KYC
Know Your Customer — the process of verifying the identity of customers and assessing their risk profile to prevent fraud, money laundering, and terrorist financing.
Know Your Customer (KYC) is the process by which financial institutions and regulated entities verify the identity of their customers, assess the nature of the customer relationship, and evaluate the risk of financial crime associated with each customer. KYC is a foundational AML requirement mandated by the Bank Secrecy Act and enforced by FinCEN, financial regulators, and card networks globally.
The KYC process encompasses three main components: Customer Identification Program (CIP) — collecting and verifying identifying information (name, date of birth, address, government ID) for individual customers; Customer Due Diligence (CDD) — understanding the purpose of the account and anticipated transaction patterns; and Enhanced Due Diligence (EDD) — additional scrutiny for high-risk customers (PEPs — Politically Exposed Persons, customers from high-risk jurisdictions, complex ownership structures).
For business customers (B2B KYC), verification extends to the entity itself (legal name, incorporation documents, EIN) and its Ultimate Beneficial Owners (UBOs) — individuals owning 25% or more of the entity — per FinCEN's Beneficial Ownership Rule. Effective May 2018, this requires collecting beneficial ownership certifications from all legal entity customers opening accounts.
Digital KYC has transformed onboarding in fintech. Traditional paper-based identity verification has been replaced by: government ID document verification (AI extracts and validates information from ID images), biometric verification (selfie liveness checks matching the user to their ID photo), and database cross-referencing (against sanctions lists, PEP databases, adverse media, and court records). Companies like Jumio, Persona, Socure, and Onfido provide KYC infrastructure-as-a-service.
KYC failures carry severe penalties. In 2023 alone, banks globally paid over $6 billion in AML/KYC-related fines, with failures including inadequate customer identification, poor suspicious activity monitoring, and lax UBO verification.
FAQs
How often must KYC be refreshed?
KYC is not a one-time event — it requires periodic refresh based on customer risk rating. High-risk customers (PEPs, high-value accounts, complex structures) should be reviewed annually. Medium-risk every 2–3 years. Low-risk every 3–5 years. Event-driven refresh is also required when suspicious activity is detected, when customer information changes materially, or when the customer relationship scope changes significantly.
What is eKYC and how is it different from traditional KYC?
eKYC (electronic KYC) uses digital identity verification — document scanning, biometric matching, database lookups, and AI analysis — to verify customer identity without requiring physical presence or paper documents. eKYC can be completed in seconds vs. days for traditional KYC, enabling digital onboarding at scale. Regulatory acceptance of eKYC varies by jurisdiction; most developed markets now explicitly permit it.
What is a Politically Exposed Person (PEP) and why does it matter for KYC?
A PEP is an individual who holds or has held a prominent public function — government officials, senior politicians, military officers, state-owned enterprise executives, and their immediate family and close associates. PEPs pose higher money laundering risk because their positions may provide opportunities for corruption. PEPs require Enhanced Due Diligence, including source of wealth and funds verification and closer ongoing monitoring.
Related Terms
AML
Anti-Money Laundering — a framework of laws, regulations, and procedures designed to prevent criminals from disguising illegally obtained funds as legitimate income.
GDPR Compliance
Adherence to the EU's General Data Protection Regulation, governing how organizations collect, store, process, and transfer personal data of EU residents.
Audit Trail
A chronological record of all user actions, system events, and data changes in a financial system, providing a traceable history for auditing and investigation.
Internal Controls
The policies, procedures, and practices designed to safeguard assets, ensure financial accuracy, prevent fraud, and promote operational efficiency.
