KYC requirements for financial institutions help banks and other financial services organizations verify customer identities, assess risk, and meet applicable anti-money laundering (AML) obligations. An effective Know Your Customer (KYC) program combines customer identification, risk-based due diligence, and ongoing monitoring throughout the customer relationship.
The main goal of KYC is to start this verification process from the very beginning and maintain it throughout the relationship. The effort begins when a company onboards new clients and then progresses to ongoing monitoring of financial transactions to identify any suspicious activity.
KYC regulations protect both the customer and the financial industry from being victimized by financial crimes and other types of fraud.
What Are the KYC Requirements for Financial Institutions?
KYC requirements for financial institutions generally involve three core components:
-
- Customer Identification Program (CIP): Verify a customer’s identity using appropriate identifying information and documents.
- Customer Due Diligence (CDD): Assess customer risk and, where applicable, identify beneficial owners.
- Ongoing Monitoring: Review customer activity to identify suspicious transactions and changes in risk.
The specific requirements depend on the institution, its customers, and the applicable jurisdiction.
What Are KYC and AML?
AML refers to the steps financial service companies take to prevent financial crimes — especially money laundering — from occurring on their watch. These steps are not optional since the 1970 Bank Secrecy Act, and more recent legislation dictates that these companies work to prevent clients from “washing” their illegal earnings through a legitimate business or individual account. These laws are meant to stop drug cartels, terrorist cells and other criminal organizations from hiding their ill-gotten gains.
KYC is perhaps the most important part of AML, since it requires financial services companies to verify customer identity and monitor their risk to prevent financial crime. These efforts begin at the customer onboarding stage when these businesses demand documentation of identity, verifying that these new customers are authentic and legitimate.
AML and KYC are both meant to prevent financial institutions from unwittingly facilitating criminal activity like terrorist financing, drug and human trafficking, and fraud.
What Are Typical KYC Processes?
Although each company may customize its KYC process, there are three required components:
- Customer Identification Program
- Customer Due Diligence
- Ongoing Monitoring
Customer Identification Program (CIP)
The CIP is the first step in KYC and begins when a customer signs up for an account. It’s also known as the onboarding process. At this stage, the financial company is collecting customer information and KYC documents so it can complete verification and authentication.
The verification process includes the following:
- Collecting customer name, date of birth and address.
- Collecting identity documents like passports, driver’s licenses, voter identity cards and even selfies for biometric verification.
- Verifying this information against public databases and other consumer reporting agencies.
KYC Documents Needed for CIP
The following documents are used for CIP:
For individuals:
- Driver’s license
- Passport
- Other government-issued IDs with photo
For businesses:
- Business license
- Business incorporation documents
In general, you can use the following for proof of address:
- Utility bill
- Voter’s ID card
- Insurance card
- Mortgage or lease agreement
You may also be asked to provide a biometric ID, such as a selfie, retina scan, fingerprints or voice recognition.
Customer Due Diligence (CDD)
Customer due diligence is another pillar of KYC and AML. CDD is a risk management strategy tailored to individual clients depending on their financial risk level. Customer risk is determined by several factors, including a potential customer’s appearance on a sanctions list, something that is especially pertinent at the moment due to global sanctions on Russia.
Other risk considerations include determining whether the customer is a politically exposed person (PEP), is on a watchlist, operates from high-risk locations or uses high-risk products.
A company’s risk assessment of the client will then place them in one of three levels of customer due diligence, which determines the KYC checks that will be performed:
-
- Simplified due diligence is a lesser level of scrutiny for companies with a low or almost non-existent risk profile for money laundering.
- Basic due diligence requires an ID of the customer based on a reliable and independent source as well as an analysis of the nature of the business.
- Enhanced due diligence (EDD) is aimed at high-risk individuals and requires information on the source of funds, the nature of the business relationship and transaction purpose.
Financial institutions can apply enhanced due diligence (EDD) by collecting additional customer information, verifying the source of funds or wealth where appropriate, reviewing beneficial ownership, and increasing monitoring based on the customer’s risk profile. The specific measures depend on applicable regulations and the level of risk identified.
A risk-based approach helps financial institutions assess potential risks associated with customers and business relationships. Risk assessment methodologies may consider customer identity, beneficial ownership, transaction patterns, geographic exposure, and other relevant factors. Based on the results, institutions can apply enhanced due diligence to high-risk customers and adjust monitoring measures according to their risk profiles.
Ongoing Monitoring
To fulfill KYC, financial services companies must practice ongoing monitoring, particularly for customers with a high-risk profile. After the initial customer ID and due diligence processes are complete, they must perform ongoing AML screening and create a plan that monitors financial transactions to ensure that transaction patterns look normal.
If any customer’s transactions exhibit spikes, cross-country transactions or other unusual activity, they will require additional checks to prove that the activity was property authorized by the true user of the account and is not fraudulent or money laundering activity.
If the financial institution notices such activity, it must file a suspicious activity report (SAR). For example, U.S. companies must use the BSA E-Filing System within 30 or 60 calendar days (depending on the circumstances) of the initial awareness of the suspicious activity.
KYB: KYC for Business
Know Your Business (KYB) is an extension of KYC aimed at business suppliers or partners. Just as companies need to vet individuals before allowing them to open a bank account or invest through their platform, companies also need to vet the other businesses they work with.
KYB processes involve:
- Collecting documents like articles of incorporation, business licenses, partnership agreements and financial statements.
- Identifying and verifying ultimate beneficial owners (UBO) before establishing a business relationship. A beneficial owner may not be the owner or company leader but is a person who ultimately benefits from the business transactions.
- Determining the nature of the business including what it sells, what service it provides and who it partners with.
- Identifying high-risk businesses.
Who Needs KYC?
Almost all financial services organizations need to implement a KYC compliance program to protect themselves from negative consequences. For instance, the following financial organizations need KYC:
- Banks
- Investment firms
- Insurance brokers
- Wealth management firms
- Casinos
- Credit unions
- Fintechs
- Private lenders
KYC compliance is not optional in the financial sector, and failure to follow the regulations can cause irreparable harm to the company.
How Much Does KYC Cost?
KYC efforts are not cheap. According to recent reports, the global cost of KYC was estimated at $1.4 billion, a 26% increase from the previous year, as governments and individual organizations spent more to limit financial crime.
In addition to the financial costs, companies adhering to KYC must strive to offer their customers a frictionless experience. This can be difficult when clients are asked to provide ID documents, which can be a time-consuming process online.
Certain solutions can help organizations maintain a high standard of user experience, but not all solutions are created equal. Customers who are delivered a bad customer experience may decide to move on, so it’s important to choose your solution carefully.
Why Is it Important to Meet KYC Regulatory Requirements?
Meeting KYC regulatory requirements helps financial institutions maintain regulatory compliance, verify customer identities, assess financial crime risks, and meet applicable anti-money laundering (AML) obligations. Requirements vary by jurisdiction and institution type, so compliance teams should align their KYC procedures with relevant laws, regulatory guidance, and risk-based controls.
And the damage doesn’t end with fines. Companies that do not comply risk losing money to fraudulent customers as well as damaging their reputations.
Financial institutions must integrate KYC and AML controls into their compliance programs, including identity verification, customer due diligence, and ongoing monitoring. They should review applicable money laundering regulations regularly and update their controls as requirements evolve. Failure to meet relevant obligations can result in financial penalties, reputational damage, and increased exposure to financial crime.
Build KYC Requirements Into Your Workflows with Jumio
KYC works to protect companies and customers from the ill effects of financial crime, including fraud and money laundering. Complying with the regulations may seem unwieldy, but it doesn’t have to be. You can implement software that will build KYC requirements into your workflows.
Jumio offers user-friendly biometrics software, automated identity verification and ongoing AML screening capabilities that will keep your company in compliance without requiring nearly as much time and effort. Jumio provides a better customer experience while protecting your company from financial losses, a diminished reputation and hefty government fines.
For more information, contact us today to find out more about our KYC services.
Frequently Asked Questions About KYC Requirements
What KYC documents are required for financial institutions?
KYC documents depend on the customer type, institution, and applicable regulations. Individuals may need to provide government-issued identification and supporting information. Businesses may need incorporation documents, ownership details, and information about authorized representatives.
What are the four elements of customer due diligence?
Customer due diligence commonly involves identifying the customer, verifying their identity, understanding the purpose and intended nature of the business relationship, and conducting ongoing monitoring. The exact requirements depend on the applicable regulatory framework and the customer’s risk profile.
What is the difference between KYC and AML?
Know Your Customer (KYC) focuses on verifying customer identities and assessing risk. Anti-money laundering (AML) covers the broader policies, procedures, and controls financial institutions use to prevent, detect, and report suspected money laundering and related financial crimes. KYC is an important part of an AML program.
How often should financial institutions update KYC information?
There is no single update frequency that applies to every customer and jurisdiction. Financial institutions should review and refresh customer information according to applicable regulations, their risk-based policies, changes in customer circumstances, and events that trigger a reassessment.
What happens if a financial institution fails to meet KYC requirements?
Failure to meet applicable KYC requirements can expose a financial institution to regulatory penalties, remediation costs, reputational damage, and increased financial crime risk. The consequences depend on the jurisdiction, the nature of the violation, and the relevant regulatory framework.
First Published: March 30, 2023
