Know your customer
KYCAlso called customer due diligence, client due diligence
Know your customer is the process a regulated firm uses to identify and verify its customers, understand what they will use the account for and assess their money laundering risk. It applies at onboarding and throughout the relationship. In law it is usually called customer due diligence, and it sits at the centre of every AML regime.
How it works
At onboarding a firm collects a customer's identity details and verifies them against documents, electronic data or digital identity checks. For companies it also identifies directors and beneficial owners. The firm records the purpose of the relationship, screens against sanctions and PEP lists and assigns a risk rating. Higher-risk customers get enhanced due diligence, such as source of wealth checks.
KYC does not stop after the account opens. Firms review files periodically or when events trigger a refresh, and compare activity with what the customer said they would do. Poor KYC is among the most common findings in supervisory enforcement, and many firms now use automated document checks and continuous data feeds to cut onboarding times.
The rules
Recommendation 10 requires identification and verification of customers and beneficial owners, understanding of the relationship's purpose and ongoing due diligence.
Countries, which apply them to regulated firms through national lawRegulation 28 requires firms to identify and verify customers and beneficial owners, assess the relationship's purpose and conduct ongoing monitoring.
Banks, insurers, payment firms, cryptoasset firms and other relevant personsRequires covered institutions to identify and verify beneficial owners of legal entity customers and maintain risk-based ongoing customer due diligence.
Banks, broker-dealers, mutual funds, futures commission merchants and introducing brokersSets directly applicable EU customer due diligence measures, including identification, verification, purpose of relationship and ongoing monitoring, replacing national rules.
Credit and financial institutions and other obliged entities in the EUCommon questions
Is KYC the same as customer due diligence?
In practice the terms overlap. KYC is the industry name for knowing who the customer is. Customer due diligence is the legal term in most AML laws and also covers beneficial owners, the purpose of the relationship and ongoing monitoring.
What documents are used for KYC?
For individuals, firms commonly use a passport, national identity card or driving licence, plus proof of address or electronic checks. For companies, they use registry extracts, constitutional documents and ownership charts, and verify directors and beneficial owners.
How often is KYC refreshed?
Rules require information to be kept up to date but rarely set fixed periods. Many firms review high-risk customers every year and lower-risk customers every three to five years, with event-driven reviews when circumstances change.
What is perpetual KYC?
Perpetual KYC refreshes customer files continuously using data feeds, such as company registry changes or adverse media, instead of waiting for a scheduled review. It aims to catch risk changes earlier and spread the review workload.
