KYCC (Know Your Customer's Customer)

What Is KYCC?

KYCC, or Know Your Customer's Customer, describes the effort a firm makes to understand the customers of its own customers. It matters most when a firm's direct customer is itself a business that moves money for others, such as a bank in a correspondent relationship, a payment service provider, a marketplace, a payment facilitator or a money services business.

In these models, the firm sees the transactions but did not onboard the people behind them. KYCC is about closing that gap: knowing enough about the end users, and about how the direct customer controls them, to judge whether the relationship exposes the firm to money laundering, fraud or sanctions risk.

KYCC is not usually a requirement to perform full due diligence on every end user. In most cases it means understanding who the underlying customers are as a population, assessing the direct customer's own controls, and looking more closely when the activity suggests something is wrong.

Why KYCC Matters

Business-to-business financial services create layers. A bank serves a payment institution, which serves merchants, which serve consumers. Each layer can hide risk from the one above it. If a payment provider onboards a merchant that is a front for illegal gambling, the funds may flow through the bank's accounts under the provider's name.

Typical risks that KYCC aims to surface include:

• end users in sanctioned or high-risk jurisdictions
• merchants or sub-customers in prohibited or high-risk sectors
• nested relationships, where the direct customer quietly lets other financial institutions use its account
• transaction volumes or patterns that do not match the customer base the direct customer described
• weak onboarding or monitoring by the direct customer, which turns the firm into an unwitting channel

How KYCC Works in Practice

Understanding the Direct Customer's Business

Start with the business model. Who are the direct customer's customers, where are they located, what do they buy or send, and through which channels? A payment provider serving domestic utility payers presents a very different profile from one serving cross-border remittances or online gaming.

Assessing the Direct Customer's Controls

Because the firm relies on the direct customer's due diligence, it should assess how good that diligence is. Common questions cover onboarding standards, sanctions and PEP screening, transaction monitoring, suspicious activity reporting, prohibited business lists and the results of audits or regulatory reviews. Questionnaires, policy reviews, sample testing and on-site visits are all used, depending on the risk.

Monitoring the Flows

What the firm actually sees is the payment data. Monitoring should test whether flows match the expected profile, for example by checking counterparties, corridors, average values and volumes. Originator and beneficiary information that accompanies payments under the Travel Rule and wire transfer rules makes this monitoring possible and is also the basis for screening end users against sanctions lists.

Escalating When Needed

When monitoring raises questions, the firm can send a request for information to the direct customer about specific transactions or end users. Repeated poor answers, or patterns that suggest nesting or prohibited activity, should lead to a review of the relationship.

Red Flags

• the direct customer cannot or will not describe its customer base
• payments to or from parties in sectors the direct customer said it does not serve
• many unrelated end users sharing the same addresses, devices or beneficiaries
• sudden growth that the direct customer's onboarding capacity could not plausibly support
• payment messages with missing or generic originator details

Regulatory Expectations

International standards focus on the direct relationship. FATF Recommendation 13 on correspondent banking expects institutions to understand the respondent's business, assess its AML and CFT controls and, for payable-through accounts, be satisfied that the respondent has carried out due diligence on customers with direct access. FATF guidance on correspondent banking services has clarified that the standards do not require institutions to perform due diligence on their respondents' customers as a general rule, while still expecting them to monitor the relationship and follow up on unusual activity.

National supervisors apply similar thinking to payment providers, acquirers and agent networks: firms are generally expected to understand the risks introduced by their customers' customers and to manage them in line with a risk-based approach, rather than to re-onboard every end user.

Best Practices

• Set out in policy which customer types require KYCC and to what depth.
• Include contractual rights to request information about underlying customers and transactions.
• Screen counterparties visible in payment data, not only the direct customer.
• Review the direct customer's prohibited sector list and check that flows respect it.
• Revisit the assessment when the direct customer launches new products, enters new markets or grows rapidly.

How on8.ai Helps

SmartSanction supports KYCC by screening both direct customers and the end users visible in payment data against sanctions, PEP and risk sources, with bulk screening available for large counterparty files through API and batch. For corporate customers, its ownership and relationship graph applies the OFAC 50 Percent Rule, and each match comes with the reasoning behind it.

Related Terms

• Correspondent Banking
• KYB (Know Your Business)
• Money Services Business (MSB)
• Travel Rule
• EDD (Enhanced Due Diligence)
• Cross-Border Transactions