Know your customer (KYC) is the process by which a bank or other regulated business establishes who its customers are, verifies their identity and builds enough understanding of their activity to judge the risk they present. KYC is a core element of anti-money-laundering and counter-terrorism financing regimes and applies at the start of a business relationship and throughout it.
The term is also used loosely for the identity checks a firm runs when opening an account. Variants describe the same discipline applied to other counterparties, such as know your business (KYB) for corporate clients.
History
Banks have long been expected to know whom they deal with, but formal KYC rules are relatively recent. In 1998 US federal banking agencies proposed a "Know Your Customer" regulation that would have required banks to profile customers' normal activity; it was withdrawn in 1999 after an unusually large volume of public comments, most of them objecting on privacy grounds. After 2001, section 326 of the USA PATRIOT Act led to the customer identification program rules, and FinCEN's 2016 customer due diligence rule added requirements to understand the purpose of accounts and identify the beneficial owners of legal entities. Internationally, customer due diligence is the subject of Recommendation 10 of the FATF standards, which the EU, the UK and most other jurisdictions have written into law.
Components
KYC is usually described as a set of related processes:
- Identification and verification. The firm collects identifying data such as name, date of birth, address and an identification number, and confirms it against documents, databases or electronic sources. Remote identity verification commonly combines document checks with a selfie and liveness test.
- Customer due diligence. Customer due diligence (CDD) adds an understanding of the nature and purpose of the relationship, the expected activity and, for companies, the ultimate beneficial owners.
- Risk rating. Each customer is assigned a risk level based on factors such as occupation, geography, products used and expected volumes.
- Enhanced or simplified measures. Higher-risk customers, including politically exposed persons, receive enhanced due diligence, which may include establishing source of wealth. Lower-risk cases may qualify for simplified due diligence where national law permits.
- Ongoing monitoring. The firm reviews transactions against the customer's profile and refreshes KYC information periodically or when a trigger event occurs.
Sanctions and screening
KYC is closely linked to sanctions screening, which checks customers against government lists such as those maintained by OFAC, and to screening for adverse media. Although sanctions compliance rests on separate legal authority, firms usually run it at the same onboarding step.
KYC in practice
For a retail bank account, KYC may take minutes when automated checks succeed. For a corporate account or a money transmitter seeking a bank partner, it can take weeks and involve ownership charts, licences, financial statements and policy documents. Payment businesses that serve other businesses often need to perform KYC on their own clients and, depending on the arrangement, on those clients' customers. Some firms offer tiered accounts, sometimes described as light KYC, where reduced checks are paired with low transaction limits.
The cost of repeated checks has encouraged shared KYC utilities, reusable digital identity schemes and "perpetual KYC", in which customer data is refreshed continuously from external sources rather than on a fixed review cycle.
Criticism
KYC requirements are criticized for excluding people who lack standard identity documents or a fixed address, a problem the FATF has acknowledged in guidance on financial inclusion. Onboarding friction also raises costs for firms and customers, and the large stores of identity data that KYC creates are a target for data breaches. Stolen and synthetic identities, and increasingly deepfake images, are used to defeat remote verification.