

Field	What to do
Risk rating applied	Prefilled with the suggested risk rating from Step 2. You can select a different rating if your assessment differs. If the risk rating applied is different from the suggested rating, you must enter a reason in Rating override reason.
CDD level applied	Prefilled with the suggested CDD level for the final risk rating: High = Enhanced, Medium = Standard, Low = Simplified. You can select a different level if your assessment differs. If the CDD level applied is different from the suggested level, you must enter a reason in CDD level reason.

Record your determination

Then complete:

• Outcome rationale (required) – explain the reason for your determination, in at least 10 characters.
• Determined by and determination date – record who made the determination and when.

7. Generate the Initial CDD record

Once you've completed all five steps, select Generate to finalise the CDD. The client's CDD status changes to Active, and the steps become read-only. There's no separate reviewer or approval step.

Firm Verify creates the Initial CDD record, a point-in-time compliance document of the client's CDD, for review sign-off and your AML/CTF audit trail.

The record includes:

• Client information – the fields shown depend on the client type (individual, sole trader, company, trust, SMSF, partnership, association or government body).
• Services profile – designated services and delivery channels.
• ML/TF risk assessment – each risk factor table, the country risk table, the four dimension ratings, and the derived rating and required CDD level.
• Entity identity verification – your verification details and any supporting documents, or the result summary if the client was verified through Identity Verification (BGLiD).
• Related parties – each party's details, representative authority, verification and screening results.
• Determination – final risk rating and any override reason, CDD level applied, outcome, rationale, who determined it and when.
• The date the record was generated.

8. Track initial CDD activity in the audit log

Initial CDD activity is recorded on the Audit Log screen. To see only initial CDD entries, select Client - Initial CDD in the Module filter.

Each entry shows when the action happened, who performed it, the module (Client) and the entity type (Initial CDD). Save and Update entries show the before and after values of fields you changed, so you can see exactly what was updated. For privacy, determination details such as the final risk rating, CDD level, outcome and rationale are redacted in the audit log.

Frequently asked questions

Select a question to see the answer.

Related articles

For the full list of audit log entries, see Audit Log. For what starting CDD costs, see Firm Verify Pricing and Billing. For how the risk rating shows on the Clients screen, see What the Clients Screen Shows.

Last checked against the 5 November 2026 release.