Customer Due Diligence Requirements for Service Businesses

This article is general information, not legal advice

The rules below are summarized for orientation. They change, they have exceptions, and how they apply depends on your industry, your state and the details of your business. If you handle client funds, work in a regulated sector or deal with large international payments, talk to a lawyer or compliance professional about your specific situation before relying on any summary, including this one.

Who the formal CDD rule actually covers

In the United States, customer due diligence as a legal requirement comes mainly from the Bank Secrecy Act and the regulations issued under it by the Financial Crimes Enforcement Network (FinCEN). The CDD rule that took effect in 2018 applies to covered financial institutions: banks and credit unions, broker dealers in securities, mutual funds, futures commission merchants and introducing brokers in commodities. Other businesses regulated under the Bank Secrecy Act, such as money services businesses, casinos and dealers in precious metals, stones or jewels, have their own anti money laundering program obligations.

A freelance developer, a marketing agency, an IT consultancy or a construction subcontractor is generally not a covered financial institution and is not subject to the formal CDD rule just because it invoices business clients. Accountants, lawyers and real estate professionals sit in a more complicated position, with professional rules and some specific federal requirements, so they should confirm their own obligations.

The four core elements banks must follow

The CDD rule is often described as having four core elements, sometimes called the pillars of customer due diligence.

• Identify and verify the identity of each customer.
• Identify and verify the beneficial owners of legal entity customers, meaning people who own 25 percent or more and one person with significant control.
• Understand the nature and purpose of the customer relationship so the institution can build a risk profile.
• Monitor the relationship on an ongoing basis, report suspicious activity and keep customer information current.

Higher risk customers get enhanced due diligence: more documentation, more questions about the source of funds and closer monitoring. Lower risk customers get a lighter version. The idea is proportion, not paperwork for its own sake.

Duties that apply to every US business

Even if the CDD rule does not cover you, some obligations reach nearly every business in the country.

Sanctions compliance is the most important. Regulations administered by the Office of Foreign Assets Control (OFAC) apply to all US persons and businesses. You may not provide services to, or accept payments from, parties on the Specially Designated Nationals list or in comprehensively sanctioned jurisdictions without authorization. There is no size threshold and no exemption for small firms, which is why screening a new client's name and principals against the SDN list is a sensible habit, especially for international work.

Large cash payments are another. A business that receives more than $10,000 in cash in one transaction, or in related transactions, generally has to report it to the IRS on Form 8300. Few service businesses are paid in cash at that scale, but it is worth knowing the rule exists.

Beneficial ownership reporting under the Corporate Transparency Act has changed several times since it was introduced, and its scope for domestic companies was narrowed significantly in 2025. Check FinCEN's current guidance rather than older articles if this affects you.

What service businesses can borrow from the bank model

You do not need a compliance department to use the logic behind CDD. The same four questions translate directly into a client intake process for a service firm.

Identify the client. Confirm the legal entity in the state registry, its status and its formation date, and make sure the name on the contract matches the registered name. Our business entity search guide shows how.

Know who you are dealing with. You do not need ownership percentages, but you should know that the person signing works for the company and has authority to sign. Check their role on the company's own website and public professional profiles, in their business capacity only.

Understand the purpose. Write down what the project is, how big it is, how the client plans to pay and from where. Payments from an unrelated third party or a foreign account for a domestic company are worth a question.

Keep watching. A client can change during a long engagement. Entity status, domain records and payment behavior are all worth checking again at renewal time or when invoices start slipping.

A risk based checklist for client intake

Banks scale their checks to the risk, and service businesses can do the same by scaling to project size and payment terms.

Keep a record of what you checked and when. A saved report gives you something concrete to point to if a partner, an insurer or a lender later asks how you choose clients. Our page on client due diligence turns this into a full step by step process.

Where the line sits for checking people

Banks verify individual customers because the law requires it. Service businesses are in a different position. If you check a person rather than a business, and use the result to decide on credit, insurance, employment or housing for that individual, you may be using a consumer report under the Fair Credit Reporting Act, with strict rules about permissible purpose and disclosure. Keep client checks focused on the business and on people only in their role at that business, and leave personal history out entirely. The fcra compliant background check page explains where ClientVetter draws this line.