CDD passport · the nine-state lifecycle

/ 01What a CDD passport is

Customer Due Diligence — the regulated process of identifying clients, beneficial owners, source of funds, and risk classification — produces evidence: identity documents, ownership confirmations, sanctions screening results, signed declarations. Traditionally each firm or department collects these independently.

A CDD passport is a single Fieldbook that holds the entire evidentiary record for one client, structured around a controlled vocabulary of document types. It can be exposed selectively to other firms and partners, verified independently, and revoked.

Four levels of detail

Simplified — 10 document types · low-risk individuals
Standard — 25 types · normal business relationships
Enhanced — 40+ types · higher risk, PEPs
Full — 70+ types · maximum due diligence

/ 02The nine states

/ 01CreatedEmpty passport instantiated

/ 02CollectionMandatory documents being gathered

/ 03ReviewAll mandatory documents present, awaiting verification

/ 04CertifiedVerified and signed

/ 05ActiveIn use; expiry monitoring on

/ 06RenewalApproaching expiry; replacement collection in progress

/ 07RecertifiedRenewal complete; back to Active on apply

/ 08ExpiredGrace period elapsed; not usable

/ 09BrokenIntegrity failure or revocation

/ 03Transitions

Transitions are driven by named LifecycleEvents. Each emits an audit entry; the chain is verifiable end-to-end.

Event	From → To
`DocumentUploaded`	Created → Collection
`AllMandatoryCollected`	Collection → Review
`AllMandatoryVerified`	Review → Certified
`Certified`	Certified → Active
`DocumentExpired`	Active → Renewal
`ReplacementVerified`	Renewal → Recertified → Active
`GracePeriodExpired`	* → Expired
`IntegrityFailure`	* → Broken

/ 04Attestation

Each verified document carries a signed attestation: who verified it, when, what file (by hash), and how.

pub struct AttestationStatement {
    pub verifier_name: String,
    pub verifier_email: String,
    pub verifier_role: String,
    pub document_fingerprint: DocumentFingerprint,   // SHA-256, type, size, pages
    pub verification_type: String,                  // in_person | video | document_only
    pub verified_at: String,
    pub signature_method: String,                   // "HMAC-SHA256"
    pub signature: String,                          // hex-encoded HMAC
}

The HMAC is computed over the canonical JSON of the statement (excluding the signature field) with the firm's signing key. Verification:

pub fn verify_attestation(s: &AttestationStatement, key: &[u8]) -> bool

/ 05Expiry monitoring

Each document type has a default validity period (passport: 10 years; bank statement: 90 days; UBO confirmation: 12 months). The passport carries an aggregate expiry, computed as the earliest mandatory-document expiry.

Severity	Timeframe
`Expiring90`	90 days out
`Expiring30`	30 days out
`Expiring7`	7 days out
`Expired`	Past expiry
`Critical`	Overdue + high-risk client

/ 06Cryptographic guarantees

Document integrity — every file fingerprinted with SHA-256 at upload; tampering detected on every read
Attestation signed — HMAC-SHA256 over canonical JSON; verifiable without trusting the host
Chain anchored — passport oplog + audit periodically anchored externally (RFC 3161 + customer witness; see disclosure ladder)
Replay-resistant — exposure tokens carry expiry and recipient identity in the signed payload

The CDD passport, rung by rung.