Know Your Customer
What is Know Your Customer (KYC)?
Know Your Customer (KYC) is the regulated process of verifying a customer's identity before opening an account and monitoring that relationship for as long as it lasts. Financial institutions and other obliged businesses run KYC to confirm customers are who they claim to be, and to keep proceeds of crime out of the financial system.
KYC is the operational core of an program. It combines identity checks at onboarding, a documented risk rating for each customer, and ongoing transaction monitoring, so the picture built on day one gets revisited whenever behaviour shifts. The same checks that block money laundering also surface rings reusing stolen identity documents and accounts opened to move funds for .
Regulators treat KYC as a licensing matter rather than paperwork. An institution that can't evidence who its customers are is treated as unable to control its own risk, which is why supervisors examine KYC files directly rather than accepting a policy document as proof.
Key requirements
Specific obligations are set by national law, but supervised firms are consistently expected to cover:
- Identity verification. Full name, date of birth, and address, checked against a government-issued identity document or an equivalent electronic source.
- Proof of address. A utility bill, bank statement, or registry record confirming where the customer actually lives.
- Beneficial ownership. For business customers, the natural persons who ultimately own or control the entity. This runs as alongside individual KYC.
- Sanctions and watchlist screening. Screening against sanctions lists, and identifying politically exposed persons who need enhanced due diligence.
- Customer risk rating. A documented assessment covering geography, product, channel, and expected activity, which sets how closely the account is monitored.
- Ongoing monitoring. Transaction review against the expected profile, periodic refresh of identity data, and record retention for the period national law specifies.
Enhanced due diligence applies where the risk rating is high: more evidence, source-of-funds checks, and senior sign-off before the relationship opens.
Who it applies to
KYC obligations fall on regulated financial firms rather than on merchants generally. In scope are banks, e-money and payment institutions, , crypto asset service providers, lenders, insurers, investment firms, and in most markets gambling operators. platforms inherit the same duties through their sponsor bank.
The legal basis differs by market. In the United States, the Bank Secrecy Act and Section 326 of the USA PATRIOT Act require a Customer Identification Program with minimum identity verification standards. In the European Union, the anti-money laundering directives set equivalent duties for obliged entities. Both regimes follow the Financial Action Task Force (FATF) standards that most national frameworks are written against.
An online merchant is usually on the receiving end of these checks. When a business signs with an acquirer, a PSP, or a , the onboarding file it completes is that provider's KYC and KYB obligation being discharged.
Penalties for non-compliance
- Supervisory fines. Imposed on the institution, with amounts set by the national supervisor under its own penalty framework.
- Licence conditions or withdrawal. Supervisors can cap onboarding, force a business line to close, or revoke authorisation outright.
- Personal liability. Named compliance officers and directors face individual fines and, in several jurisdictions, prohibition from holding regulated roles.
- Remediation orders. A back-book review that requires re-verifying every existing customer file, usually under an external monitor and at the firm's expense.
- Loss of banking access. Correspondent banks and acquirers exit relationships with firms under AML enforcement, which removes the payment rails the business runs on.
