Know your customer or know your client (KYC) laws, regulations and guidelines in financial services require regulated businesses and professionals to verify the identity of a customer, and the suitability and risks involved with maintaining a business relationship with them. These procedures fit within the broader scope of anti-money laundering (AML) and counter terrorism financing (CTF) regulations.
KYC processes are also used by companies of all sizes to determine whether their proposed customers, agents, consultants, or distributors are anti-bribery compliant and are who they claim to be. Banks, insurers, export creditors, and other financial institutions are increasingly required to make sure that customers provide detailed due-diligence information. Initially, these regulations were imposed only on financial institutions, but regulations now apply in many countries to fintech, virtual assets dealers, non-financial industries, and non-profit organizations.
Requirements AML/CFT legislation strengthens the prevention of and the fight against money laundering, its predicate offences and terrorist financing. It places legally binding obligations on sectors exposed to the risk of money laundering or the financing of terrorism to monitor their customers and transactions, and to report suspicious activities to governments.
In the European Union these sectors are described as obliged entities, whereas in the United States the term covered institutions is used.
Obliged entities are required to identify and assess the risks of money laundering and terrorist financing to which they are exposed. This business-wide risk assessment must be kept up-to-date. To manage these risks and comply with relevant AML legislation, obliged entities must have internal policies, procedures and controls in place. This includes applying Customer Due Diligence (CDD) measures and may require Enhanced Due Diligence (EDD) checks for certain categories of customers or transactions.
The US Financial Crimes Enforcement Network (FinCEN), a bureau of the US Department of Treasury, which is tasked with safeguarding the financial system from illicit activity, set out the core elements of CDD:
Customer identification and verification, Beneficial ownership identification and verification, Understanding the nature and purpose of customer relationships to develop a customer risk profile, and Ongoing monitoring for reporting suspicious transactions and, on a risk-basis, maintaining and updating customer information.
KYC encompasses a set of practices to verify business clients. These include verification of registration credentials, location, the UBOs (Ultimate Beneficial Owners) of that business client, etc. Also, the business client is screened against blacklists and grey lists to check if they are in involved in any sort of criminal activity, e.g. money laundering, terrorist financing or corruption. KYC is significant in identifying fake business entities and shell companies.
The main categories of Know-Your-Customer requirements of CDD, along with the need for additional checks for high risk clients have been set out in the United States in the Financial Industry Regulatory Authority (FINRA) Rule 2090, which states that financial institutions must use reasonable diligence to identify and retain the identity of every customer and every person acting on behalf of those customers. In enforcing this rule, these organizations are expected to collect all information essential to knowing their customers. Information deemed necessary for enforcing know your customer requirements include the Customer Identification Program (CIP), Customer Due Diligence (CDD), and Enhanced Due Diligence (EDD). To fulfill the requirements set out by FinCEN in the 2016 CDD Rule, these checks should be supported by an on-going monitoring programme.
Customer Identification Program (CIP) An AML/CFT Customer Identification Program (CIP) is a legally mandated framework requiring financial institutions to verify the identity of any person or entity opening a new account. It is the foundation on which the broader KYC framework, to prevent money laundering and terrorist financing, is built. It ensures that regulated entities can identify and verify their customers before granting them access to the global financing system.
In the USA, section 326 of the USA Patriot Act requires banks and other financial institutions to have a CIP. This act requires financial institutions to, as a minimum, verify the identity of anyone looking to open an account, maintain records of this information, and verify if this person is on the list of known or suspected terrorists that financial institutions are provided by the U.S government. Financial institutions must collect four pieces of identifying information about its customers including:
Name Date of birth Address Identification number The FinCEN 2004 CIP Rule provides interpretative guidance with respect to the CIP obligations set out in the USA Patriot Act. The rule mandates that financial institutions implement a written risk-based Customer Identification Program. The program must ensure that: financial institutions are able to form a reasonable belief that they know the true identity of every customer; collect minimum data as specified in the USA Patriot Act; verify the identity of the prospective customer within a reasonable time; check watchlists of suspected terrorists; and give customers adequate notice that the financial institution is confirming their identity. Financial institutions must also retain information for five years after an account is closed.
Under its AML/CFT regulatory framework, the European Union imposes similar requirements on obligated entities. Specifically, they should obtain name, address, date of birth, nationality and ID documentation for individuals and corporate name, registered address, proof of incorporation and ultimate beneficial ownership information for legal entities.
Customer Due Diligence (CDD) Customer Due Diligence (CDD), a KYC process that is part of AML/CFT legislation, requires financial institutions to verify a clients' identity, understand the nature and purpose of a relationship, assess financial crime or terrorist financing risk, and report suspicious transactions. Financial institutions are obligated to monitor the risk level of clients throughout the lifecycle of the relationship.
In the USA, the Bank Secrecy Act, the common name for the Currency and Foreign Transaction Reporting Act of 1970 and its amendments and other statutes, established the legal basis for the 2016 CDD rule issued by FinCEN as part of an effort to improve financial transparency and deter money laundering. The rule expanded existing CDD obligations to include beneficial ownership information and clarified the requirements to understand the nature and purpose of a business relationship, to develop a risk profile and to report suspicious transactions. It also emphasised the importance of risk-based procedures for on-going CDD monitoring of their clients by financial institutions, including up-dating customer risk profiles when significant changes occur, such as beneficial ownership or new patterns of activity. The CDD rule enhanced CDD requirements for "U.S. banks, mutual funds, brokers or dealers in securities, futures commission merchants, and introducing brokers in commodities." The CDD rule requires that financial institutions identify and verify the identity of customers associated with open accounts. The CDD rule has four core requirements:
Identify and verify the identity of customers Identify and verify the identity of the beneficial owners of companies opening accounts Understand the nature and purpose of customer relationships to develop customer risk profiles Conduct ongoing monitoring to identify and report suspicious transactions, and on a risk basis, to maintain and update customer information
Beneficial owner information is required for any individual who owns 25 percent or more of a legal entity and an individual who controls the legal entity.
CDD obligations for financial institutions operating in the European Union are set out in the 2024 AML Regulation. This consolidated and expanded the requirements included in the five AML Directives, and created a single, centralised rule book.
In the European Union, obligated entities must apply CDD measures when: establishing a business relationship; carrying out occasional transactions of at least €10,000; participating in a legal arrangement; there are suspicions money laundering; or when there are doubts about the accuracy of previously obtained information. The following CDD measures must be carried out in the European Union
Identify and verify customers Identify and verify beneficial owners and ownership structures Assess and understand the purpose and intended nature of the business relationship or occasional transactions Verify whether the client is targeted for financial sanctions Assess the nature of the customers' business Conduct on-going monitoring of the relationship and transactions, and ensure that they are consistent with the knowledge of the customer and of the source of funds Determine whether the customer is a Politically Exposed Person
If an obligated entity in the European Union is unable to apply CDD measures, then it must refrain from carrying out the transaction or establishing a business relationship. It should also terminate existing business relationships when CDD obligations cannot be met.
Enhanced Due Diligence (EDD) Enhanced Due Diligence is required when initial identity checks have been completed and high-risk factors have been identified for an individual or a business. These measures may be needed based upon factors such as the jurisdiction the customer is based in, the products they are using, or the nature of the customer. When these requirements have been met "enhanced" or additional due diligence above and beyond CDD is conducted which identifies the following information:
Source of wealth and funds check Additional identity research Risk identification and assessment Nature of the client Details of company background and activities Director and shareholder information The formal concept of additional CDD obligations for certain categories of higher risk customers or transactions was established by the USA Patriot Act of 2001. This established mandatory Enhanced Due Diligence (EDD) obligations. It required US financial institutions to maintain additional rigorous screening for foreign banking accounts, offshore jurisdictions and correspondent banking relationships to combat terrorist financing. FinCEN set out the formal obligations needed to fully implement EDD in a 2007 rule. Requirements to undertake EDD checks and monitoring for higher risk business relationships, customers and transactions were included in the FATF's Forty Recommendations in 2003.