We collect all the CDD documents. Why isn’t that enough?

Eloise Butterworth · 26 October 2026 · a five-minute read

This question usually comes with a hint of exasperation, and honestly, fair enough. The firm has invested in electronic verification, the files hold ID, bank statements and EIDV reports, the onboarding checklist gets ticked. What more does anyone want?

The straight answer: collecting is not checking. Client due diligence is not a filing exercise, it is a thinking exercise, and the regulator has said so out loud: lack of scrutiny of CDD was flagged as an emerging risk in the SRA’s sectoral risk assessment in 2025, and it is one of the most consistent findings in audits. The documents are the start of the job, not the end of it.

What scrutiny actually looks like

Take the pack you already collect and read it against what you know. Do the dates line up? Do the spellings match, on the ID, on the bank statement, on the file? Do the values and transactions in the statements support the story the client has told you about where the money comes from? Is there anything in the documents that changes the risk profile of the client or the matter, a jurisdiction you did not expect, a company you have never heard of, a deposit that arrived last Tuesday from nowhere in particular?

None of that requires forensic accountancy. It requires ten minutes of cross-referencing and the willingness to ask a follow-up question when something does not sit right. The firms that get caught out are rarely the ones missing documents; they are the ones holding documents they can’t evidence anybody scrutinised.

The EIDV comfort blanket

Electronic verification of identity is a genuinely useful tool and an increasingly dangerous comfort blanket. A green result tells you an identity checks out against databases. It does not tell you the identity belongs to the person you are dealing with unless you are using biometrics (and many still aren’t), that the source of funds makes sense, or that the matter itself smells right. Over-reliance on the tech, treating the report as the conclusion rather than something that needs testing is where too many firms still come unstuck.

If it isn’t written down, it didn’t happen

Here is the part that stings even the diligent firms: plenty of fee earners do scrutinise, and record none of it. To an auditor, and to the SRA, undocumented scrutiny is indistinguishable from no scrutiny. A file note of three lines, what you checked, what you noticed, why you were satisfied, converts good practice into evidence. It is the cheapest AML control you will ever implement.

So the honest reframe of the question: you almost certainly collect enough. The gap, if there is one, is between collecting and concluding, and it is the gap your file reviews should be built to find.