Know Your Customer (KYC)

Know Your Customer, or KYC, is a regulatory requirement that compels banks, brokers, and other financial institutions to verify the identity and assess the risk profile of each customer before establishing a business relationship or conducting significant transactions. KYC forms the foundation of anti-money-laundering (AML) compliance and is mandatory under law in most countries.

The foundation: who you are, not just who you claim to be

KYC begins with identity verification. A financial institution cannot simply take a customer’s word for who they are. The firm must collect identifying documents—typically a passport, national ID card, or driver’s license—and verify their authenticity. This has moved increasingly into the digital realm; many banks now use biometric comparison (comparing a photo of the customer to their ID) or third-party identity verification services that cross-reference databases and public records.

For individuals, the institution collects basic facts: name, date of birth, address, and typically a national identification number (like a Social Security number in the United States or a Personal Identification Number elsewhere). For businesses, KYC extends further: the firm must verify the legal existence of the company, identify its beneficial owners (the real humans who ultimately control it), and understand the company’s business purpose and structure.

Why KYC exists: two interlocking threats

KYC addresses two distinct problems. The first is financial crime—specifically, money laundering. A person or criminal organization might try to move illicit funds through the financial system by using false identities or shell companies. By verifying identity at account opening, banks create a paper trail that ties cash flows to real people and makes large-scale anonymous laundering far harder. It does not eliminate the problem, but it forces criminals to either use real identities (risking exposure) or exploit trusted insiders at corrupt institutions.

The second is terrorism financing. Regulators want to prevent banks and other firms from unknowingly facilitating the movement of money to terrorist organizations or sanctioned regimes. Again, identity verification is the starting point—if you know who your customer is, you can check their name against sanctions lists and risk watchlists.

From a regulatory perspective, KYC is also about institutional hygiene. A firm that knows its customers is better positioned to spot suspicious activity and report it to authorities. A firm that cuts corners—accepting customers without proper verification—becomes a magnet for bad actors and signals to regulators that the institution’s compliance culture is weak.

The mechanics: documents, databases, and ongoing monitoring

In practice, a firm collects KYC information through a combination of customer self-disclosure and third-party verification. The customer fills out forms (often now digital) providing personal and financial information. The firm verifies identity documents, cross-references them against watchlists (like the Office of Foreign Assets Control’s sanctions list in the US), and runs credit checks or other background checks to assess creditworthiness and risk.

For some customer types—high-net-worth individuals, shell companies with opaque ownership, entities in high-risk jurisdictions—the process is deeper and more intrusive. A bank might demand additional documentation, hire external investigators, or conduct enhanced due diligence before opening the account.

KYC does not end at account opening. Institutions are required to conduct ongoing monitoring—reviewing customer transactions for unusual patterns, checking for changes in customer status, and updating KYC records periodically. If a customer’s risk profile changes (e.g., they move to a high-risk jurisdiction or start a business in a sensitive sector), the institution must re-assess and potentially escalate monitoring or freeze the account.

KYC versus CDD: what’s the difference?

KYC and Customer Due Diligence (CDD) are related but not identical. KYC is the specific process of identifying and verifying a customer’s identity. CDD is a broader regulatory obligation that includes KYC plus additional requirements: understanding the customer’s source of funds, assessing the nature and purpose of their relationship with the bank, and identifying and verifying beneficial owners of corporate accounts.

In the United States, CDD is mandated by a rule issued by FinCEN in 2016. Most firms consider KYC the frontline component of CDD and have integrated the two into a single process.

The cost of KYC compliance

KYC compliance is expensive. A mid-sized bank might spend millions annually on identity verification systems, sanctions list screening, monitoring software, and compliance personnel. Smaller firms, especially fintech startups, often struggle with the compliance burden—the setup cost of building or licensing a KYC system can exceed the expected revenue from early customers.

This has given rise to a KYC service industry: third-party providers who specialize in identity verification, document authentication, and ongoing monitoring. A startup can outsource KYC to a service like Stripe, Plaid, or Onfido rather than building it in-house, trading operational cost for a per-transaction fee.

KYC failures and regulatory fallout

When a bank fails to conduct proper KYC or ignores red flags in customer behavior, regulators punish it harshly. In 2020, JP Morgan Chase settled with regulators for over 900 million dollars for failures in its AML controls, including inadequate KYC and suspicious activity monitoring. Wells Fargo faced similar penalties. These fines often include not just a monetary sanction but also mandatory improvements to compliance infrastructure and sometimes restrictions on the firm’s ability to add new customers.

The reputational damage can be severe as well. A bank caught facilitating money laundering loses customer trust and attracts scrutiny from regulators for years afterward. For this reason, modern financial institutions tend to err on the side of aggressive compliance—they may decline customers with unclear ownership structures or tie-ups to high-risk jurisdictions, even if there is no direct evidence of wrongdoing.

The tension between access and security

KYC creates a friction point: it blocks or delays access to financial services. For individuals and businesses with legitimate reasons to use financial services, the process can feel intrusive and slow. A startup trying to open a business bank account might wait weeks for KYC approval. A freelancer in a developing country might be rejected because their home country is on a risk watchlist.

This has sparked debate about the balance between security and financial inclusion. Regulators have generally held firm—the cost of bad actors is deemed too high. However, some jurisdictions are experimenting with streamlined KYC for lower-risk customers (e.g., lower account balances or transaction limits) to reduce friction while preserving oversight of high-value flows.

See also