KYC

KYC — Know Your Customer — is the set of obligations a financial institution has to establish who it is dealing with and to keep understanding that relationship over time. It exists to make money laundering, terrorist financing, sanctions evasion, and identity fraud harder to carry out through regulated institutions.

There is an international standard — the FATF Recommendations, as amended June 2026 — but it is a standard rather than law: it is written to “set an international standard, which countries should implement through measures adapted to their particular circumstances.” What binds an institution is therefore its own country’s rules, which is why the specifics differ by jurisdiction while implementation shares common principles. Applicability, exclusions, and permitted simplifications still need to be checked for the institution, customer, and transaction. The concrete instance used below is the United States’ Customer Due Diligence rule, which “amends Bank Secrecy Act regulations” and “aims to improve financial transparency and prevent criminals and terrorists from misusing companies to disguise their illicit activities and launder their ill-gotten gains.” It applies to “U.S. banks, mutual funds, brokers or dealers in securities, futures commission merchants, and introducing brokers in commodities.”

Four obligations, not one check

The most common misreading of KYC is that it is an identity check performed once, at account opening. The rule’s own structure says otherwise: covered institutions must “establish and maintain written policies and procedures that are reasonably designed to” do four things.

1. “Identify and verify the identity of customers.” The part everyone thinks of — and only the first quarter of the obligation.
2. “Identify and verify the identity of the beneficial owners of companies opening accounts.” A separate requirement, subject to its legal scope and exceptions. The target is “the natural persons (known as beneficial owners) of legal entity customers who own, control, and profit from companies” — because a company can be used precisely to obscure who is behind a transaction.
3. “Understand the nature and purpose of customer relationships to develop customer risk profiles.” Not identity at all, but expectation: what this customer is for, so that behavior can later be judged against something.
4. “Conduct ongoing monitoring to identify and report suspicious transactions.” A continuing duty, not an event.

Read as a whole, KYC is a program that runs for as long as the relationship does. The third and fourth items depend on each other: monitoring with no recorded expectation of what is normal for this customer produces alerts nobody can adjudicate, because there is nothing to compare behavior against.

FinCEN’s February 13, 2026 order FIN-2026-R001 permits covered institutions to limit beneficial-owner identification and verification to the legal entity’s first account with that institution, later facts that reasonably call prior information’s reliability into question, and occasions required by risk-based ongoing due diligence. It relieves the requirement at every additional account opening, not ongoing monitoring or other applicable AML obligations.

Note also the phrase “written policies and procedures that are reasonably designed to.” The obligation attaches to having a defensible program, not to achieving a perfect outcome — which is why examinations ask to see the design and the evidence that it was followed.

The same four, in the international standard

This four-part shape is not a peculiarity of US law. Recommendation 10 of the FATF Recommendations lists the customer due diligence measures as “(a) Identifying the customer and verifying that customer’s identity using reliable, independent source documents, data or information”; “(b) Identifying the beneficial owner, and taking reasonable measures to verify the identity of the beneficial owner,” which “for legal persons and arrangements… should include financial institutions understanding the ownership and control structure of the customer”; “(c) Understanding and, as appropriate, obtaining information on the purpose and intended nature of the business relationship”; and “(d) Conducting ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of that relationship.”

Recommendation 10 describes customer identification, beneficial-owner identification and verification, understanding the relationship, and ongoing scrutiny. Its risk-based approach determines the extent of applicable measures, read with the interpretive notes and the legal rules implementing them.

Determine applicability before choosing the depth of checks. FATF’s framework allows defined exemptions in specified circumstances as well as simplified measures for lower risk. This does not let an institution declare any low-risk segment exempt on its own. Record the legal basis and conditions for an exclusion or relief, then apply the required measures proportionately within scope. See risk-based decisions for documenting that reasoning.

When you cannot complete it

The standard also states what happens when required measures cannot be carried out under the applicable framework, and it is more decisive than most descriptions of KYC suggest. The institution should be required “not to open the account, commence business relations or perform the transaction; or should be required to terminate the business relationship; and should consider making a suspicious transactions report in relation to the customer.”

Two things follow for whoever builds the systems. Refusal and exit are ordinary outcomes of the process rather than exceptions to it, so the customer lifecycle needs a supported path for them — a product that can only open accounts will be worked around. And the duty reaches backwards: within the applicable scope, the requirements “should apply to all new customers,” but institutions “should also apply this Recommendation to existing customers on the basis of materiality and risk, and should conduct due diligence on such existing relationships at appropriate times.” A remediation program over an existing book is a normal part of KYC, not a sign that something went wrong.

What automation changes, and what it does not

Document capture, biometric comparison, list screening, and anomaly models all make the work cheaper and more consistent. Three things they do not move.

• The judgment. Whether a pattern is suspicious enough to report is a decision with legal consequences. A model can rank and route; it does not discharge the duty.
• The accountability. The institution remains responsible for a vendor’s false negative. Outsourcing the mechanism does not outsource the obligation.
• The evidence burden. An automated decision still has to be explainable after the fact — which of these transactions were reviewed, by what rule, and why this one was cleared.

That third point is the one that surprises technical teams, and it is a design constraint rather than a reporting afterthought. A monitoring system that cannot reconstruct why it did not alert on a particular transaction is difficult to defend, so decisions and their inputs need to be retained rather than only their outcomes — the purpose an audit log serves here.

What it asks of a data platform

KYC turns into four concrete platform requirements, and they pull against each other in a way worth planning for.

• Retention with history. The standard sets a floor: records on transactions kept “for at least five years” and “sufficient to permit reconstruction of individual transactions.” Monitoring additionally needs what was true at the time rather than only the current state, so customer records need versioning rather than in-place updates.
• Reproducible decisions. An alert or a clearance must be explainable against the data as it stood then, which means the inputs to a decision are part of the record.
• Tight access control. Identity documents and beneficial-ownership data are among the most sensitive holdings in a bank, and least privilege applies with unusual force.
• Restraint about collection. The retention duty argues for keeping things; data minimization argues for holding no more than the purpose requires. Both are real, and the resolution is a documented decision per field rather than a default in either direction.

Where models are used to rank or triage, they acquire the evidentiary burden of the decisions they influence, and their behavior drifts as customer populations and typologies change — see drift detection. Treating a screening model as a static deliverable is how a program passes an examination one year and fails the next with no code having changed.

Two clarifications to close. KYC is often spoken of as identical to AML; it is more accurate to say KYC is one part of an anti-money-laundering program, alongside transaction reporting, sanctions compliance, and governance. And note what the two sources quoted here are: an international standard that countries choose how to implement, and one country’s rules implementing it. The obligations that apply to any particular institution are the ones in its own regulator’s rules. This entry explains a term and is not legal or regulatory advice.

References:

• FATF, The FATF Recommendations, Recommendations 1, 10 and 11 (amended June 2026)
• FATF, February 2025 update on proportionality, simplified measures, and exemptions
• FinCEN, Information on Complying with the Customer Due Diligence (CDD) Final Rule
• FinCEN, FIN-2026-R001, Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening (February 13, 2026)