The foundations

Understanding KYC and Customer Due Diligence

Know Your Customer, commonly known as KYC, refers to procedures used by financial institutions to identify and verify customers and understand relevant aspects of their activities and relationships. Customer due diligence (CDD) is a broader process that includes gathering and assessing information to understand the customer and the risks associated with the relationship.

These processes form important components of anti-money laundering and counter-terrorist financing controls. Depending on the applicable framework, institutions may also need to consider sanctions exposure, fraud risks, corruption-related risks and other financial crime concerns.

KYC is not simply the collection of identity documents at account opening. It involves assessing whether the information obtained is sufficient, consistent and appropriate for the relationship, and updating that understanding when circumstances change.

Establishing identity

Customer Identification and Verification

Customer identification establishes the identity of the person or organisation seeking a financial relationship. Verification involves assessing whether the identity information is reliable and sufficiently supported by appropriate evidence.

Individual customers

Depending on the jurisdiction and the circumstances, verification may involve official identity documents, address information and reliable electronic identification methods. Institutions should follow the standards applicable to their business and assess whether the evidence obtained is adequate.

Corporate and institutional customers

For companies, partnerships, trusts and other legal arrangements, due diligence may require information about legal existence, registration, business activities, ownership and control. The documents and checks needed depend on the entity's legal form and the relevant requirements.

Purpose and intended nature of the relationship

Institutions generally need to understand why a customer is seeking the service and how the account or relationship is expected to be used. Relevant information may include the nature of the business, expected transaction patterns, geographic connections and the source of funds used in the relationship.

Consistency and verification quality

Information should be reviewed for inconsistencies, gaps and indicators that warrant further enquiry. A document or database result should not automatically be treated as conclusive if other information raises legitimate concerns.

Where verification cannot be completed to the standard required by applicable rules, the institution should follow its procedures for resolving the issue and determining whether the relationship can be established or continued.

Ownership and control

Beneficial Ownership and Corporate Structures

Identifying a legal entity's registered owners may not be sufficient to establish who ultimately owns or controls it. Beneficial ownership procedures seek to identify the natural persons who ultimately own or control a customer, in accordance with the applicable legal definitions and thresholds.

Corporate ownership can involve several layers of companies, nominee arrangements, trusts or entities established in different jurisdictions. Understanding these structures can help institutions assess who is behind the relationship and whether the ownership information is consistent with the customer's stated activities.

Understanding ownership chains

Institutions may need to trace ownership through intermediate entities to identify the relevant natural persons. The necessary depth of investigation depends on the structure, the applicable requirements and the risks identified.

Identifying persons exercising control

Ownership percentages are not always the only relevant factor. A person may exercise control through voting rights, contractual arrangements, senior management responsibilities or other mechanisms recognised by the relevant framework.

Trusts and other legal arrangements

Where the customer involves a trust or similar arrangement, relevant parties may include settlors, trustees, beneficiaries and persons exercising effective control, depending on the legal structure and applicable requirements.

Resolving discrepancies

Institutions should investigate material inconsistencies between customer declarations, corporate records and other reliable sources. Where the information remains unclear, the issue should be escalated under the institution's due diligence procedures.

Beneficial ownership checks should be proportionate and documented. No single ownership threshold or verification method applies universally across all jurisdictions and types of customer.

Risk-based controls

Customer Risk Assessment

Customer risk assessment helps institutions determine the level of due diligence and monitoring appropriate to a relationship. It should consider relevant risk factors collectively rather than relying on a single characteristic or an automated score alone.

Customer and business profile

Factors may include the customer's business activities, ownership structure, expected account usage, source of funds and the nature of the requested services. Complex structures or unusual circumstances may warrant additional clarification.

Geographic exposure

Countries and territories may present different levels or types of risk in relation to money laundering, sanctions, corruption or the effectiveness of relevant controls. Institutions should use current, credible information and apply the requirements of their own jurisdiction.

Products, services and delivery channels

Some services may involve higher transaction volumes, more complex payment chains, limited face-to-face interaction or other characteristics that affect risk. The assessment should reflect how the product is used and the safeguards available.

Expected and actual activity

Expected activity established during onboarding provides a reference point for later monitoring. Material differences between the stated purpose of an account and its actual activity may warrant investigation, although a difference alone does not establish wrongdoing.

Risk assessments should be recorded, explain the factors considered and be updated when new information materially changes the institution's understanding of the customer.

Enhanced checks

Standard Due Diligence and Enhanced Due Diligence

Customer due diligence should be proportionate to the risks identified and the requirements that apply. Institutions commonly distinguish between standard due diligence and enhanced due diligence, with the latter involving additional measures for relationships or situations presenting higher risks.

Standard customer due diligence

Standard procedures typically involve identifying and verifying the customer, understanding the purpose and intended nature of the relationship, identifying beneficial owners where relevant, and establishing a basis for ongoing monitoring.

Enhanced due diligence

Where higher risk is identified, additional measures may include obtaining further information about the customer, understanding the source of funds or wealth where appropriate, conducting more detailed ownership enquiries, securing additional approvals and applying more intensive monitoring.

Politically exposed persons

Politically exposed persons (PEPs) are individuals entrusted with prominent public functions, as defined under the relevant framework. Their positions may create particular exposure to bribery or corruption risks. PEP-related controls commonly include specific risk assessment and additional measures where required. Being a PEP does not, by itself, establish that a person has engaged in wrongdoing.

Higher-risk relationships

Other circumstances may also require enhanced scrutiny, depending on applicable rules and the institution's assessment. The measures adopted should address the identified risks rather than applying additional checks without a clear purpose.

Institutions should document the reasons for enhanced measures, the information obtained and the decisions made. Requirements differ between jurisdictions, so procedures should be aligned with the relevant legal and supervisory framework.

Ongoing oversight

Ongoing Monitoring and Periodic Reviews

KYC and customer due diligence are continuing responsibilities. A customer's ownership, business model, geographic exposure and transaction patterns may change after onboarding, making it important to keep the institution's understanding current.

Transaction monitoring

Monitoring processes can help identify activity that appears inconsistent with a customer's known profile or raises other concerns under the institution's risk framework. Alerts need appropriate review, and conclusions should be based on relevant information rather than assumptions.

Customer information updates

Institutions should maintain procedures for updating identity records, ownership information, contact details and other relevant customer information. The timing and depth of reviews should reflect applicable requirements, customer risk and material changes in circumstances.

Event-driven reviews

Significant changes may prompt a review outside the normal schedule. Examples include a change in beneficial ownership, a material shift in business activity, new geographic exposure or information that calls the existing risk assessment into question.

Investigating alerts and discrepancies

Reviewers should have access to relevant information, clear escalation procedures and documented decision criteria. Where an alert is resolved, the rationale should be recorded appropriately. Where concerns remain, the institution should follow its applicable escalation and reporting procedures.

Monitoring should be proportionate to the relationship and supported by appropriate governance, reliable data and periodic assessment of system effectiveness.

Funds and wealth

Understanding Source of Funds and Source of Wealth

Source of funds refers to where the money involved in a particular transaction or relationship originated. Source of wealth concerns how a person or entity accumulated its overall wealth. These concepts are related but answer different questions.

Depending on the customer's risk profile and applicable requirements, institutions may need to obtain information or evidence supporting the origin of funds or the accumulation of wealth.

Assessing source of funds

Relevant information may relate to business revenue, employment income, asset sales, investments, inheritance or other legitimate sources. The appropriate evidence depends on the circumstances and the institution's assessment.

Assessing source of wealth

Where required, institutions may consider the customer's professional history, business ownership, investment activity or other factors that help explain how the wealth was accumulated.

Consistency with the customer profile

The objective is to understand whether the information obtained is plausible and consistent with what is known about the customer and the intended activity. A source of funds or wealth should not be accepted uncritically when material inconsistencies remain unresolved.

Institutions should avoid requesting information without a clear risk-based purpose, while ensuring that their checks meet applicable requirements.

Records and accountability

Record Keeping, Documentation and Auditability

Clear records help demonstrate what checks were performed, what information was considered and why decisions were made. They also support periodic reviews, internal oversight and the handling of regulatory enquiries where applicable.

Customer due diligence records may include identity and verification evidence, ownership information, risk assessments, relevant correspondence, review outcomes and records of decisions or escalations.

Accuracy and completeness

Records should be sufficiently clear for authorised reviewers to understand the basis of the assessment. Missing information, conflicting documents and unresolved exceptions should be handled through established procedures.

Retention and access

Institutions should follow the record-retention periods and data-handling requirements applicable to their activities and jurisdictions. Access should be restricted appropriately, and customer information should be protected against unauthorised disclosure or alteration.

Audit trails and review

Where systems support it, an audit trail can help establish who performed a check, when it was completed, what information was used and whether the record was subsequently amended. Documentation should reflect the actual process undertaken.

Good record keeping strengthens accountability, but it does not replace the need for sound judgement, effective controls and appropriate escalation.

Governance and technology

Technology, Automation and Human Oversight

Digital onboarding, identity verification tools, screening systems and workflow automation can help institutions process information consistently and manage large volumes of customer records. Their effectiveness depends on the quality of data, the design of the controls and the way results are reviewed.

Digital identity verification

Electronic verification methods may improve convenience and support remote onboarding. Institutions should assess the reliability of the method, the evidence it produces and whether it meets the requirements applicable to the customer and service.

Screening and alert management

Automated tools may compare customer information with relevant sanctions lists, PEP information or other risk data. Potential matches need appropriate review to distinguish genuine matches from similar names or incomplete information.

Data quality and model limitations

Incomplete, outdated or inconsistent data can affect screening and risk assessments. Institutions should monitor data quality and understand the limitations of automated scores, rules and detection methods.

Human judgement and accountability

Automation should support, not obscure, accountability. Staff need clear procedures for investigating exceptions, challenging questionable results and escalating unresolved concerns. Material decisions should be explainable and appropriately documented.

Technology arrangements should also consider privacy, cybersecurity, access controls, vendor dependencies and the safe handling of sensitive customer information.

Common challenges

Improving the Effectiveness of KYC Processes

Customer due diligence can become inefficient when procedures are fragmented, information is duplicated or review responsibilities are unclear. At the same time, reducing administrative effort should not undermine the quality of risk assessment or required controls.

• Inconsistent documentation: use clear standards for collecting, verifying and recording information.
• Complex ownership structures: establish procedures for tracing ownership and control and escalating unresolved questions.
• Outdated customer profiles: apply risk-based review schedules and event-driven updates.
• Excessive false-positive alerts: periodically assess screening quality and refine processes within applicable requirements.
• Unclear responsibilities: define who collects information, who reviews it and who authorises exceptions.
• Fragmented systems: improve coordination between onboarding, screening, monitoring and customer-record management where appropriate.
• Weak escalation: provide clear routes for raising concerns and documenting decisions.

Improvements should be measured through meaningful indicators, such as review timeliness, unresolved exceptions, record quality and the effectiveness of controls. Speed alone is not an adequate measure of a successful KYC programme.

Conclusion

Building Trust Through Effective Customer Due Diligence

KYC and customer due diligence are essential elements of a structured financial crime risk-management framework. They help institutions establish who their customers are, understand relevant ownership and control, assess the purpose of relationships and identify circumstances that may require further attention.

Effective procedures combine reliable verification, risk-based assessment, ongoing monitoring, appropriate documentation and clear accountability. They also require periodic review as customer circumstances, technology and financial crime risks evolve.

When implemented proportionately and consistently, customer due diligence can support better-informed decisions, stronger controls and more transparent financial relationships. Its effectiveness depends on sound judgement, reliable information and compliance with the legal and regulatory requirements that apply to each institution.