Answer:
There is none. It is best classified as a regulatory expectation based on pure practicality.
The FFIEC Examination Manual makes references that clearly assume a bank has identified its EDD or "higher risk" customers; e.g. how do you do a money laundering risk assessment without identifying the number and types of higher risk customers on your rolls? The new "due diligence" regulation's emphasis on "risk based" analysis underscores the concept. How do you know when to do more monitoring or require more documentation without knowing which customers to focus on?