What is Know Your Customer (KYC)?

The goal of the KYC compliance requirement is to prevent money laundering, fraud, financing terrorism, and identity theft among other potential financial crimes. Financial institutions that are required to follow KYC guidelines include banks and credit unions, finance tech applications, private lenders, wealth management firms and broker-dealers. Failure to adhere to KYC can result in penalties, such as fines.

History of KYC

KYC requirements first came into place in the 1990s. They were strengthened even further as part of the Patriot Act, post 9/11, in an effort to limit funds going to terrorist cells.

In 2016, the Financial Crimes Enforcement Network (FinCEN) updated KYC requirements once again. This update aimed to address the fact that KYC did not explicitly require banks to identify stakeholders and beneficiaries of businesses with accounts at their institutions. The issue was that a business could appear outwardly legitimate while sheltering potentially bad actors and completing financial transactions for them. The 2016 update introduced Know Your Business (KYB) to address this gap in the regulations.

How does KYC work?

KYC can be broken down into three key components: the Customer Identification Program (CIP), Customer Due Diligence (CDD), and Continuous Monitoring.

For the Customer Identification Program, financial institutions must prove that a client is who they say they are before opening an account on their behalf. Any individual who controls a legal entity or owns more than 25% of one must have their identity verified via identifying documents (e.g., ID cards and business licenses), proof of address, and in some cases, even biometrics. Potential customers must also provide financial references and statements for review.

To comply with Customer Due Diligence, financial institutions must complete a detailed risk assessment for each customer. The risk assessment involves the financial institution reviewing the potential type and frequency of transactions a customer plans to make. Reviewing these potential transactions allows the institution to be aware of anomalous transactions when the account is opened. The assessment results in a risk rating that dictates how often a customer’s account will be monitored for fraud or other suspicious transactions.

Continuous monitoring is just what it sounds like: financial institutions are responsible for continually reviewing and monitoring customer accounts for suspicious or unusual activity. In the event of suspicious activity on an account, financial institutions are responsible for submitting a Suspicious Activities Report (SAR) to FinCEN.