KYC (Know Your Customer)

What Is KYC?

Know Your Customer (KYC) is the set of processes a financial institution uses to establish who its customer is, to understand the nature and purpose of the relationship, and to keep that understanding up to date. At its core, KYC answers two questions: is this person or business who they claim to be, and does the relationship make sense given what we know about them?

KYC is a legal requirement for banks, payment institutions, e-money issuers, virtual asset service providers, money services businesses and many other regulated businesses. In practice the term is used both narrowly, for identity verification at onboarding, and broadly, as shorthand for the whole customer due diligence framework from onboarding to exit. When the customer is a company, the same principles are applied under the name KYB (Know Your Business).

Why KYC Matters

Criminals need access to the financial system to place, move and use illicit funds. KYC is the first barrier. If an institution does not know who controls an account, it cannot detect when that account is used for laundering, fraud, sanctions evasion or terrorist financing.

KYC also underpins most other controls:

• Sanctions and PEP screening depend on accurate names, dates of birth and nationalities.
• Transaction monitoring compares activity to the customer's expected behavior, which comes from KYC information.
• Suspicious activity reporting relies on being able to identify the people involved.
• Fraud prevention depends on stopping fake and stolen identities at the door.

Failures in KYC are among the most common findings in regulatory enforcement against financial institutions, and they also carry direct commercial cost through fraud losses and lost banking relationships.

The Components of KYC

Customer Identification and Verification

The institution collects identifying information, typically full name, date of birth, address and an identification number, and verifies it against reliable, independent sources. Verification may use identity documents, electronic data sources, biometric comparison with a document photo, or a combination. For legal entities, it covers the registered name, registration number, address, legal form and the people who control it.

Beneficial Ownership

For legal entities and arrangements, the institution identifies the natural persons who ultimately own or control the customer and takes reasonable measures to verify their identity. This prevents criminals from hiding behind companies, trusts and nominees.

Purpose and Intended Nature of the Relationship

The institution understands why the customer wants the account or service and what activity to expect, such as the type and volume of transactions, the countries involved and the source of funds.

Risk Assessment

Information gathered at onboarding feeds a customer risk rating. Lower-risk customers may qualify for simplified measures where the law allows, while higher-risk customers, including many politically exposed persons and customers linked to high-risk jurisdictions, require enhanced due diligence.

Ongoing Due Diligence

KYC does not end at onboarding. Customer information is refreshed on a risk basis and in response to trigger events, and activity is monitored for consistency with the customer's profile.

Regulatory Expectations

FATF Recommendation 10 sets the international standard for customer due diligence, including identifying and verifying the customer and beneficial owner, understanding the purpose of the relationship and conducting ongoing due diligence. Recommendation 12 adds enhanced measures for politically exposed persons.

In the European Union, CDD requirements have been set by the AML Directives, starting with the consolidated framework in Directive (EU) 2015/849, and are now carried into the directly applicable AML Regulation (EU) 2024/1624. In the United Kingdom, the Money Laundering Regulations 2017 set out CDD, simplified and enhanced due diligence, and ongoing monitoring duties. In the United States, banks and other covered institutions must operate a Customer Identification Program under rules implementing section 326 of the USA PATRIOT Act, and FinCEN's Customer Due Diligence Rule requires covered institutions to identify and verify beneficial owners of legal entity customers and to conduct ongoing monitoring.

All of these regimes take a risk-based approach: the depth of KYC should match the risk the customer presents.

Common Challenges

• Friction versus control. Every extra step at onboarding loses some genuine customers, while weak checks admit fraudsters. Risk-based flows that ask for more only when needed help balance the two.
• Synthetic and stolen identities. Fraudsters combine real and invented data or use stolen documents, which simple data checks may not catch.
• Document forgery and deepfakes. Remote onboarding requires checks on document authenticity and on the liveness of the person presenting it.
• Stale records. Information collected years ago may no longer be accurate, weakening screening and monitoring.
• Complex ownership. Layered corporate structures across several jurisdictions make beneficial ownership hard to establish.

How on8.ai Helps

Pre-KYC checks email, phone, IP risk, VAT numbers, velocity and bots before onboarding begins. Passporter, currently in development, reads and verifies identity documents, including e-passport chip verification to ICAO 9303, with images processed by on8's own models rather than sent to the cloud. SmartSanction adds sanctions, PEP and risk screening, with an ownership graph for KYB.

Related Terms

• CDD (Customer Due Diligence)
• EDD (Enhanced Due Diligence)
• KYB (Know Your Business)
• UBO (Ultimate Beneficial Owner)
• Liveness Detection
• Synthetic Identity Fraud