Customer Due Diligence Rule

A firm completed thorough identification and due diligence on a customer at account opening. Three years later the customer's trading pattern and stated occupation no longer match. What does the customer due diligence requirement expect?

1. A.Nothing further; identification and due diligence are completed at account opening and are not revisited.Wrong. Ongoing monitoring is an express component, and a profile only works if it reflects the current customer.
2. B.The firm should update the customer information on a risk basis and assess whether the changed pattern has an explanation.Correct. Divergence between profile and behaviour is exactly the signal the monitoring component exists to catch.
3. C.The firm must close the account, since a customer whose activity departs from the stated profile can no longer be verified.Wrong. Closure is a last resort, and an unexplained change calls first for inquiry rather than exit.
4. D.The firm must re-run its identity verification from the beginning, collecting fresh documents for every such customer.Wrong. Identity was established; what has gone stale is the activity profile rather than the identification.

Why: Customer due diligence is not a one-time gate at account opening; it includes ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. A profile assembled years ago stops being useful the moment the customer's actual behaviour diverges from it, and that divergence is itself one of the most reliable indicators the monitoring is meant to catch. The firm should therefore refresh the customer information and assess whether the new pattern has an explanation, escalating to its anti-money-laundering compliance officer if it does not. Updating is expected where activity or risk indicates a need, rather than on a rigid calendar applied identically to every account.

Opening an account for Fenwick Trading LLC, a firm asks for the identity of the individuals who own or control the entity. The manager signing the forms says the owners value their privacy and declines to name them. What is the correct outcome?

1. A.The account may be opened, since the entity itself has been identified and verified as the customer.Wrong. Verifying a company establishes nothing about who stands behind it, which is the gap the rule closes.
2. B.The account may be opened with trading restricted to unsolicited transactions until the information is supplied.Wrong. No partial-onboarding route exists; the information is a precondition rather than a limit on activity.
3. C.The account may not be opened, and the refusal should itself be assessed as a red flag.Correct. The information is mandatory with no privacy exception, and a refusal is itself worth examining.
4. D.The account may be opened if the manager certifies in writing that no owner appears on any sanctions list.Wrong. A self-certification about sanctions does not supply the identification the rule requires.

Why: The customer due diligence rule requires a firm to identify and verify the beneficial owners of a legal entity customer, capturing both those who own an equity interest at or above the level the rule sets and one individual with significant responsibility for controlling or managing the entity. The requirement exists because a company can be assembled specifically to stand between a person and their money, and identifying the entity alone would let that structure defeat the whole programme. The information is not optional and there is no privacy exception, so an entity that will not supply it cannot be onboarded. A refusal of this kind is also a red flag in its own right and should be assessed for whether it warrants a suspicious activity report.