KYC (Know Your Customer)

What it is

Know Your Customer (KYC) is the set of checks a bank or other obliged entity performs to know who it is dealing with. It is the practical side of customer due diligence (CDD), which the law requires. KYC answers four questions:

1. Who is the customer? Identify and verify with reliable documents or electronic identification.
2. Who is behind it? For companies, identify the beneficial owners and the control structure.
3. What is the relationship for? Record purpose, intended nature, expected activity and source of funds.
4. How risky is it? Assign a customer risk rating that sets the depth of checks and the review frequency.

KYC continues after onboarding. Firms monitor the relationship, refresh data periodically and on trigger events, and update the risk rating.

Why it matters

KYC is the first line of defence against money laundering, terrorist financing, sanctions breaches and fraud. Transaction monitoring and sanctions screening only work if customer data are accurate. Weak KYC is one of the most common causes of supervisory fines in Europe. From July 2027 the Anti-Money Laundering Regulation (AMLR) sets one directly applicable EU rulebook for these checks.

Worked example

Illustrative numbers.

A bank onboards 1,000 business customers in a month. Its risk model rates 850 as low risk, 130 as medium and 20 as high.

• Low risk: standard checks, review every 5 years.
• Medium risk: standard checks plus extra data on activity, review every 3 years.
• High risk (for example a politically exposed person as beneficial owner): enhanced due diligence with source of wealth evidence and senior management approval, review every year.

The firm sets these review cycles in its own policy. Over five years the 20 high-risk files generate 100 reviews, while the 850 low-risk files generate 850. Both workloads need staffing.

Who uses it

• KYC analysts collect and verify documents and complete onboarding files.
• Corporate onboarding analysts unwrap complex ownership chains and trusts.
• Periodic review analysts refresh files on schedule and on triggers.
• AML analysts use KYC profiles to judge whether activity is unusual.
• Relationship managers and private banking analysts gather client information and explain requests.

Common confusions

• KYC and CDD are often used as synonyms. CDD is the legal term; KYC is the industry name for the process.
• KYC is ongoing. A file approved at onboarding can become outdated within months.
• Verification of identity is only one part. Understanding ownership, purpose and risk is equally required.
• KYB (know your business) is a common label for KYC on legal entities.
• Simplified due diligence reduces the extent of checks for low-risk cases. It never removes them entirely.