Enhanced Due Diligence in 2026: Faster, Smarter, and Built for Real Risk

Before our recent webinar even began, the presenters were reminiscing about decade-old AML email threads. They’ve been working in this industry for a long time. That perspective matters. Enhanced Due Diligence (EDD) today is not what it was even a few years ago. Regulatory expectations are clearer, the risk landscape is broader and crucially, technology is now mature enough to deliver depth at speed.

This post distills the discussion: what EDD really requires, why it’s challenging, how AI and automation are changing the game, and how compliance teams can modernize without ripping up their existing processes.

EDD starts where KYC stops

Most institutions have mastered the basics: sanctions screening and PEP checks. These are table stakes. The real fork in the road comes after that first pass. Some customers, by jurisdiction, product, behavior, or profile, are flagged as higher risk. Regulators have been clear: this shouldn’t trigger de-risking by default. It should trigger EDD.

EDD means a deeper, risk-based examination of source of funds and source of wealth, ownership and control, and the network of associates and related entities. This is where the hard work begins. Analysts must answer sharper questions:

• Where did the wealth originate, and does the timeline make sense?
• Do shell companies or nominee structures obscure ownership?
• Who are the ultimate beneficial owners (UBOs), and who are the people around them?
• What does litigation, regulatory action, or adverse media reveal about reputation over time?

Historically, analysts tackled this with open-source searches, document pulls, company registries, and patchwork databases. It was painstakingly slow and in high-stakes onboarding or reviews, “slow” often meant “too late.”

What’s changed: AI, automation, and explainability

The shift isn’t that AI replaces analysts. It’s that AI and automation now take on 70–90% of the assembly work that used to consume analysts’ time.

• Data collection at scale: Modern platforms ingest and normalize data from registries, courts, regulators, and multilingual media across 100+ countries.
• Network mapping: Automated discovery surfaces directors, shareholders, familial ties, business associates, and layered structures. Analysts start with a map instead of a blank page.
• Source-of-wealth narratives: Systems synthesize holdings, roles, assets, and disclosures into structured wealth stories, ready for analyst review.
• Continuous refresh: Reports are no longer static snapshots; they can be regenerated with the latest data.

Speed alone isn’t enough. Credibility is the bigger concern. Two non-negotiables define modern EDD:

1. Grounded citations: Every assertion, an asset, a case, a relationship, must link back to a primary or trustworthy source.
2. Human review: Analysts still make the final calls, applying context and judgment to what automation surfaces.

In short, EDD shifts from assembling data to analyzing meaning.

Governance in the AI era

As adoption grows, governance questions are catching up. Vendor due-diligence questionnaires increasingly ask:

• How do you ensure explainability and prevent hallucinations?
• What guardrails, source lists, and redlining processes are in place?
• How do you log prompts, outputs, and reviewer actions for audit?

Expect these to become standard. Treat EDD the way you treat model risk management: define inputs, document processes, preserve evidence, and measure outcomes. As most of us now know “We trusted the AI” will not satisfy regulators.

Case study: Global retailer with 25,000 suppliers

Consider a retailer sourcing across Southeast Asia, China, and Latin America. With 25,000+ suppliers, every partnership carried reputational and sanctions risk. During one review, Alessa’s EDD partner, RZOLUT,  surfaced a familial link: the counterparty was a nephew of a cabinet minister in a high-risk jurisdiction.

The impact wasn’t just the discovery, it was the explainability. Public records, relationships, and media references were all cited in context. The board could see why the risk mattered, not just what it was.

Operationally, the process didn’t require armies of consultants. It relied on automation, scoped EDD tiers, litigation and regulatory checks, association mapping, and source-of-wealth analysis—delivered at speed.

Beyond banks: why every sector must care

EDD is no longer confined to banks. In many jurisdictions, utilities, telecoms, real estate, and other sectors now face AML and sanctions obligations. These firms often hit two gaps:

• Skills: They lack the AML staffing banks have built over decades.
• Budgets: Few had line items for EDD tooling or outsourced research.

For them, efficiency isn’t optional. Faster turnaround, consistent templates, and tiered scope can mean the difference between staying compliant and stalling in backlog.

What “good” looks like in 2025

Not every EDD need requires the same depth. Many teams adopt a tiered model:

• Self-serve pulls (minutes): Quick source-of-wealth snapshots with citations.
• Standard EDD (24–48 hours): Screening + litigation/regulatory checks + network mapping + structured wealth narrative.
• Extended scope (4–5 days): Complex ownership, deep litigation, associate networks, and richer profiling—work that once took weeks.

*These report turnaround times are not standard. They are possible with new AI driven solutions offered by partners of Alessa like Rzolut.

Integrating EDD without disruption

Successful programs don’t chase a “big bang” transformation. They plug in capabilities step by step:

1. Triggers: Embed “Order EDD” actions directly into sanctions/PEP workflows.
2. Templates: Standardize report structures for consistency.
3. Citations: Keep all sources live and auditable.
4. Review loop: Define what humans verify and how they record judgments.
5. Refresh: Re-run reports when cases stay active.

Even if core platforms aren’t AI-ready today, integrations are getting simpler, allowing teams to start adjacent and move to embedded solutions over time.

Getting started or scaling up

• Define use cases (onboarding, periodic reviews, vendor onboarding, M&A, etc.).
• Right-size tiers. Reserve deep dives for the riskiest cases.
• Codify what counts as “enough” evidence for each scenario.
• Measure outcomes: turnaround time, rework, audit findings, and meaningful escalations.

Above all, remember: EDD is not a checkbox exercise. It’s how institutions stop illicit funds, protect customers, and safeguard the financial system.

The bottom line

EDD has always been essential, but until now it’s been painfully labor-intensive. What’s changed is our ability to do it quickly, consistently, and credibly. Automation does the heavy lifting; analysts apply judgment. That shift transforms EDD from a bottleneck into a strategic advantage.

Whether you’re a global bank, a casino vetting high-rollers, or a retailer managing a vast supplier base, the message is clear: adopt risk-based EDD that goes beyond sanctions and PEPs, demand explainability, insist on human review, and integrate step by step. Done right, EDD becomes not just compliance, but competitive strength.