Enhanced Due Diligence (EDD) for Payment Service Providers: Compliance and Automation (2026)

What Is Enhanced Due Diligence (EDD) for Payment Service Providers?

Quick Answer: Payment service providers (PSPs) are obliged entities under EU AMLD6 and UK Money Laundering Regulations 2017, required to apply Enhanced Due Diligence (EDD) to merchants and business clients that present elevated AML/CFT risk. EDD for PSPs covers UBO verification, source-of-funds analysis, sanctions and PEP screening, adverse media review, and enhanced ongoing monitoring — with audit-ready documentation at every step, aligned with FATF Recommendations 10 and 12.

Payment service providers sit at the intersection of financial infrastructure and merchant risk. Unlike banks onboarding a single corporate client, PSPs process hundreds or thousands of merchant applications — each representing a distinct business entity, ownership structure, and risk profile. A gambling operator registered in Malta, a cross-border remittance platform incorporated in a high-risk jurisdiction, or a merchant with an unusually complex holding structure: all are standard cases in a PSP compliance queue, and all can trigger mandatory Enhanced Due Diligence (EDD) obligations under applicable regulation.

The scale challenge is structural. Standard Customer Due Diligence (CDD) works for straightforward low-risk merchants. The moment a merchant falls into a higher-risk category — by industry, jurisdiction, ownership complexity, or transaction pattern — compliance teams must escalate to a more intensive review process. That process requires more data sources, more verification steps, senior management sign-off, and documentation that survives regulatory scrutiny. For PSPs running large merchant portfolios, that escalation volume quickly becomes unmanageable without a structured workflow. For a detailed overview of how Enhanced Due Diligence (EDD) differs from standard CDD, see the Enhanced Due Diligence (EDD) complete guide.

Regulatory Requirements: What Obliges Payment Service Providers (PSPs) to Apply Enhanced Due Diligence (EDD)?

Payment service providers are classified as obliged entities across all major regulatory frameworks — meaning EDD is not discretionary but a legal requirement triggered by specific risk conditions. The core obligations for PSPs come from four overlapping regulatory sources.

EU: AMLD6 and PSD2/PSD3. Under EU AMLD6, PSPs operating in the European Economic Area must apply Enhanced Due Diligence (EDD) to customers in high-risk categories defined by the European Commission, including those linked to high-risk third countries, complex ownership structures, and PEPs. PSD2 and PSD3 layer additional requirements around transaction monitoring and fraud controls that intersect directly with EDD obligations for higher-risk merchant relationships.

UK: MLRs 2017 and PSRs. The UK Money Laundering Regulations 2017 require Enhanced Due Diligence (EDD) for high-risk business relationships, PEPs, and transactions involving high-risk jurisdictions. Payment service providers operating under the FCA's authorisation regime must embed EDD into their onboarding and ongoing monitoring procedures.

Global baseline: FATF Recommendations 10 and 12. FATF Recommendation 10 sets the risk-based framework for when EDD applies; Recommendation 12 mandates enhanced measures for PEPs. The EBA Guidelines on ML/TF Risk Factors provide the operational implementation standard for EU-regulated PSPs, specifying which merchant and customer characteristics elevate risk and require escalated review.

The table below summarises the key obligations by framework:

When Is Enhanced Due Diligence (EDD) Triggered for Payment Service Providers (PSPs)?

Not every merchant in a PSP portfolio requires Enhanced Due Diligence (EDD). The obligation activates when a specific risk factor — or combination of factors — makes standard CDD insufficient to assess and document the relationship. For payment service providers, the trigger landscape is broader than for most financial institutions, because the merchant base is structurally diverse and often cross-border by default.

The seven primary EDD triggers for PSPs:

1. High-risk merchant categories. Gambling and gaming operators, cryptocurrency exchanges, FX and remittance platforms, adult content businesses, pharmaceutical and nutraceutical merchants, and tobacco or firearms retailers are universally treated as elevated-risk under FATF guidance and EBA sector-specific risk assessments. Any of these categories triggers mandatory Enhanced Due Diligence (EDD) at onboarding.

2. High-risk and high-scrutiny jurisdictions. Merchants incorporated in, or operating primarily into, FATF-listed jurisdictions — whether on the grey list or subject to enhanced monitoring — require EDD regardless of the merchant category. The same applies to jurisdictions with weak AML/CFT regimes identified in the European Commission's delegated regulation under AMLD6.

3. Complex or opaque ownership structures. Holding company chains, multi-layer structures with entities across multiple jurisdictions, or structures where the ultimate beneficial owner (UBO) cannot be confirmed from registry data alone — all require Enhanced Due Diligence (EDD) to establish and document actual control.

4. Politically Exposed Persons (PEPs) in ownership or control. If a UBO, director, or senior controlling individual is a PEP or a close associate of a PEP, EDD is mandatory under FATF Recommendation 12 and AMLD6 Article 20, requiring source-of-wealth verification and senior management approval.

5. Adverse media signals at onboarding or during review. Material adverse media — fraud allegations, regulatory sanctions, money laundering investigations — detected during screening escalates the case to EDD regardless of merchant category or jurisdiction.

6. Unusual or inconsistent transaction patterns. Merchants whose transaction volumes, geographies, or counterparty profiles are inconsistent with their declared business activity trigger enhanced monitoring obligations that require EDD-level documentation.

7. Correspondent relationships and payment aggregators. PSPs acting as acquirers for other payment intermediaries — aggregators, sub-merchants, payment facilitators — must apply Enhanced Due Diligence (EDD) at the relationship level, not only at the end-merchant level, where the intermediary itself presents elevated risk.

Top 3 Enhanced Due Diligence (EDD) Pain Points for Payment Service Providers (PSPs)

PSPs face EDD compliance challenges that are structurally different from those of banks or investment firms. The combination of high merchant volumes, cross-border portfolios, and time-sensitive onboarding decisions creates three recurring operational failures that manual EDD processes cannot resolve at scale.

Pain Point 1: Manual EDD creates an onboarding bottleneck that costs revenue.

A PSP onboarding hundreds of merchants per month will escalate a meaningful share of those cases to Enhanced Due Diligence (EDD). Each manual EDD review — pulling registry data across jurisdictions, mapping ownership chains, running sanctions and adverse media searches, writing up findings — takes between 30 and 240 minutes of analyst time and costs $10–80 per case. At scale, that translates directly into delayed merchant activation, lost revenue from merchants who abandon the process, and compliance teams stretched beyond capacity. According to McKinsey, compliance teams already spend up to 85% of their working time on manual reviews — EDD escalations compress that further. For a full breakdown of what manual EDD actually costs, see the EDD cost breakdown.

Pain Point 2: Cross-border merchant portfolios outpace the tools available.

PSP merchant portfolios are inherently cross-border. A single acquiring PSP may onboard merchants incorporated across 30, 50, or 100+ jurisdictions — each with different registry access, different document standards, different languages, and different watchlist coverage requirements. Manual EDD processes built around one or two primary markets break down the moment a high-risk merchant triggers review in an unfamiliar jurisdiction. Analysts resort to ad hoc searches, incomplete registry pulls, and unstructured documentation — producing case files that fail audit standards precisely where regulatory scrutiny is highest.

Pain Point 3: Adverse media screening generates noise, not signal.

Adverse media review is a mandatory component of Enhanced Due Diligence (EDD) for every escalated merchant. In practice, manual adverse media searches on merchant names — especially common business names, names shared across multiple entities, or merchants operating in multiple languages — return results where up to 90% are irrelevant: name collisions, syndicated duplicates of the same article, or outdated allegations with no ongoing regulatory relevance. Analysts spend significant time filtering noise rather than assessing genuine risk. That false positive rate is not a minor inconvenience — it is a systematic drag on EDD throughput that compounds across every case in the queue. For a detailed comparison of manual and AI-assisted EDD performance, see manual vs AI EDD.

How Scoreplex Automates Enhanced Due Diligence (EDD) for Payment Service Providers (PSPs)

Scoreplex is an AI-native Enhanced Due Diligence (EDD) platform built for compliance teams that run high volumes of business reviews across multiple jurisdictions. For PSPs, it replaces the fragmented manual process — separate tools for registry checks, sanctions screening, adverse media, document review — with one structured, evidence-linked workflow that runs each EDD case from trigger to audit-ready report.

The platform covers every component of a PSP EDD review:

Registry and business verification across 140+ jurisdictions. Scoreplex pulls legal entity data, registration status, business activity, and jurisdictional context from official registries across 140+ business jurisdictions — including markets where manual access is slow, document-heavy, or language-restricted. Cross-border merchant cases that would take an analyst hours to piece together manually are resolved in a single workflow pass.

UBO and corporate structure mapping. The corporate structure module maps ownership hierarchies, identifies beneficial owners, and surfaces controlling entities across multi-layer structures. Where registry data is incomplete or contradictory, Scoreplex flags the discrepancy and documents the gap — producing the ownership evidence trail that regulators require.

PEP and sanctions screening against 325+ global watchlists. Every merchant case is screened against OFAC, UN, EU, HMT, and 325+ additional sanctions lists and watchlists, with explainable match logic and source-linked evidence. Screening covers 200+ languages, which matters directly for PSPs with merchant portfolios spanning non-Latin-script jurisdictions. For a deeper look at how AI handles EDD screening end-to-end, see EDD AI agent.

Adverse media analysis with 85% false positive reduction. Scoreplex clusters adverse media results into risk events, deduplicates syndicated copies, and ranks findings by compliance relevance — reducing false positives by 85% compared to manual searches. Analysts review structured risk signals, not raw search output.

Audit-ready case files with evidence-linked outputs. Every EDD review produces a structured case file: registry evidence, ownership charts, screening logs, adverse media findings with source attribution, document validation results, and a due diligence narrative aligned with regulatory documentation standards. Senior management sign-off and ongoing monitoring schedules are built into the workflow.

The operational result: EDD cases that take 30–240 minutes manually are completed in 5–30 minutes with Scoreplex, at a per-case cost of $2–5 versus $10–80 for manual review.

Enhanced Due Diligence (EDD) Automation ROI for Payment Service Providers (PSPs)

The financial case for automating Enhanced Due Diligence (EDD) is direct and measurable. The table below compares the operational cost of manual EDD against AI-automated review across the metrics that matter most to PSP compliance and operations teams.

At 500 EDD cases per month — a realistic volume for a mid-size PSP with an active merchant acquisition programme — the shift from manual to AI-automated review produces more than $219,000 in direct annual savings on analyst time and tooling alone. That figure does not include the downstream revenue impact of faster merchant activation, reduced abandonment during onboarding, or the cost of regulatory findings resulting from incomplete manual case files.

For PSP compliance teams evaluating the full cost picture of their current process, the EDD cost breakdown provides a detailed model across direct and indirect cost components.

---

About Scoreplex

Scoreplex is an AI platform that automates customer due diligence, minimizes false positives, streamlines document verification, and generates comprehensive narrative reports.

How it works: From a single company input, it produces a complete business risk profile, including::

• Official registry checks with UBO identification and full ownership chains
• Global sanctions and PEP screening
• Real-time adverse media monitoring with structured events and source attribution
• Automated document verification (incorporation records, address validation)
• Website analysis and cross-checks of company details, products, contacts, and locations
• Product and customer review analysis (Trustpilot, G2, Google Reviews)
• Social media analysis of corporate accounts and profiles of founders and directors
• High-risk country exposure assessment based on aggregated signals
• A structured risk summary highlighting red flags, rationale, and direct source links

Built for Faster, Smarter KYB Decisions:

• 10× faster reviews through end-to-end automation
• Up to 10× lower costs compared to traditional service providers
• Significantly fewer false positives driven by registry-first matching and transparent risk signals

Book a Demo

---

FAQ: Enhanced Due Diligence (EDD) for Payment Service Providers (PSPs)

Are PSPs legally required to conduct Enhanced Due Diligence (EDD)?

Yes. Payment service providers are classified as obliged entities under EU AMLD6, UK Money Laundering Regulations 2017, and equivalent frameworks in most regulated markets. Where a merchant or business relationship meets a defined risk threshold — high-risk category, complex ownership, PEP exposure, high-risk jurisdiction — Enhanced Due Diligence (EDD) is a legal obligation, not a discretionary measure. Failure to apply EDD where required exposes the PSP to regulatory sanctions, fines, and reputational risk.

Which merchants trigger Enhanced Due Diligence (EDD) for a PSP?

The primary triggers are: merchants in high-risk categories (gambling, crypto, FX, remittance, adult, pharmaceuticals), merchants incorporated in or operating into FATF-listed or high-risk jurisdictions, merchants with complex or opaque UBO structures, merchants where a director or UBO is a PEP, and merchants with adverse media or sanctions exposure identified at onboarding or during periodic review. Unusual transaction patterns inconsistent with declared business activity are an additional trigger during ongoing monitoring.

What does an Enhanced Due Diligence (EDD) review for a PSP merchant involve?

A complete EDD review for a PSP merchant covers: enhanced identity and legal entity verification, UBO mapping across all ownership layers, source-of-funds and source-of-wealth analysis where applicable, sanctions and PEP screening against global watchlists, adverse media review with documented findings, senior management approval, and an audit-ready case file with evidence links and an ongoing monitoring schedule.

How long does Enhanced Due Diligence (EDD) take for a PSP?

Manual EDD takes 30–240 minutes per case depending on ownership complexity, jurisdictions involved, and the volume of adverse media results requiring review. AI-automated EDD platforms such as Scoreplex complete the same scope in 5–30 minutes, reducing per-case cost from $10–80 to $2–5 and producing a structured, audit-ready case file as output.

What regulations govern Enhanced Due Diligence (EDD) for PSPs in the EU and UK?

In the EU, the primary frameworks are AMLD6, the EBA Guidelines on ML/TF Risk Factors, and PSD2/PSD3. In the UK, the Money Laundering Regulations 2017 and the Payment Services Regulations apply. All jurisdictions trace their EDD obligations to the FATF risk-based approach set out in Recommendations 10 and 12, which define when enhanced measures are required and what they must cover.

How does AI reduce the EDD workload for PSP compliance teams?

AI automates the data-gathering, structuring, and initial analysis phases of Enhanced Due Diligence (EDD): registry pulls across 140+ jurisdictions, UBO mapping, sanctions screening against 325+ watchlists, and adverse media clustering with false positive reduction of up to 85%. Analysts receive a structured case file with evidence-linked findings rather than raw data, reducing manual preparation time by up to 80% and enabling compliance teams to handle higher EDD volumes without proportional headcount increases.

What documentation does a PSP need to retain for each Enhanced Due Diligence (EDD) case?

Regulators require: enhanced identity verification records for the entity and UBOs, source-of-funds evidence, a documented UBO ownership chart with supporting registry evidence, sanctions and PEP screening logs with match rationale, adverse media review records with source links, senior management approval records, and an ongoing monitoring schedule with periodic review dates. All records must be retrievable on demand and complete enough to support a regulatory examination without supplementary explanation.