Know Your Customer (KYC)
Know Your Customer, or KYC, is the process of identifying and verifying a customer before a business relationship starts and keeping that understanding current while it lasts, so a firm knows who it is actually dealing with. Identity verification is the first step of KYC, not the whole of it.
Also called: customer identification · customer onboarding checks
Know Your Customer is industry shorthand rather than a legal term. Few statutes use the phrase. What a supervisor actually enforces is written more precisely — as customer due diligence across most of the world, and in the United States as a customer identification program plus the beneficial ownership and monitoring rules beside it. When two parties agree that they are “doing KYC”, they may not be agreeing on very much.
The full process runs: collect the customer’s details; verify them against reliable, independent evidence; establish who owns and controls a corporate customer; screen the customer and its owners against sanctions and other lists; record what the relationship is for and what activity is expected; assign a risk rating; and keep all of it current for as long as the relationship lasts.
The commercial problem is that KYC is also the name of a product category. A vendor selling document capture and a liveness check is selling identity verification, which is one step of it. The product does not record expected activity, does not risk-rate the customer, does not unwind an ownership chain — that is Know Your Business — and does not refresh anything. A firm that treats the purchase as compliance finds the gap when a sponsor bank or an examiner asks for the rest.
In practice
KYC is the whole process of knowing the customer; identity verification is only its first step. A passed document check tells a firm the person exists, not whether what they are doing makes sense.
Example
A fintech buys a KYC vendor: document scan, selfie match, database check, pass or fail in ninety seconds. Its sponsor bank later asks how customers are risk-rated, where expected activity is recorded, and when files were last refreshed. None of that was in the product. The vendor delivered identity verification; the KYC obligation was never met.
Commonly confused with
| Term | How it differs |
|---|---|
| Customer Identification Program | CIP is a specific United States rule about verifying identity at account opening; KYC is the broader international practice that rule sits inside. |
| Customer Due Diligence | CDD is the defined regulatory standard with named elements; KYC is the informal umbrella term firms use for the same territory. |
| Know Your Business | KYB is the version applied to a corporate customer, adding legal existence and the ownership chain to what KYC asks of an individual. |
See also
- Know Your BusinessKnow Your Business, or KYB, is the verification of a corporate customer rather than an individual: that the entity legally exists, who owns and controls it, and what it actually does. It is the corporate counterpart to KYC, and the ownership chain is the hard part.
- Customer Due DiligenceCustomer due diligence, or CDD, is the baseline set of checks a regulated firm performs on a customer: who they are, who owns and controls them, and what activity to expect. It is done at onboarding and then kept current for as long as the relationship lasts, with risk rather than a fixed calendar setting when it is revisited.
- Customer Identification ProgramA Customer Identification Program, or CIP, is the United States rule requiring a bank to collect a minimum set of identifying details — name, date of birth for an individual, address and an identification number — before it opens an account, and to verify identity within a reasonable time afterwards. It is not a synonym for KYC.
- Enhanced Due DiligenceEnhanced due diligence, or EDD, is the additional scrutiny applied where money laundering risk is higher. In the UK and the EU it is mandatory in prescribed cases — politically exposed persons, high-risk countries, correspondent banking — as well as wherever a firm’s own risk assessment says the baseline is not enough.
- Anti-Money LaunderingAnti-money laundering, usually shortened to AML, is the body of law, regulation and internal controls requiring financial firms to detect, prevent and report attempts to disguise the origin of criminal proceeds. It is an obligation placed on the firm, not a product the firm can buy.