What is simplified due diligence?
Simplified due diligence (SDD) is a lighter form of customer due diligence that a UK regulated firm may use when it has decided that a client or transaction is low risk. Under regulation 37 of the Money Laundering Regulations 2017 (MLRs), you can adjust the extent, timing or type of checks, but you cannot skip them.
SDD sits at the bottom of the three levels: simplified, standard customer due diligence and enhanced due diligence.
The UK rules
| Rule | What it says | Where |
|---|---|---|
| When it is allowed | Only where you have decided the relationship or transaction presents a low degree of risk, taking into account your firm-wide risk assessment, information from your supervisor and the risk factors in reg 37(3) | Reg 37(1) |
| What you can change | The extent, timing or type of the measures you take under regs 28 and 29(11)–(13) | Reg 37(2)(a) |
| What you still do | Keep complying with regs 28, 29 and 30A, and monitor well enough to detect unusual or suspicious transactions | Reg 37(2) |
| Risk factors | Customer, product or service, and geographical factors, for example a public body, a regulated financial institution or a company listed on a regulated market | Reg 37(3) |
| No automatic low risk | One or more low-risk factors does not always mean the risk is low | Reg 37(4) |
| When to stop | If you doubt the documents, the risk is no longer low, you suspect money laundering, or any reg 33(1) EDD trigger applies | Reg 37(8) |
Source: MLR regulation 37, as amended by SI 2026/621 from 30 June 2026.
What this means for a small firm
- Decide on the evidence. SDD needs a documented decision that the case is low risk, based on your firm-wide risk assessment and a client risk assessment.
- Reduce, don’t remove. You still identify the client and verify them. You might accept fewer documents, or verify later where the rules allow.
- Keep monitoring. Ongoing monitoring still applies, and so does discrepancy reporting for company clients.
- Write it into your policy. Say which client types you treat as low risk and what you collect for them.
- Expect to use it sparingly. Most of the clients a small estate agency, letting agency or accountancy practice sees, such as private individuals and small private companies, rarely fit the clearer examples in reg 37(3), like public bodies, regulated financial institutions and listed companies. Standard CDD is likely to be the norm.
Frequently asked questions
Can I skip ID checks under simplified due diligence?
No. SDD lets you adjust how much you do and when, but you must still meet the core CDD duties in reg 28. If you cannot justify low risk on the file, apply standard CDD.
Which clients qualify for SDD?
Examples in reg 37(3) include public authorities, regulated credit and financial institutions subject to equivalent AML rules, and companies listed on a regulated market. A client fitting an example is not automatically low risk: you still have to assess it.
When must I stop using SDD?
As soon as you doubt the information you hold, the risk is no longer low, you suspect money laundering or terrorist financing, or a reg 33(1) trigger for enhanced due diligence applies (reg 37(8)).
How AML Buddy helps
Even for a low-risk client, you need a verified identity on file. With AML Buddy, your client checks their ID document and takes a selfie through one secure link, and is screened against sanctions, PEP and adverse media sources, with a timestamped PDF report. The decision to apply SDD stays with your firm. See pricing.