Tiered KYC

Tiered KYC is a way of organizing know your customer requirements so that they are proportionate to what an account can do. A customer who provides minimal information, perhaps only a name and mobile number, receives a basic account with low limits on how much it can hold and move. A customer who supplies identity documents, proof of address or biometric verification moves to a higher tier with larger limits and more services.

The approach is used mainly for mobile money wallets, prepaid instruments and basic bank accounts, and it is most developed in countries where many adults lack formal identity documents. It is an application of the risk-based approach to anti-money laundering, and it is closely linked to policies on financial inclusion.

Standard account-opening rules assume that a customer can produce a government identity document and evidence of where they live. In many low-income countries a large share of the population cannot, particularly rural residents, women and migrants. Applying full requirements to everyone keeps these people unbanked and leaves their transactions in cash, where no monitoring happens at all.

The international standards allow for a different answer. The FATF Recommendations permit simplified due diligence where the risk of money laundering or terrorist financing is demonstrably lower, and guidance from the Financial Action Task Force on financial inclusion describes tiered accounts as one way to do this. The reasoning is that a product with tight limits is of little use for moving criminal proceeds, so less verification is acceptable. As limits rise, so does the potential for abuse, and verification must rise with it.

Schemes differ in detail but share a structure.

• Entry tier. The customer registers remotely or at an agent with basic details. Some regimes accept a phone number verified against the telecom operator's registration records, or a letter from a local official. The account has a low maximum balance and low daily and monthly transaction caps, and may be restricted to domestic use.
• Middle tier. The customer presents an identity document, which is checked against a government database where one exists. Limits are raised to cover typical household and small business needs.
• Full tier. The customer completes standard customer due diligence, including address verification and, in many countries, a face-to-face or video check. The account has high or no regulatory limits and access to the full range of services, such as international transfers.

The limits attached to each level are usually set by the central bank and expressed as a maximum balance, a single transaction cap and cumulative caps per day or month. Providers build these into their systems as wallet limits, and the level assigned to each customer is often called the wallet KYC level. When a customer approaches a ceiling, the app prompts them to upgrade by submitting more information.

Mexico introduced a four-level system for bank accounts in 2011, in which the lowest level could be opened without identification and carried strict monthly deposit limits. The Central Bank of Nigeria adopted a three-tiered framework in 2013 for bank accounts and mobile money, with the lowest tier requiring only basic customer information.

In India, the Reserve Bank of India distinguishes prepaid wallets issued on minimum details, which have a small monthly loading limit and restricted functions, from full-KYC wallets that can hold more and send funds to bank accounts. The State Bank of Pakistan defines several levels of branchless banking account with graduated limits, verified against the national identity database. Kenya, Tanzania, Ghana and other mobile money markets apply similar structures.

The same logic appears in developed markets under other names. European anti-money laundering law has long exempted low-value electronic money products from full verification, and the Fifth Anti-Money Laundering Directive narrowed that exemption by lowering the thresholds.

Low-tier accounts are not risk-free. Because they are easy to open, criminals can open many of them, or recruit others to do so, and spread funds across them in small amounts, a pattern related to smurfing. Accounts opened with weak identification are attractive to a money mule network and to fraudsters who need somewhere to receive stolen funds.

Regulators and providers address this in several ways. Rules usually limit each person to one entry-level account per provider. Limits are enforced on cumulative activity, not only on single transactions. Transaction monitoring applies to every tier, and unusual patterns lead to restrictions or a request to upgrade. Where digital identity systems exist, even the lowest tier can be tied to a verified identity at low cost, which reduces the trade-off between access and assurance.

Tiered schemes depend on limits being set sensibly. If the lowest tier is too restrictive, customers find the account useless and return to cash. If it is too generous, it invites abuse. Upgrading can be a barrier in itself when it requires travel to a branch or documents the customer does not have, so many accounts remain at the lowest level indefinitely.

There are operational costs as well. Providers must maintain several onboarding flows, track cumulative limits accurately and re-verify customers when rules change. Regulators have at times tightened lower tiers sharply in response to fraud, forcing providers to restrict or close large numbers of accounts at short notice.

• Financial Action Task Force