Enhanced Due Diligence (EDD): When Standard KYC Isn't Enough

What should an EDD file be able to show?

A list of the customers who get enhanced due diligence is easy to produce. Showing why a particular customer got it, when it started, what was checked, who approved the relationship and when it was last looked at again is harder. That second set of answers is what an examiner or independent tester needs from the file, and it's hard to give when the trigger lives in a screening tool, the source-of-wealth evidence sits in a shared drive, the approval is in an email thread and the next review date is in someone's calendar.

Enhanced due diligence software is supposed to close that gap. Before you buy or build any, though, you need a precise answer to two questions. When does the rule actually require EDD, and when does it only depend on your own risk assessment? And what does the file have to record so that someone who wasn't there can follow the decision?

This guide is for MLROs, heads of KYC and compliance leads at banks, payment firms, fintechs and other regulated firms. It sets out the EDD triggers in the FATF Recommendations, the UK Money Laundering Regulations 2017, the US rules for correspondent and private banking accounts, and the EU AML Regulation that applies from July 2027. It then covers the measures those rules list, what an EDD file needs to record, and what to look for in software that handles it. It reflects those texts as they stood on October 20, 2026. It isn't legal advice, and the rules that apply to you depend on your jurisdiction and licence type.

Request the EDD trigger matrix and a shadow-mode run

Start with the free Customer Risk Rating Matrix, an Excel spreadsheet that scores each customer's risk across standard CDD dimensions, assigns a risk tier and shows whether standard or enhanced due diligence applies, so you can write down your triggers and thresholds before you compare tools. If you want to see event-driven review on your own data, we'll run the agent across your book in shadow mode and show you which events it would have caught and which reviews it would have right-sized.

Get the EDD trigger matrix

What is enhanced due diligence, and when is it required?

Enhanced due diligence (EDD) is the extra set of checks you apply on top of standard customer due diligence (CDD) when the money laundering or terrorist financing risk of a customer or transaction is higher. The FATF Recommendations put it simply: where the risks of money laundering or terrorist financing are higher, financial institutions should be required to conduct enhanced CDD measures, consistent with the risks identified. In particular, they should increase the degree and nature of monitoring of the business relationship to determine whether those transactions or activities appear unusual or suspicious.

EDD is therefore a response to a risk finding, not a customer category or a fixed checklist. The rules differ on which findings force it and which measures it has to include, but they share three building blocks:

• a trigger, meaning the fact or event that put the customer in the higher risk group;
• measures, meaning the extra information, approval and monitoring you apply because of it;
• a record that lets someone else check the trigger, the measures and the decision later.

In the UK, regulation 33 of the Money Laundering Regulations 2017 says a relevant person must apply enhanced customer due diligence measures and enhanced ongoing monitoring, in addition to the customer due diligence measures required under regulation 28 and, if applicable, regulation 29, to manage and mitigate the risks arising in a list of cases. That list starts with any case identified as one where there is a high risk of money laundering or terrorist financing, either by the firm's own risk assessment under regulation 18(1) or in information made available to it under regulations 17(9) and 47. It also includes correspondent relationships, PEPs, false or stolen identification documentation and unusual transactions, and it ends with a catch-all: any other case which by its nature can present a higher risk of money laundering or terrorist financing.

In the EU, the AML Regulation (EU) 2024/1624 will set the rule directly. It shall apply from 10 July 2027, except in relation to two categories of obliged entity, to which it shall apply from 10 July 2029. Article 34 requires obliged entities to apply enhanced due diligence measures in the specific cases it lists, as well as in other cases of higher risk that are identified by obliged entities pursuant to Article 20(2), second subparagraph.

The US is different. The bank program rule at 31 CFR 1020.210 requires appropriate risk-based procedures for conducting ongoing customer due diligence, including understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile. The explicit enhanced due diligence requirements in the rules cited here sit in two places: correspondent accounts for certain foreign banks and private banking accounts. For every other higher risk customer, how far you go is set by your own risk-based procedures, so those procedures need to say what moves a customer into EDD and what happens next.

How does EDD differ from standard CDD?

Standard CDD under the FATF standard has four parts: identifying the customer and verifying that customer's identity using reliable, independent source documents, data or information; identifying the beneficial owner and taking reasonable measures to verify their identity; understanding and, as appropriate, obtaining information on the purpose and intended nature of the business relationship; and conducting ongoing due diligence on the business relationship and scrutiny of transactions. EDD keeps all four and asks for more on each, plus a senior sign-off that standard CDD doesn't need under the rules cited here.

The UK rule adds the measures on independent sources in regulation 33(5), and the rest come from the FATF examples and regulation 33(3A). Our answer on the difference between CDD and EDD sets out the standard CDD baseline in more detail.

Which EDD triggers are mandatory, and which come from your risk assessment?

The rules separate fixed triggers from risk factors, and your policy and your software should keep them apart too.

• Mandatory triggers, such as a PEP match or a FATF call for action country, send the customer straight to the EDD decision. The customer risk rating sends a customer to the EDD decision when its score crosses the threshold your policy sets. Transaction monitoring sends an existing customer to the EDD decision when activity is complex, unusually large or has no apparent purpose. The EDD decision sets which EDD measures apply and how far they go. The EDD measures end with senior management approval before the relationship starts or continues.

Some triggers are fixed by the rule. Under the FATF standard, Recommendation 12 applies to foreign politically exposed persons whether as customer or beneficial owner, and Recommendation 19 says financial institutions should be required to apply enhanced due diligence measures to business relationships and transactions with natural and legal persons, and financial institutions, from countries for which this is called for by the FATF. The UK turns those into named cases in regulation 33(1), including a business relationship with a person established in a FATF call for action country and any case where a customer has provided false or stolen identification documentation or information and the firm proposes to continue to deal with that customer. When one of these applies, you don't get to decide whether EDD is needed. You decide how far it goes.

Other triggers are risk factors that feed your own assessment. FATF lists examples such as non-resident customers, legal persons or arrangements that are personal asset-holding vehicles, companies that have nominee shareholders or shares in bearer form, businesses that are cash-intensive and an ownership structure that appears unusual or excessively complex given the nature of the company's business. FATF also says the examples are not mandatory elements of the FATF Standards, and are included for guidance only. The UK rule lists similar factors in regulation 33(6), and then adds a sentence worth copying into any EDD policy: relevant persons must bear in mind that the presence of one or more risk factors may not always indicate that there is a high risk of money laundering or terrorist financing in a particular situation.

A risk factor is an input to your customer risk rating. A mandatory trigger is a case the rule names. Write down which is which, and the threshold that turns one into the other.

That sentence matters for software design. A cash-intensive business isn't automatically an EDD customer under these texts. It's a customer with a risk factor that your customer risk rating has to weigh with the others. The earlier version of this article listed cash-intensive businesses and non-resident customers as automatic triggers. Under the rules cited here they aren't, and a system that hard-codes them as automatic will either push too many low-value files into EDD or train analysts to close EDD reviews without reading them.

The first figure shows how the three kinds of trigger reach one decision. Mandatory triggers, such as a PEP match or a FATF call for action country, send the customer straight to the EDD decision. The customer risk rating sends a customer to the EDD decision when its score crosses the threshold your policy sets. Transaction monitoring sends an existing customer to the EDD decision when activity is complex, unusually large or has no apparent purpose. The EDD decision sets which EDD measures apply and how far they go. The EDD measures end with senior management approval before the relationship starts or continues, wherever the rule or your policy requires it.

Write the split down in your policy:

1. For each mandatory trigger, name the rule it comes from.
2. For each risk factor, say how it is weighted in the customer risk rating.
3. Set the score that sends a customer to EDD, and record who approved it.
4. Test the threshold against a sample of past files and record the result.

Then the threshold is a documented decision rather than an analyst's instinct.

How should PEP status change the review?

PEP rules apply to customers and to beneficial owners, and they differ between jurisdictions more than most EDD triggers do.

• PEP screening produces a possible match that an analyst confirms or clears before it becomes a PEP determination. The PEP determination starts a risk assessment of the customer, which sets how far the enhanced measures go. The risk assessment of the customer decides what evidence of source of wealth and source of funds you need. The source of wealth and source of funds evidence goes to senior management approval with the analyst's assessment. After senior management approval, the relationship moves into enhanced ongoing monitoring until the PEP rules stop applying.

The FATF standard sets four extra steps for foreign PEPs. Financial institutions should have appropriate risk-management systems to determine whether the customer or the beneficial owner is a politically exposed person, obtain senior management approval for establishing (or continuing, for existing customers) such business relationships, take reasonable measures to establish the source of wealth and source of funds, and conduct enhanced ongoing monitoring of the business relationship. For domestic PEPs and people with a prominent function at an international organisation, the last three steps apply in cases of a higher risk business relationship with such persons. The requirements for all types of PEP should also apply to family members or close associates of such PEPs.

The UK rule makes the PEP determination the start of a risk assessment, not the end of one. Under regulation 35, if a firm has determined that a customer or a potential customer is a PEP, or a family member or known close associate of a PEP, it must assess the level of risk associated with that customer, and the extent of the enhanced customer due diligence measures to be applied. Since an amendment to regulation 35, the starting point for a domestic PEP is that the customer or potential customer presents a lower level of risk than a non-domestic PEP. If no enhanced risk factors are present, the extent of enhanced customer due diligence measures for a domestic PEP is less than the extent to be applied in the case of a non-domestic PEP. The core measures still apply to every PEP relationship: senior management approval, adequate measures to establish the source of wealth and source of funds, and enhanced ongoing monitoring.

The UK rule also sets an end point. Where a person who was a PEP is no longer entrusted with a prominent public function, the firm must continue to apply those requirements for a period of at least 12 months after the date on which that person ceased to be entrusted with that public function, or longer if it considers that appropriate. Your software needs to record the date a PEP left office as well as the office they held.

US rules are narrower. For a private banking account for which a senior foreign political figure is a nominal or beneficial owner, the due diligence program shall include enhanced scrutiny of such account that is reasonably designed to detect and report transactions that may involve the proceeds of foreign corruption. Outside that account type, how a US firm treats PEPs is set by its own risk-based CDD procedures.

The second figure shows the PEP review as a sequence. PEP screening produces a possible match that an analyst confirms or clears before it becomes a PEP determination. The PEP determination starts a risk assessment of the customer, which sets how far the enhanced measures go. The risk assessment of the customer decides what evidence of source of wealth and source of funds you need. The source of wealth and source of funds evidence goes to senior management approval with the analyst's assessment. After senior management approval, the relationship moves into enhanced ongoing monitoring until the PEP rules stop applying.

Two details are worth checking in any sample of PEP files. The first is family members and close associates: the UK definition includes a spouse or civil partner, children and their spouses or civil partners, and parents, and close associates include an individual known to have joint beneficial ownership of a legal entity or a legal arrangement or any other close business relations with a PEP. The second is a cleared match with no reasoning. If an analyst decides a screening hit isn't the PEP, the file should say why, in words someone else can check.

Insurers have two more PEP duties in the UK. A firm providing a contract of long-term insurance must take reasonable measures to determine whether a beneficiary of the policy, or the beneficial owner of a beneficiary, is a PEP or a family member or known close associate of a PEP, before any payment is made under the policy or the benefit is assigned. Where the beneficiary is a PEP, senior management must be informed before any sums are paid out, and the whole business relationship with the policy holder is scrutinised on an ongoing basis under enhanced procedures.

What about higher-risk countries and correspondent relationships?

Country triggers come in two strengths. The strong form is a country for which the FATF has called for enhanced measures. Under Recommendation 19 it is mandatory for countries to require financial institutions to apply enhanced due diligence when the FATF calls for such measures to be introduced. The UK rule defines a FATF call for action country by reference to the list of High-Risk Jurisdictions subject to a Call for Action published by the Financial Action Task Force as such list has effect from time to time. The list changes over time, so your software needs to read the current list, not a copy taken when the policy was written.

For that UK trigger, regulation 33(3A) lists the measures in full. They must include obtaining additional information on the customer and on the customer's beneficial owner, obtaining additional information on the intended nature of the business relationship, and obtaining information on the source of funds and source of wealth of the customer and of the customer's beneficial owner. They also include obtaining information on the reasons for the transactions, obtaining the approval of senior management for establishing or continuing the business relationship, and conducting enhanced monitoring of the business relationship by increasing the number and timing of controls applied, and selecting patterns of transactions that need further examination.

The weaker form is a country risk factor in your own assessment. FATF gives examples such as countries identified by credible sources, such as mutual evaluation or detailed assessment reports or published follow-up reports, as not having adequate AML/CFT systems, and countries subject to sanctions, embargos or similar measures issued by, for example, the United Nations. These feed the customer risk rating. They don't trigger EDD on their own unless your policy says they do.

Correspondent relationships carry their own rule. FATF Recommendation 13 says that, in addition to normal customer due diligence, financial institutions should assess the respondent institution's AML/CFT controls and obtain approval from senior management before establishing new correspondent relationships. In the US, a covered financial institution must run a due diligence program for correspondent accounts for foreign financial institutions, and the enhanced procedures apply to any correspondent account maintained for a foreign bank that operates under an offshore banking license, or under a license from a country designated as non-cooperative or as warranting special measures. For those accounts, the enhanced scrutiny shall reflect the risk assessment of the account and shall include, as appropriate, obtaining and considering information relating to the foreign bank's anti-money laundering program and monitoring transactions to, from, or through the correspondent account.

When should transactions trigger EDD on an existing customer?

EDD isn't only an onboarding decision. A customer who was standard risk at onboarding can become an EDD customer years later, and the rules expect you to notice.

• A customer event, such as a new screening hit, an ownership change or activity outside the profile, opens a review with the evidence attached. Every customer event goes into the event log, even when no review is needed. The review checks whether the event changes the risk rating. A higher risk rating reopens the EDD file and its measures. The review ends in an analyst decision to keep, change or exit the relationship.

The FATF standard says financial institutions should examine, as far as reasonably possible, the background and purpose of all complex, unusual large transactions, and all unusual patterns of transactions, which have no apparent economic or lawful purpose. The UK makes the same transactions a named EDD case: a transaction that is unusually complex or unusually large in each case given the nature of the transaction, an unusual pattern of transactions, or transactions with no apparent economic or legal purpose. For those cases, the measures must include, as far as reasonably possible, examining the background and purpose of the transaction, and increasing the degree and nature of monitoring of the business relationship in which the transaction is made to determine whether that transaction or that relationship appear to be suspicious. The EU AML Regulation will require obliged entities to examine the origin and destination of funds involved in, and the purpose of, transactions that are of a complex nature, unusually large, conducted in an unusual pattern or without an apparent economic or lawful purpose.

In the US, the bank rule requires conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information. That obligation is what turns a monitoring alert into a CDD update, and a CDD update into a higher risk rating when the facts justify it.

Existing customers also come back into scope when what you know about them changes. FATF says financial institutions should apply CDD measures to existing customers on the basis of materiality and risk, and conduct due diligence on such existing relationships at appropriate times, taking into account whether and when CDD measures have previously been undertaken and the adequacy of data obtained. This is the idea behind event-driven review, often called perpetual KYC: instead of waiting for the next scheduled date, you reopen the file when something material changes.

The third figure shows how an event reaches the EDD file. A customer event, such as a new screening hit, an ownership change or activity outside the profile, opens a review with the evidence attached. Every customer event goes into the event log, even when no review is needed. The review checks whether the event changes the risk rating. A higher risk rating reopens the EDD file and its measures. The review ends in an analyst decision to keep, change or exit the relationship.

Event-driven review doesn't replace the periodic cycle you have committed to in your policy. It adds a second route in. Our guide to how ongoing due diligence replaces the annual review covers the operating model in more detail, including how to set event thresholds without flooding the team.

What EDD measures are you expected to take?

The rules list similar measures, and they are worth reading side by side, because a tool that only collects the easy items will leave gaps in the file.

FATF's examples of enhanced CDD measures include obtaining additional information on the customer, updating more regularly the identification data of customer and beneficial owner, obtaining additional information on the intended nature of the business relationship, and obtaining information on the source of funds or source of wealth of the customer. They also include obtaining information on the reasons for intended or performed transactions, obtaining the approval of senior management to commence or continue the business relationship, and conducting enhanced monitoring of the business relationship, by increasing the number and timing of controls applied, and selecting patterns of transactions that need further examination.

The UK adds measures that are about the quality of evidence, not just its quantity. Depending on the requirements of the case, the enhanced measures may also include seeking additional independent, reliable sources to verify information provided or made available to the firm, and taking additional measures to understand better the background, ownership and financial situation of the customer, and other parties to the transaction. They may also include taking further steps to be satisfied that the transaction is consistent with the purpose and intended nature of the business relationship.

The EU list from July 2027 follows the same pattern, with one change in wording that matters for software: obtaining information on the reasons for the intended or performed transactions and their consistency with the business relationship. For credit institutions, financial institutions and trust or company service providers, the regulation also adds specific measures for a higher-risk business relationship that involves the handling of assets with a value of at least EUR 5 000 000 through personalised services for a customer holding total assets with a value of at least EUR 50 000 000.

Two things follow for anyone choosing or configuring enhanced due diligence software. First, source of wealth and source of funds are different questions. Source of wealth is how the customer came to have their overall wealth; source of funds is where the money in this relationship or transaction comes from. A form with one free-text box for both makes it hard to show you answered either. Second, the measures are proportionate. FATF asks for measures consistent with the risks identified, so the file should say why this customer got these measures and not others.

What must an EDD file record?

The record-keeping rules set the minimum. FATF says financial institutions should keep all records obtained through CDD measures, account files and business correspondence, including the results of any analysis undertaken, for at least five years after the business relationship is ended, or after the date of the occasional transaction. The words "results of any analysis undertaken" matter. FATF gives inquiries to establish the background and purpose of complex, unusual large transactions as an example. An EDD file that holds documents but not the analyst's reasoning about them doesn't meet that standard.

• The trigger is the first entry in the EDD file, with the date and the source that raised it. Each of the EDD measures taken goes into the EDD file with the evidence behind it. The analyst assessment explains in the EDD file why the evidence does or doesn't support the customer's account of their wealth and funds. The approval goes into the EDD file with the approver's name, date and any conditions. The EDD file sets the next review date and the monitoring that runs until then. The EDD file is kept for the retention period, at least five years after the relationship ends under the FATF standard and the UK rules.

In the UK, regulation 40 requires a copy of any documents and information obtained by the relevant person to satisfy the customer due diligence requirements in regulations 28, 29 and 33 to 37. The period is five years beginning on the date on which the relevant person knows, or has reasonable grounds to believe, that the business relationship has come to an end. After that, the firm must delete any personal data obtained for the purposes of the regulations unless an exception applies, so retention in your system needs an end date as well as a start.

In the US, the beneficial ownership rule for legal entity customers gives a useful model of what a verification record looks like. For verification, the record must include a description of any document relied on (noting the type, any identification number, place of issuance and, if any, date of issuance and expiration), of any non-documentary methods and the results of any measures undertaken, and of the resolution of each substantive discrepancy. Identification records must be kept for five years after the date the account is closed, and verification records for five years after the record is made.

Put together, those rules suggest what a complete EDD file contains. This list is our reading of the sources above, written as a file standard you can test against:

• The trigger: what put the customer into EDD, the date, and where it came from (screening, risk rating, monitoring alert or a named rule).
• The risk assessment of the customer: the rating, the factors behind it and, for PEPs, the assessment of how far the measures go.
• The measures taken: what was requested, from where, and what came back, with independent sources marked as such.
• Source of wealth and source of funds, recorded separately, each with the evidence and the analyst's view of whether it holds together.
• Screening results with each hit's disposition and the reasoning for clearing or escalating it.
• The approval: who approved starting or continuing the relationship, when, and with what conditions.
• The monitoring plan: what enhanced monitoring applies, and the next review date.
• Every later review, with what changed and what was decided, and the date PEP measures can stop if that applies.

The fourth figure shows the file as a record built up over time. The trigger is the first entry in the EDD file, with the date and the source that raised it. Each of the EDD measures taken goes into the EDD file with the evidence behind it. The analyst assessment explains in the EDD file why the evidence does or doesn't support the customer's account of their wealth and funds. The approval goes into the EDD file with the approver's name, date and any conditions. The EDD file sets the next review date and the monitoring that runs until then. The EDD file is kept for the retention period, at least five years after the relationship ends under the FATF standard and the UK rules.

Our EDD checklist for high-risk customers turns these items into a working document. It is organised around risk classification, identity and beneficial ownership verification, source of wealth and source of funds, PEP, sanctions and adverse media screening, ongoing monitoring parameters and senior management approval.

What happens when EDD can't be completed?

Sometimes the customer won't provide the evidence, or the evidence doesn't support their account. The rules expect you to have decided in advance what happens then.

The US rules spell this out for the two account types they cover. The correspondent account program shall include procedures to be followed in circumstances in which a covered financial institution cannot perform appropriate due diligence or enhanced due diligence with respect to a correspondent account, including when the covered financial institution should refuse to open the account, suspend transaction activity, file a suspicious activity report, or close the account. The private banking rule has the same structure.

Your policy should name the same options for every EDD trigger, the time an analyst can wait for evidence, who decides between them and what the file records. That decision is the most sensitive one in the process, and it belongs with the people your policy names. Software can track the deadline, chase the customer and assemble the file, but it shouldn't make the call.

What should enhanced due diligence software do?

An EDD process needs three kinds of tooling: something that collects information (screening, registry and document checks), something that moves work (case management and approvals) and something that watches for change (monitoring and event triggers). Check which of the three a product covers and how it hands work to the others, because a file is only complete when all three feed it.

Here is what to test for, in the order the rules above put weight on them:

Ask for every answer on your own data, not on a demo customer. A product that can't show why one of your customers is in EDD will not be able to show an examiner either.

If you want a structured way to set your triggers before you look at tools, the Customer Risk Rating Matrix gives teams a structured, repeatable method to score each customer's risk level across standard CDD dimensions, assign a risk tier (low, medium, high, or very high), and determine whether standard or enhanced due diligence applies.

Who decides what in EDD?

The rules put the EDD decisions with people. Under the FATF standard, senior management approves PEP relationships and new correspondent relationships, and the UK rules require its approval for PEP relationships and for customers established in FATF call for action countries. The firm assesses how far the measures go for each PEP, and for correspondent and private banking accounts US firms must have procedures for deciding what to do when due diligence can't be completed. Software can help with every step around those decisions, but the decisions themselves stay with the accountable people.

• Customer events from screening, monitoring, documents and ownership records go into the AI agent layer. The AI agent layer opens a pre-filled review file with the trigger, the evidence and what the analyst needs to confirm. The pre-filled review file goes to the analyst, who confirms the facts and proposes the outcome. Where EDD requires it, the analyst sends the case to senior management for approval to start or continue the relationship. The senior management decision and every step before it are written to the audit trail, so an examiner can replay the case.

The fifth figure shows where an AI agent layer fits. Customer events from screening, monitoring, documents and ownership records go into the AI agent layer. The AI agent layer opens a pre-filled review file with the trigger, the evidence and what the analyst needs to confirm. The pre-filled review file goes to the analyst, who confirms the facts and proposes the outcome. Where EDD requires it, the analyst sends the case to senior management for approval to start or continue the relationship. The senior management decision and every step before it are written to the audit trail, so an examiner can replay the case.

Conclusion

EDD is a response to a risk finding, and the rules separate the findings that force it from the ones you weigh yourself. The FATF standard and the UK rules name PEPs, FATF call for action countries, correspondent relationships and unusual transactions, and they expect your own risk assessment to identify the rest. The US rules make EDD explicit for correspondent and private banking accounts and leave the rest to risk-based procedures, and the EU AML Regulation will set the rule directly from 10 July 2027.

Software helps most at the two points the rules lean on: catching the change that should reopen a file, and keeping the trigger, evidence, reasoning and approval in one record. Before you buy any, write down your triggers and thresholds, then ask each vendor to show you why one of your own customers is in EDD.

Ask for a shadow-mode run

Request the EDD trigger matrix and a shadow-mode run

Start with the free Customer Risk Rating Matrix, an Excel spreadsheet that scores each customer's risk across standard CDD dimensions, assigns a risk tier and shows whether standard or enhanced due diligence applies, so you can write down your triggers and thresholds before you compare tools. If you want to see event-driven review on your own data, we'll run the agent across your book in shadow mode and show you which events it would have caught and which reviews it would have right-sized.

Get the EDD trigger matrix

Frequently Asked Questions

About the author

Sahil Kataria

Founder and CEO of FluxForce

Sahil works on secure AI and financial technology for regulated industries. His engineering background spans identity verification, payment security and compliance automation. He has led teams across Africa, the United States, Europe and India.

At FluxForce.ai, his focus is on explainable AI and auditable financial workflows. He writes for banking and compliance teams about the practical decisions behind these systems: how to assess risk, keep controls visible and introduce automation without losing accountability.

View Sahil Kataria author profile →