KYC questionnaire: 12 questions and the rule behind each one

Filing the signed questionnaire as the finished check is the mistake to avoid. The questionnaire is the asking part of customer due diligence (CDD): the customer's own account, with nothing in it tested yet. A customer that ticks "no" on the sanctions question still goes through screening.

What is a KYC questionnaire, and how does it differ from a KYC form and from verification?

The questionnaire gathers what the customer declares. KYC documents verify it, because FATF Recommendation 10(a) wants identity verified "using reliable, independent source documents, data or information", and a customer's own answer is none of those. Screening runs the declared names against sanctions and PEP lists.

"KYC form" usually names the version the customer fills in, with fields, uploads and a signature; the questionnaire is the set of questions behind it.

US banks have the split in writing. Under 31 CFR 1020.220, a bank's Customer Identification Program (CIP) obtains a name, a date of birth, an address and an identification number "prior to opening an account" and has to check them "within a reasonable time after the account is opened".

Which questions must every KYC questionnaire ask, and what is the legal basis for each?

The 12 questions below cover what four rulebooks ask of a standard customer: FATF, the UK Money Laundering Regulations 2017 (regulation 28), Regulation (EU) 2024/1624 (the AMLR, which applies from 10 July 2027) and the US CIP and beneficial ownership rules. The reference after each item names the rulebooks that ask it.

1. Every name used. AMLR Article 22(1)(a)(i) asks for "all names and surnames"; for a company, the legal name and legal form (22(1)(b)(i)).
2. Date and place of birth, or registration details. AMLR 22(1)(a)(ii) and the CIP rule; for a company, the registration number (UK regulation 28(3)(a)(ii)).
3. Address. A person's usual residence (AMLR 22(1)(a)(iv)); a company's registered office and, if different, its principal place of business (22(1)(b)(ii), regulation 28(3)(a)(iii)).
4. Nationality, national ID number and tax number. AMLR 22(1)(a)(iii) and (iv), the tax number "where available"; US persons give a taxpayer identification number.
5. Occupation or business activity. AMLR Articles 20(1)(e) and 25(e).
6. Purpose and intended nature of the relationship. FATF Recommendation 10(c), AMLR 25(a), regulation 28(2)(c).
7. Expected activity. The estimated amount (AMLR 25(b)) and where the money goes (25(d)).
8. Source of funds. AMLR 25(c); at enhanced level, source of funds and source of wealth for the customer and its owners (Article 34(4)(c)).
9. PEP status of the customer and its beneficial owners, with family members and close associates. AMLR 20(1)(g), UK regulation 35. On a yes, ask the name, position, country and dates in office. The standalone PEP declaration form adds the source of funds and wealth.
10. Beneficial owners. Who owns or controls the customer, through every layer, up to the ultimate beneficial owner (UBO) (AMLR Articles 51 to 54, regulation 28(4), 31 CFR 1010.230).
11. Who acts for the customer, and on what authority. AMLR 20(1)(i), regulation 28(10).
12. Sanctions declaration. Whether the customer or its owners are subject to targeted financial sanctions, and whether listed persons, alone or together, control it or own over 50 percent of it (AMLR 20(1)(d)). The article says "verifying", so screening runs whatever the answer.

How do the questions change by customer type?

Table 1. KYC questionnaire by customer type (templates as published on 1 November 2026)

Every row has a ready form among the 37 free KYC form templates from complead, formerly Sanction Scanner, each with the legal basis behind every question.

One wording gap matters if you onboard in several countries. From 10 July 2027 the AMLR counts an owner at "25 % or more" (Article 52(1)), as the US does with "25 percent or more" (1010.230(d)(1)), while UK regulation 5 says "more than 25%". A holder of exactly 25 percent is an owner in the US but not, by shares alone, in the UK. So ask "25 percent or more". The reviewer applies the local test.

The EU line may also drop: Article 52(2) lets the Commission set a lower threshold for higher risk categories of companies, normally at most 15 percent and always under 25 percent.

How do the questions change at simplified, standard and enhanced due diligence?

At simplified due diligence, the AMLR lets a firm collect less on purpose and intended nature, or infer it from the type of relationship (Article 33(1)(c)), and verify identity after onboarding where the lower risk justifies it, within 60 days (33(1)(a)). Identification itself stays (Article 20(1)(a)), so the free simplified form still has 27 questions.

At enhanced due diligence, Article 34(4) lists measures to apply in proportion to the risk: more on the customer, its owners and the intended relationship, source of funds and source of wealth for both, and the reasons for the transactions. FATF's interpretive note to Recommendation 10 gives occupation and "volume of assets" as examples (paragraph 20). For a customer established in a FATF call for action country, the UK makes those measures mandatory (regulation 33(3A)). Add two questions of your own. One covers links to any high risk country, the other the customer's account of any adverse media.

Take an illustrative applicant who left a deputy minister's post in spring 2026. A UK firm keeps the PEP measures, source of wealth and source of funds among them, for at least 12 months after that (regulation 35(9)), and the AMLR sets the same floor (Article 45(2)). The form asks for the dates in office; senior management approval stays in the internal section.

Which questions should a KYC questionnaire leave out?

Say a fintech's sign up page asks every customer for marital status, religion, a marketing opt in and how they found the app (an illustrative form). None feeds the risk rating. Religion is also special category data under GDPR Article 9(1).

The GDPR's data minimization principle, Article 5(1)(c), wants personal data "adequate, relevant and limited to what is necessary" for the purpose. The AMLR adds two limits: special category data only where "strictly necessary" for AML purposes (Article 76(1)), and no commercial use of personal data processed under the regulation (Article 76(4)). Marketing questions belong on a separate form with their own legal basis.

Keep a question only if a rule requires it or its answer feeds a risk factor. Tax residency and US person status come from the OECD Common Reporting Standard and FATCA, and the free builder labels both "Not an AML rule"; they can stay, marked as tax questions.

How do you turn the rest into a form customers complete?

1. Plain words, one fact per question. "Where will the money for this relationship come from?" reads better than "State your source of funds."
2. Conditional questions. The trust block opens only for trusts, the nominee follow up only after a "yes".
3. A signed declaration. The customer confirms the answers and agrees to report changes, which serves the duty to keep data current (AMLR Article 26(2)).
4. Records for five years after the relationship ends. AMLR Article 77(3) and UK regulation 40 set five years, FATF Recommendation 11 at least five.

In complead, the customer risk assessment and KYC product sends the questionnaire as a branded online form whose questions branch on earlier answers. Answers land on the customer record as scored factors in the firm's own risk model, and on submission the declared names are run through 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes.

Which questions does a crypto exchange ask a company customer?

An illustrative EU exchange is onboarding Alder Trading Ltd, which will deposit euros and withdraw crypto to its own wallets.

In the free KYC questionnaire builder, the analyst picks private company, standard level and the EU AMLR rulebook. Before any risk box is ticked, that questionnaire holds 54 questions in 12 sections, ending in an internal section for the screening result, the risk rating and the next review date, and the builder shows all 10 of its core AMLR requirements covered. The analyst ticks the crypto risk box and adds three questions from the free crypto exchange customer form: the wallet addresses, how Alder acquired its crypto, and whether it uses privacy coins or mixers.

The ownership answers need arithmetic. Article 52(1) multiplies holdings along each chain, but Article 54 takes over where a company in the chain controls the customer:

• Person A holds 40 percent of Alder directly, so A is an owner.
• Birch Holdings holds the other 60 percent, and above 50 percent is control (Article 53(2)(c)).
• Birch is held 70 percent by person B and 30 percent by person C. Multiplying would give B 42 percent and C 18 percent.
• Because Birch controls Alder, Article 54(b) makes everyone with 25 percent or more of Birch a beneficial owner of Alder. So C counts too.

A form that asked only for holdings of 25 percent or more after multiplying would have missed C.

What happens after the customer answers the questionnaire?

Verification comes first: an identity document, or an eID at the eIDAS "substantial" or "high" level (AMLR Article 22(6)). Then every declared name is screened, owners and directors included.

The answers feed the customer risk rating, which sets the due diligence level and the review date. Software can propose the rating, but under the AMLR any decision to accept or refuse a customer, or to change its due diligence, needs "meaningful human intervention" (Article 76(5)).

Then comes renewal. The AMLR allows at most one year between updates of customer information for a higher risk customer, and five years for any other (Article 26(2)). In the US, FinCEN's order of 13 February 2026 lets covered institutions identify a company customer's owners at the first account it opens, and afterwards only when facts call the data into question or their risk based procedures require it.

Three changes to an existing form, before the next onboarding:

• Tag every question with its rule or the risk factor it feeds, and cut the rest.
• Ask about owners at "25 percent or more", and ask who controls each company in the chain.
• Set a review date for each risk tier, one year at most for higher risk.

Method: Burçak Aydın read each rule cited on this page in its own text on 1 November 2026, from the FATF June 2026 edition to the UK regulations as in force on 31 October 2026, and Ufuk Gürdaş reviewed the citations. Tool facts come from complead's builder and template pages that day.