What is KYC?
Know Your Customer (KYC) is a practical label for the controls used to understand and verify a customer’s identity. In many AML regimes, those controls sit within wider customer due diligence (CDD) obligations. The exact legal duties, evidence and review intervals depend on the regulated entity, product, customer and applicable jurisdiction.
KYC is not a single document check or a universal checklist. A controlled process distinguishes between information the customer supplies, checks that validate it, and evidence that independently verifies a relevant fact. It should also record unresolved discrepancies and the decision made in response.
For the complete lifecycle—including business verification, beneficial ownership, customer risk, enhanced measures, evidence and ongoing review—see our KYC, KYB and customer due diligence guide.
What does a KYC process usually cover?
For an individual customer, the process typically establishes who the person is, whether the identity information is reliable, and whether the relationship can proceed under the applicable policy and legal requirements. The information and verification methods should be proportionate to the relationship and the relevant regime.
Common control questions include:
- What information is needed to identify the customer?
- Which source or method can verify the material facts?
- Is there a mismatch, missing item or reason to doubt the earlier information?
- Is a person acting for someone else, and is their authority understood?
- What risk information should influence the next step?
Sanctions, PEP and adverse-media controls may use the same customer data, but they serve distinct purposes. A screening result is an investigative signal; the applicable process determines whether it requires further review, a restriction or another action.
Why evidence quality matters
Collecting information is different from verifying it. A reliable record should make clear what was collected, which source was used, when it was checked, what the result was and whether there were limitations. That lets a reviewer understand why a customer was accepted, escalated or asked for more information.
This is especially important when onboarding is partly automated. Automation can retrieve data, validate fields and route cases, but the organisation still needs ownership of source quality, exception handling, human review and change control. A completed system field should not become a substitute for evidence.
KYC is part of an ongoing relationship
KYC does not end once an account is opened. Customer information should remain current through material-change detection and any risk-based review cycle required by the applicable regime. A new representative, a change in ownership, a different use of the product or a conflict in the data can all require a reassessment.
For businesses, this moves into KYB: legal-entity identity, ownership and control, representative authority and business context. For the terminology and the distinction between KYC, CDD and enhanced due diligence, see KYC vs CDD vs EDD.
Practical next steps
Start by mapping the product, customer type and legal perimeter. Then define the evidence required for the material facts, the sources that can support it, the escalation path for discrepancies and the record that must be retained. A short KYC workflow can be effective when it is clear, proportionate and connected to the wider customer-due-diligence process.
Continue reading: Adverse media