When customer due diligence fails on a key client: what to do first
When a customer due diligence check fails on a key client, suspend the transaction that triggered the failure and record the exact trigger before any further service is provided. The file moves from ordinary monitoring to enhanced review immediately. No further service continues until the check is resolved, escalated, or the relationship is formally restricted.
The legal basis
For crypto-asset service providers, identification duties that feed into due diligence sit alongside two directly applicable EU regulations: Regulation (EU) 2023/1114 (MiCA) and Regulation (EU) 2023/1113 (TFR). Both apply from 30 December 2024. Neither regulation sets out a due diligence procedure by that name. They establish the framework around it — authorisation and conduct obligations under MiCA, and the information that must accompany a transfer of crypto-assets under TFR — within which a failed check on a key client becomes a compliance event rather than an internal note.
Where a national implementing measure applies to the specific step you are taking, it is checked against your registered entity separately; this page does not substitute for that check.
What this means in practice
A failed check on a key client changes three things at once. The transaction that triggered the failure is suspended, not merely flagged for later review. The clock for an internal decision starts running from the moment the failure is recorded, not from when a compliance officer later opens the file. The relationship's risk classification rises, which extends monitoring to related accounts and to counterparties the client controls.
None of this depends on whether the client disputes the finding. The suspension is a control measure, not an accusation, and it is reversible once the discrepancy is resolved.
Immediate steps
- Compliance officer suspends the triggering transaction and records the exact trigger in the file, with a timestamp.
- Front office stops all further servicing of the client pending the outcome of the review.
- Compliance officer requests supplementary identification or source-of-funds evidence from the client, in writing, with a stated deadline.
- If the evidence does not arrive or does not resolve the discrepancy, compliance officer escalates the file to senior management with a written recommendation.
- Senior management decides whether to file a suspicious activity report and whether to restrict or terminate the relationship.
- Compliance officer logs the decision, the evidence reviewed, and the date before any restriction is lifted or made permanent.
Who decides, and on what evidence
| Stage | Decision-maker | Evidence reviewed | Typical timing |
|---|---|---|---|
| Initial trigger | Compliance officer | Identification records already on file | Immediate, at the moment of failure |
| Supplementary request | Compliance officer | Client's written response | Set by internal policy, usually days |
| Escalation | Senior management | Compliance officer's file and recommendation | Before any further transaction is allowed |
| Filing decision | Senior management, on compliance advice | Full file, including the client's response | Without undue delay once suspicion is confirmed |
If the client's own supervisory relationship turns this into a wider governance question, that path is handled separately: When a supervisor asks about governance explained.
If your situation differs
If the client relationship also carries a licence you administer and royalty payments under it look understated, the evidence-gathering overlaps but the decision-maker does not: When royalties are underreported.
If the same client has sent, or received, a warning letter over a patent while the due diligence file is open, keep the two files separate but cross-reference the dates: When a warning letter arrives from a patent holder.
If the underlying contract with this client carries a security addendum that arrived with the order form, check whether the addendum's obligations are already breached before the due diligence file closes: When a security addendum arrives with the order form.
What this page does not cover
This page does not set out how to draft a suspicious activity report, does not calculate a filing deadline in a specific number of days, and does not assess whether a given client qualifies as a politically exposed person. It does not describe the internal risk-scoring methodology a firm applies to its own client base; that choice belongs to the firm's own policy, not to the regulation cited above.
Related situations
A failed due diligence check often precedes a decision on whether to file. If that is the next stage in your file, see When a suspicious activity report is considered.
Verified
Checked on 5 March 2025. Sources: Regulation (EU) 2023/1114 (MiCA), in force from 30 December 2024; Regulation (EU) 2023/1113 (TFR), in force from 30 December 2024.
FAQ
What is the first step when customer due diligence fails on a key client?
Suspend the transaction that triggered the failure and record the exact trigger in the file before any further service is provided to that client.
Which deadline is already running?
The internal escalation clock starts at the moment the failure is recorded, not when the file is later reviewed. The regulations above do not set a fixed number of days for this internal step; your own escalation policy does.
Who decides, and on what evidence?
Senior management decides, on the compliance officer's recommendation, based on the client's written response and the identification records already held on file.