What is Customer Due Diligence (CDD) for Accountants and Tax Advisers
L.4557/2018 requires accountants to apply Customer Due Diligence (CDD) before every new business relationship. Learn exactly what is required, which documents you need, and how to assess each client's risk.
What is Customer Due Diligence?
Customer Due Diligence (CDD) is the process by which a professional — accountant, tax adviser, lawyer or consultant — identifies and assesses the risk of each new client before taking on work. Under Law 4557/2018, Article 11, applying CDD is mandatory for all "obliged entities" — and accountants are explicitly listed (Article 5§1). Failing to apply CDD is not merely an administrative breach. It can lead to fines of up to €5,000,000, criminal prosecution, and suspension of professional licence.
When Does CDD Apply?
CDD is mandatory in three situations: 1. Before every new business relationship: Every time you take on a new client, you must complete the CDD process before starting any work. 2. For occasional transactions above €15,000: If an individual or legal entity commissions work worth more than €15,000, CDD is required even without an ongoing relationship. 3. When there are indications of money laundering: Whenever suspicious elements appear — even for an existing client — you must re-examine their file.
What CDD Involves: The 4 Steps
The due diligence process consists of four core steps: Step 1 — Identification: Collect identity documents (national ID or passport), tax number, residential address. For legal entities: articles of association, company registration, details of the legal representative. Step 2 — Beneficial Owner (UBO): Identify the "ultimate beneficial owner" — the natural person who ultimately controls or benefits from the client (>25% ownership or control). Step 3 — Purpose of the Business Relationship: Understand the scope of work, the source of funds, and the nature of the transactions. Step 4 — Risk Assessment: Classify the client as low, medium or high risk, with documented methodology.
Which Documents Do You Need?
For natural persons: • Copy of national ID or passport (in date) • Proof of address (utility bill, last 3 months) • Tax identification number (TIN) and social security number • Tax return or income certificate (for high-risk clients) For legal entities, additionally: • Company registry certificate (not older than 3 months) • Articles of association or latest amendment • Company tax number • UBO declaration or registry search • Details of the legal representative All documents must be kept for at least 5 years after the end of the business relationship (Article 25 L.4557/2018).
Simplified vs. Enhanced CDD
The law provides for three levels of CDD based on risk: Simplified CDD: For low-risk clients — e.g. public authorities, EU-listed companies. Fewer documents, but documentation is always required. Standard CDD: For the average client. Full four-step process as described above. Enhanced CDD (EDD): For high-risk clients: PEPs (politically exposed persons), clients from high-risk countries, complex corporate structures. Requires additional documents and senior management approval.
How to Assess Each Client's Risk
The law requires a risk-based approach: you do not treat all clients identically. Risk assessment is based on factors such as: Geographic risk: Residence/activities in high-risk countries (FATF, EU lists) Occupational risk: Industries with elevated risk (real estate, cash-intensive businesses) Ownership structure: Complex holding structures, offshore companies PEP status: Politicians, judges, senior public officials and their family members Transaction history: Unusual or unexplained transactions The classification must be documented in writing. Complylty automatically generates a risk score (0–100) with detailed documentation for each client.
What If the Client Refuses to Provide Information?
If a client refuses to cooperate in the CDD process, the law is clear: you do not take on the work, or you terminate the relationship if it has already begun. Moreover, refusal to comply with CDD is itself an indicator of suspicious behaviour that may oblige you to file a Suspicious Transaction Report (STR) with the AMLCU. Important: You are not permitted to notify the client that you have filed an STR (tipping-off is prohibited under Article 39 L.4557/2018).