PEP
Politically exposed persons
“PEPs, their family members and close associates require senior management approval, establishing the source of wealth and source of funds, and enhanced monitoring of the relationship.”
Enhanced Due Diligence (AML): When and How to Apply It
We help you identify high-risk situations (PEPs, high-risk third countries, correspondent banking, non-face-to-face transactions, opaque structures) and design and implement the enhanced due diligence (EDD) measures required by Law 10/2010 and Royal Decree 304/2014, with enhanced monitoring and traceability.
Free consultation
We reply within 24 h
- Legal basis (Law 10/2010)
- Art. 11
- Trigger cases (Royal Decree 304/2014)
- Art. 19
- Enhanced measures (Royal Decree 304/2014)
- Art. 20
- EU Regulation (AMLR)
- Reg. (EU) 2024/1624
Services
How we handle enhanced due diligence
Six building blocks to detect when enhanced due diligence is required and to apply it in a proportionate, documented way that you can defend before SEPBLAC.
Diagnosis
Identifying high-risk situations
We review your risk assessment and your customer portfolio to detect when enhanced due diligence is required: customers, products, channels and transactions that present a higher risk of money laundering or terrorist financing.
Learn more →
Art. 11 Law 10/2010High riskRisk-based approachRoyal Decree 304/2014
Implementation
Designing and implementing enhanced measures
We build the enhanced measures into your procedures: additional information, senior management approval, source of wealth and source of funds, and enhanced monitoring, all integrated into the AML/CFT manual.
Learn more →
ProceduresAML manualEvidence
PEP
Politically exposed persons
We design how you handle domestic and foreign PEPs (PRP): senior management approval, source of wealth and source of funds, and enhanced monitoring of the relationship.
Learn more →
PEP / PRPSenior management approval
Geography
High-risk third countries
We apply EDD to customers and transactions linked to countries with strategic deficiencies identified by the European Commission and the FATF, with enhanced monitoring of transactions.
Learn more →
FATFHigh-risk countries
Funds
Source of wealth and source of funds
We document the source of wealth and source of funds in high-risk relationships, with the additional information and supporting evidence the supervisor may request.
Learn more →
Source of fundsWealth
Monitoring
Enhanced, ongoing monitoring
We set up enhanced, ongoing monitoring of high-risk relationships, with more frequent reviews, adjusted thresholds and a record of activity.
Learn more →
MonitoringReviews
Trigger cases
When enhanced measures are triggered
Enhanced due diligence is not optional in certain situations: politically exposed persons, high-risk third countries, correspondent banking, non-face-to-face transactions and opaque structures all trigger EDD.
Geography
High-risk third countries
“Customers and transactions linked to countries with strategic deficiencies, as identified by the European Commission and the FATF, require enhanced measures to be applied systematically.”
Correspondent banking
Cross-border correspondent banking
“Correspondent relationships with institutions from third countries require enhanced, ongoing monitoring of transactions, with the intensity adjusted to the risk in each case.”
Opacity
Non-face-to-face transactions and opaque structures
“Non-face-to-face transactions, non-transparent or complex ownership structures and unusual transactions with no clear economic rationale raise the risk and trigger EDD.”
Why it matters
Why are enhanced measures critical?
Failing to apply enhanced due diligence when it is required, or applying it as a mere formality, is a due diligence breach that can be penalized, and it leaves the entity exposed to high-risk transactions.
The most common mistake: treating all customers the same. If the risk assessment does not single out high-risk situations, the entity does not trigger EDD when it should and leaves gaps that the supervisor will spot.
High risk allows no shortcuts: with a PEP, a high-risk country or an opaque structure, standard measures are not enough. Identification, source of funds and monitoring must all be strengthened.
Enhanced measures must be demonstrable: triggering them on paper is not enough. You need evidence of senior management approval, of the verified source of funds and of enhanced monitoring.
Law 10/2010
Non-compliance
Failing to apply enhanced measures in the cases where they are required is a due diligence breach that SEPBLAC can penalize.
PEP
Senior management approval
Establishing or maintaining a relationship with a PEP without approval from the appropriate level of senior management is a common control weakness.
Exposure risk
High-risk transactions
Without EDD, the entity may end up channeling high-risk transactions without detecting them in time, with consequences in terms of penalties and reputation.
Do you know when you must apply enhanced measures?
You should review your risk assessment, identify the high-risk situations in your customer portfolio and have your enhanced measures clearly defined and documented: additional information, source of funds, senior management approval and enhanced monitoring.
Frequently asked questions
Enhanced measures: common questions
What are enhanced due diligence measures?
They are the most demanding level of due diligence, known as enhanced due diligence (EDD): the measures that obliged entities must apply, in addition to standard measures, to customers, products or transactions that present a higher risk of money laundering or terrorist financing.
They are set out in Article 11 and Section 3 of Law 10/2010 and developed in Royal Decree 304/2014.
When must they be applied?
Whenever the transaction or relationship presents a higher risk. The law sets out cases where they are mandatory and, in addition, each entity must identify in its risk assessment other situations that justify EDD.
Typical higher-risk factors: non-transparent or complex ownership structures, regular use of bearer payment instruments, or unusual transactions with no clear economic purpose.
Which cases always require enhanced measures?
The main enhanced due diligence cases under Law 10/2010 and Royal Decree 304/2014 include:
- Politically exposed persons (PEPs), their family members and close associates.
- High-risk third countries with strategic deficiencies.
- Cross-border correspondent banking with institutions from third countries.
- Non-face-to-face transactions and products that favor anonymity.
What specific measures does EDD include?
They depend on the case, but they usually combine additional information on the customer and the purpose of the relationship, establishing the source of wealth and source of funds, senior management approval to establish or maintain the relationship, and enhanced, more frequent monitoring of transactions.
The measures must be adjusted to the level of risk in each case and must be documented.
What is a PEP and why does it require enhanced measures?
A PEP (politically exposed person, or PRP under Spanish law) is someone who holds or has held prominent public functions. The law applies the same treatment to domestic and foreign PEPs.
Because of their exposure to corruption risks, a relationship with a PEP requires senior management approval, knowing the source of wealth and source of funds, and enhanced monitoring, which also extends to their family members and close associates.
What are high-risk third countries?
They are countries with strategic deficiencies in their anti-money laundering systems, as identified by the European Commission and the FATF.
Relationships and transactions linked to them require enhanced measures to be applied systematically, with enhanced monitoring of transactions.
How do standard, simplified and enhanced measures differ?
It is a risk-graded system:
- Simplified: low-risk customers or transactions.
- Standard: customer identification and know your customer (KYC) as the general rule.
- Enhanced: higher risk, with additional and more intensive measures.
Simplified measures stop applying as soon as the risk is no longer low.
How does the EU AML package affect EDD?
Regulation (EU) 2024/1624 (AMLR) harmonizes enhanced due diligence measures across the EU for high-risk situations, including PEPs and high-risk third countries.
It applies directly from July 10, 2027, so you should review now how you identify and document EDD ahead of that date.
People also ask
Enhanced measures: PEPs, family members, duration and turning customers away
Who approves a high-risk business relationship or one with a PEP?
The senior management level that the entity sets in its internal procedures, in line with the risk. The designated person must understand the entity’s risk exposure and be senior enough to decide. Establishing or maintaining the relationship without that approval is a control weakness.
Are enhanced measures a closed list?
No. The law sets out mandatory cases, but the approach is risk-based: each obliged entity must identify other higher-risk situations in its risk assessment and apply proportionate enhanced measures, even if those situations are not expressly listed.
Must EDD be applied to a PEP’s family members and close associates?
Yes. The enhanced treatment of PEPs extends to their family members and to persons known to be close associates, because of the risk that they may be used as an indirect channel.
How long does PEP status last?
Enhanced measures are maintained while the person holds the public function and for at least two years after they leave it. After that period, a risk-based approach continues to be applied according to the remaining risk.
Does EDD mean you must turn the customer away?
Not necessarily. EDD is a way to manage the risk, not a ban. However, if the due diligence measures cannot be applied properly, the obliged entity must not start the business relationship, or must end it.
How does it relate to sanctions screening?
They are complementary obligations: EDD manages money laundering risk, while sanctions screening checks that the customer or the transaction does not involve persons or entities subject to international financial sanctions. In high-risk relationships, both controls are strengthened.
Levels and scope
Due diligence levels: comparison and scope
The intensity of due diligence is graded by risk. We help you define when to apply each level and document enhanced measures proportionately.
What determines the scope (and cost) of EDD
Implementing effective enhanced measures depends on how many high-risk situations the entity deals with and on how robust its existing risk assessment is.
- Risk profile
- Number of high-risk customers: PEPs, third countries, opaque structures, non-face-to-face.
- Sector
- Correspondent banking, crypto, real estate and other sectors with high exposure.
- Starting point
- Designing EDD from scratch, or strengthening and documenting an existing system.
- Recurrence
- Enhanced monitoring, PEP reviews and keeping source of funds information up to date over time.
How we work on EDD
We start from the risk assessment, define the EDD triggers and build the measures into the manual and procedures, with evidence for the supervisor.
- Review of the risk assessment and of high-risk situations.
- Definition of triggers and enhanced measures for each case.
- Integration into procedures, enhanced monitoring and evidence.
| Level | Simplified | Standard | Enhanced (EDD) |
|---|---|---|---|
| When it applies | Low risk | As the general rule | Higher risk |
| What it requires | Lighter, graduated identification | Customer identification and KYC | Additional information, source of funds and enhanced monitoring |
| Typical cases | Public entities, low-risk products | Standard customer with no red flags | PEPs, third countries, correspondent banking, non-face-to-face |
| Senior management approval | No | No | Yes (in cases such as PEPs) |
| Legal basis | Arts. 9–10 Law 10/2010 | Arts. 3–8 Law 10/2010 | Art. 11 and Section 3 · Royal Decree 304/2014 |
Indicative table. Simplified due diligence stops applying as soon as the risk is no longer low, and enhanced due diligence is adjusted to the level of risk in each case. Each entity should set its triggers in its manual.
Operational guide
How to apply enhanced due diligence measures: a practical guide
EDD is not about ticking more boxes. It means detecting high risk, strengthening identification, source of funds and monitoring proportionately, and keeping evidence of every decision. That is how enhanced measures stand up to a SEPBLAC review.
Identify the high-risk situation
The first step is to recognize the trigger: a PEP, a high-risk third country, correspondent banking, a non-face-to-face transaction or an opaque structure. Without clear triggers in the manual, EDD is not activated when it should be.
Apply proportionate measures
Additional information, source of wealth and source of funds, senior management approval and enhanced monitoring. The intensity is adjusted to the risk in each case: you do not apply everything in the same way to everyone.
Document and monitor
Every enhanced measure must leave a trail: who approved it, what source of funds was verified and how monitoring is carried out. If the measures cannot be applied, the relationship is not started, or it is ended.
Enhanced measures checklist in 10 steps
- Risk assessment: define which customers, products and transactions are higher risk.
- Triggers: set out in the manual the cases that trigger EDD.
- PEPs: check whether the customer, its beneficial owner, family members or close associates are politically exposed persons.
- Geography: check for links with high-risk third countries (European Commission and FATF).
- Additional information: collect enhanced data on the customer and the purpose of the relationship.
- Source of funds and wealth: document where the wealth and the funds come from.
- Senior management approval: obtain approval from senior management where required.
- Enhanced monitoring: step up monitoring and adjust thresholds and frequency.
- Evidence: keep the supporting documents for each enhanced measure applied.
- Exit: if the measures cannot be applied, do not start the business relationship, or end it.
If you want to review or implement your enhanced measures, see our anti-money laundering (AML/CFT) practice area or our page on due diligence (KYC).
Enhanced measures in practice
From risk trigger to evidence
Applying EDD takes more than good intentions: you need to detect the high-risk situation, strengthen the measures proportionately, approve at the right level and monitor the relationship more closely. Here is a visual overview of how it works in practice.
1) DetectDetect: the trigger
The goal is not to apply EDD to everything, but to recognize when the risk is high and trigger it. The risk assessment and the triggers in the manual are the starting point.
- PEPs, family members and close associates
- High-risk third countries
- Opaque structures and non-face-to-face
2) StrengthenStrengthen: EDD measures
Enhanced measures are added on top of standard ones and adjusted to the risk: more information, source of funds and wealth, and stepped-up controls.
- Additional information
- Source of wealth and funds
- Intensity proportionate to risk
3) ApproveApprove: senior management
In cases such as PEPs, establishing or maintaining the relationship requires approval from the senior management level set by the entity, with sufficient seniority.
- Documented approval
- A sufficiently senior approver
- Risk-based decision
4) MonitorMonitor: enhanced monitoring
High-risk relationships require enhanced monitoring, which in correspondent banking is ongoing. Thresholds and frequency are adjusted and each review is recorded.
Tip: enhanced monitoring is what inspectors look at most closely. Without a record of reviews, EDD looks like a formality rather than an effective control.
Quick decisionPractical map: should I apply enhanced measures?
Mandatory case
PEP, high-risk third country, correspondent banking or non-face-to-face: always EDD, no exceptions.
Higher risk
Opaque structure, bearer payments or unusual transaction: proportionate EDD based on the risk assessment.
Cannot be applied
If the measures cannot be applied: do not start the business relationship, or end it.
Enhanced measures playbook
Case by case: which measure to apply
PEP / PRP
Senior management approval, source of wealth and source of funds, and enhanced monitoring, extended to family members and close associates.
PEP file, senior management approval and source of funds evidence.
High-risk third country
Systematic enhanced measures and enhanced monitoring of transactions linked to those countries.
Identification of the geographic link and a record of monitoring.
Correspondent banking
Enhanced, ongoing monitoring of transactions, with the intensity adjusted to the risk of the correspondent relationship.
Correspondent banking questionnaire and documented periodic review.
Non-face-to-face transaction
Secure remote identification procedures and stronger know-your-customer checks.
Evidence of the remote identification process used.
Opaque structure
Additional information on the ownership structure and the beneficial owner; measures proportionate to the higher risk.
Group structure chart and beneficial ownership analysis.
Common EDD mistakes
Spot them before SEPBLAC flags them.
- Not triggering EDD because the manual lacks clear triggers.
- Applying enhanced measures as a mere formality, without genuinely stepping up monitoring.
- Maintaining relationships with PEPs without senior management approval.
- Not documenting the source of wealth and source of funds in high-risk relationships.
- Leaving PEPs’ family members and close associates out of the scope of enhanced measures.
Operational glossary
Key concepts in enhanced due diligence
If you are defining or applying enhanced due diligence, these terms come up in the risk assessment, in the manual and in your dealings with the supervisor. Understanding them helps you apply EDD proportionately.
EDDBasics
Enhanced due diligence
Additional and more intensive measures applied, on top of standard ones, to customers, products or transactions with a higher risk of money laundering or terrorist financing.
Art. 11 and Section 3 of Law 10/2010.
PEP / PRPTrigger
Politically exposed person
Someone who holds or has held prominent public functions. The relationship requires senior management approval, source of funds and enhanced monitoring, also for family members and close associates.
Single regime for domestic and foreign PEPs.
Third countryGeography
High-risk country
A country with strategic deficiencies in its anti-money laundering system, identified by the European Commission and the FATF. It requires EDD to be applied systematically.
Commission decision (Art. 9 Dir. 2015/849).
Correspondent bankingBanking
Cross-border correspondent banking
A relationship between financial institutions in different jurisdictions. With institutions from third countries, it requires enhanced, ongoing monitoring of transactions.
Art. 13 of Law 10/2010.
Source of fundsMeasure
Source of funds and wealth
Source of funds is where the money for a transaction comes from; source of wealth is how the customer’s overall wealth was built up. In EDD, both are documented.
A typical measure in relationships with PEPs.
Non-face-to-faceChannel
Non-face-to-face transaction
A relationship or transaction in which the customer is not physically present. It requires secure remote identification procedures and stronger know-your-customer checks.
Art. 21 of Royal Decree 304/2014.
ApprovalGovernance
Senior management approval
Approval required to establish or maintain high-risk relationships (such as those with PEPs), given by a person who understands the risk and is senior enough.
Set out in the internal procedures.
MonitoringControl
Enhanced monitoring
More intensive and more frequent monitoring of high-risk relationships, with adjusted thresholds and a record of the reviews carried out.
Ongoing in correspondent banking.
AMLREU 2024
Regulation (EU) 2024/1624
EU regulation that harmonizes due diligence, including enhanced due diligence, for high-risk situations. Directly applicable from July 10, 2027.
Strengthens EDD across the EU.
Contact
Book a call
Tell us about your risk profile and we will help you define when to apply enhanced measures, design them proportionately and document them for SEPBLAC.
Legal framework for enhanced due diligence measures: Law 10/2010 and Royal Decree 304/2014
Enhanced due diligence measures are governed by Article 11 and Section 3 of Law 10/2010 of April 28. Obliged entities must apply them, in addition to standard measures, in the cases set out in the law and, more generally, in the areas, products, channels, relationships and transactions that present a higher risk of money laundering or terrorist financing.
Cases and measures (Royal Decree 304/2014)
The Regulation approved by Royal Decree 304/2014 of May 5 develops EDD: Article 19 sets out the cases in which it applies, Article 20 the enhanced measures, Article 21 the requirements for non-face-to-face relationships and transactions, and Article 22 the high-risk countries, territories or jurisdictions. Higher-risk factors include non-transparent or complex ownership structures and the regular use of bearer payment instruments.
PEPs, third countries and correspondent banking
Section 3 includes specific cases. Politically exposed persons (PEPs), under a single regime for domestic and foreign PEPs, require senior management approval, establishing the source of wealth and source of funds, and enhanced monitoring, also for family members and close associates. High-risk third countries (identified by European Commission decision under Article 9 of Directive 2015/849, and by FATF lists) require systematic EDD. Cross-border correspondent banking requires enhanced, ongoing monitoring of transactions.
Supervision and consequences
SEPBLAC supervises compliance. Failing to apply enhanced measures when required, or applying them as a mere formality, is a due diligence breach that can be penalized. If the measures cannot be applied properly, the obliged entity must not start the business relationship, or must end it.
The EU AML package
Regulation (EU) 2024/1624 (AMLR) harmonizes enhanced due diligence measures across the EU for high-risk situations, and Directive (EU) 2024/1640 (AMLD6) completes the institutional framework, with application and transposition from July 10, 2027.
AML / due diligence services
Related areas
Resources and blog
Official sources
Key legislation, linked to the official text:
- Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Royal Decree 304/2014 of May 5 approving the Regulation implementing Law 10/2010 of April 28 on the prevention of money laundering and terrorist financingBOE · consolidated text
- Regulation (EU) 2024/1624 of May 31, 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financingEUR-Lex · Official Journal of the EU
Legislation and links reviewed in .