Know Your Customer (KYC)

KYC, short for Know Your Customer, is the process financial institutions and payment providers use to verify a customer's identity and assess the risk they might pose before, and throughout, an ongoing relationship. It's one of the most widely referenced compliance concepts in payments, and for good reason: it sits at the foundation of how the financial system tries to keep bad actors from moving money through legitimate channels.

At its simplest, KYC answers a basic question: is this customer who they claim to be? But in practice, KYC extends well beyond a single identity check at account opening. It includes understanding why a customer wants a particular financial relationship, building a reasonable picture of their expected activity, and continuing to monitor that activity over time to catch behaviour that doesn't match the original picture.

The Legal Basis Behind KYC Requirements

In the United States, KYC obligations are grounded in the Bank Secrecy Act and enforced by the Financial Crimes Enforcement Network (FinCEN), with the USA PATRIOT Act reinforcing the requirement that financial services providers verify customer identity at account opening. Internationally, the Financial Action Task Force sets recommendations that a large majority of jurisdictions have adopted into their own domestic law, even though it has no direct enforcement power over individual institutions.

The Core Components Of A KYC Programme

A typical KYC programme covers four main pieces: identity verification, understanding the nature and purpose of the customer relationship, ongoing transaction monitoring, and enhanced scrutiny for higher-risk customers. This last piece is often handled through enhanced due diligence, applied to customers whose risk profile, jurisdiction, or transaction pattern warrants a closer look than the standard process provides.

Why KYC Doesn't Stop At Onboarding

A common misunderstanding is treating KYC as a single event that happens once, at the start of a relationship. In reality, most regulatory frameworks expect ongoing monitoring throughout the relationship's life, since a customer's risk profile can shift meaningfully over time. Someone who opened a low-risk personal account might later start moving unusually large sums, and it's the ongoing monitoring layer of KYC, not the initial check, that's generally responsible for catching that kind of shift.

KYC's Role In Preventing Fraud And Financial Crime

Proper KYC is generally understood to make several forms of financial crime harder to carry out. It raises the bar for identity fraud, where someone tries to open an account using a stolen or fabricated identity, and it supports fraud detection more broadly by giving institutions a reliable baseline of who a customer is and how they typically behave. Without that baseline, spotting unusual activity becomes considerably harder, since there's nothing to compare it against.

How KYC Relates To KYB

KYC and KYB checks are closely related but apply to different kinds of customers. KYC verifies individual people, while KYB verifies businesses as legal entities, including their ownership structure. A payment provider serving both consumers and businesses generally needs both processes running in parallel, since a business customer's individual beneficial owners will typically still need to go through some form of KYC as part of the broader KYB process.

Balancing KYC Thoroughness Against Customer Experience

One of the persistent tensions in KYC design is balancing regulatory thoroughness against onboarding friction. Overly burdensome identity verification can push legitimate customers to abandon signup entirely, while checks that are too light leave the door open to exactly the kind of risk KYC is meant to manage.

Many institutions now use risk-based approaches, applying lighter verification to lower-risk customers and reserving more intensive checks for situations that genuinely warrant them, rather than applying the same level of scrutiny to every customer regardless of risk.