Identity at sign up is only the first of four measures in FATF Recommendation 10, the international standard. The beneficial owner, the purpose of the relationship and ongoing due diligence follow, each scaled by a risk based approach (RBA, Recommendation 1). An ID copy alone answers one.
What is KYC, and what does know your customer mean?
KYC stands for know your customer, also written know your client. It means knowing a customer well enough to judge what money laundering or terrorist financing risk it brings, and the rulebooks call that work customer due diligence (CDD).
A text search of the FATF, EU, UK and US AML texts cited here, run on 28 October 2026, finds neither "know your customer" nor "KYC". Two rule titles keep the name. FINRA Rule 2090, a US rule titled Know Your Customer, requires member broker dealers to know "the essential facts concerning every customer". India's central bank calls its AML rule for commercial banks the Know Your Customer Directions, 2025.
So your KYC policy should cite the customer due diligence article of each market you serve, because the KYC requirements of 15 markets differ in regulator, national identity system and beneficial ownership threshold.
Why is KYC compliance important?
KYC keeps criminal money and terrorist financing out of the firm. Its file shows what the firm knew and when, kept at least five years after the relationship ends (FATF Recommendation 11).
KYC is the customer part of a wider AML program. A US bank's program under 31 CFR 1020.210 must include internal controls, independent testing, a designated person who coordinates compliance, training and risk based customer due diligence.
What are the parts of KYC, and in what order?
Table 1. The seven parts of KYC and the rule behind each (as of October 2026)
| Part | What it covers, with the rule | When, and any threshold |
|---|---|---|
| 1. Identify and verify | Identity checked against "reliable, independent source documents, data or information" (R10(a)), such as a passport (R11) | Before or during onboarding. A US bank collects name, date of birth, address and identification number before opening an account, with exceptions for a taxpayer number applied for and for credit card accounts, and verifies identity within a reasonable time after opening (31 CFR 1020.220) |
| 2. Beneficial owner (UBO) | The natural persons who own or control the customer, and its ownership and control structure (R10(b)) | US, for a legal entity customer: each owner of 25% or more, plus one person who controls it (31 CFR 1010.230) |
| 3. Purpose and risk rating | The purpose and intended nature of the relationship (R10(c)); the rating sets how far every other part goes (R1) | At onboarding, then again when part 6 brings new facts |
| 4. Screening | Politically exposed person (PEP) status (R12); adverse media through open source intelligence (OSINT) where the firm's policy asks; targeted financial sanctions as a CDD measure in the EU only, of these four rulebooks (Regulation (EU) 2024/1624, the AMLR, Art 20(1)(d)) | Before the relationship starts; a foreign PEP needs senior management approval (R12(b)); the EU sanctions measure from 10 July 2027 |
| 5. Level of due diligence | Simplified due diligence (SDD) where lower risk is identified (R1), enhanced due diligence (EDD) for higher risk | Extra measures always for foreign PEPs (R12) and cross border correspondent banking (R13); EDD for countries FATF calls for (R19) |
| 6. Ongoing monitoring | Transactions scrutinized against what the firm knows of the customer (R10(d)) | EU from 10 July 2027: customer information updated at least every year for higher risk customers and every 5 years for others, and reviewed on a relevant change (Art 26(2), (3)); Indian commercial banks at least every 2, 8 or 10 years by risk (RBI para 42(1)) |
| 7. Records | CDD records at least five years after the relationship ends or after an occasional transaction; transaction records at least five years (R11) | In the EU from 2027, 5 years also from a refusal (Art 77(3)); UK: five years from the end of the relationship or of an occasional transaction (MLR 2017 regulation 40) |
The KYC process runs the rows in order, each row holding one or more KYC checks. Parts 1 to 4 happen before or during onboarding; FATF lets countries allow verification to finish soon after, where the risk is managed and a delay would interrupt business. UK and US rules set no fixed review interval, only customer information kept up to date on a risk basis.
If the measures cannot be completed, a bank opens no account, carries out no transaction, ends any existing relationship and considers reporting suspicion to the financial intelligence unit, or FIU (Recommendation 10; AMLR Article 21 from 10 July 2027; UK regulation 31). A UK bank may still repay deposits to the person who paid them in, with consent where a disclosure is required. A US bank's customer identification program (CIP) sets when not to open an account, the terms for using one while verification is pending, and when to close it.
Is sanctions screening part of KYC?
Picture a bank (illustrative) with branches in Frankfurt, Germany, and London, onboarding one trading company in September 2027. Frankfurt files the sanctions result as customer due diligence, because AMLR Article 20(1)(d) asks whether the company or its beneficial owners face targeted financial sanctions, and whether sanctioned persons control it or hold more than 50 percent of its proprietary rights, individually or collectively. London screens the same names under UK sanctions law, beside its CDD.
FATF (Recommendations 6 and 7), the UK and the US keep that check in sanctions law. If your group runs one onboarding flow for both, record the EU check in the KYC file itself as well as in the screening system.
Who has to carry out KYC, and when is it required?
Sectors subject to KYC:
- Banks and other financial institutions, for every customer (Recommendation 10).
- Lawyers, notaries, accountants, casinos, real estate agents, dealers in precious metals or stones and trust and company service providers, only for the work Recommendation 22 lists, such as a casino transaction of USD/EUR 3,000 or more.
- Virtual asset service providers (Recommendation 15), for every customer and for occasional transactions above USD/EUR 1,000.
- EU football agents and professional football clubs from 10 July 2029 (AMLR Articles 3(3)(n), (o) and 90), clubs only for four transaction types, such as player transfers.
KYC is required when a relationship starts, for an occasional transaction above USD/EUR 15,000 or a payment covered by Recommendation 16, on suspicion of money laundering or terrorist financing, and when the firm doubts identity data it holds. For existing customers, materiality and risk decide.
Which laws set KYC requirements, and since when?
Global KYC regulatory frameworks write the duty as customer due diligence, each on its own dates (as of October 2026). FATF's Recommendation 10 (June 2026 text) wants the principle in law and lets each country set the detail in law or other enforceable means, with national regulators supervising.
In the EU, Directive (EU) 2015/849 (AMLD4) Article 13 sets the measures today, through each member state's own law. From 10 July 2027 the AMLR applies directly (Article 90), with nine measures in Article 20(1). Under its Article 28(1), AMLA's final report on the customer due diligence standards is dated 30 September 2026, and the standards go next to the European Commission for adoption.
In the UK, MLR 2017 regulation 28 sets the measures. Since 30 June 2026, S.I. 2026/621 has put the thresholds in sterling: £12,000 for most occasional transactions and £800 for transfers of funds. In the US, FinCEN's CIP rule (1020.220) and beneficial ownership rule (1010.230) sit inside a bank's AML program (1020.210).
In India, the RBI's Directions (updated as on 1 October 2026) set outer limits for KYC updates, and each bank writes its approach into a KYC policy its Board or a Board committee approves (para 42(1)).
How does KYC differ from KYB, KYT and the other know your checks?
Six other checks borrow the name; three sit inside customer due diligence:
- KYB (know your business) is KYC for a company, partnership or trust customer, with part 2 traced to the natural persons who own or control it.
- KYT (know your transaction) is the payments side of part 6 (Recommendation 10(d)).
- KYCC (know your customer's customer) belongs to correspondent banking: for payable through accounts, Recommendation 13(e) asks the correspondent to be satisfied that the respondent bank has done CDD on the customers with direct access to them.
- KYS (know your supplier) and KYE (know your employee) cover suppliers and staff. Neither is a customer under Recommendation 10.
- KYP (know your patient) checks a patient's identity in healthcare, as a fraud control outside AML rules.
What does know your customer software do, and what stays with people?
Know your customer software, sold as KYC compliance tools or a KYC API, runs lookups, screening, scoring and records, and the technologies used for digital KYC and eKYC run part 1 remotely.
In complead, formerly Sanction Scanner, customer risk assessment and KYC scores CDD data from the firm's own KYC forms against a risk model the firm builds, and again when facts change; document and biometric checks stay with the firm's identity verification provider. Its AI proposes model changes with the evidence. Each passes a simulation and the firm's approval first. Customer onboarding runs the identity or ownership step (KYC for individuals, KYB for companies) and screening in one request.
The next question is part 1 in practice: how one person's identity is checked step by step, and what changes for a company.
Related terms
- Customer risk assessment. The method that turns a customer's risk factors into the rating behind part 3.
- KYB verification. Parts 1 and 2 for a company: its registration, its officers and its owners, each checked at source.
- Proof of address. The document or data a firm accepts as evidence of where a customer lives.
- Know your supplier. Due diligence on the firms a business buys from, outside customer due diligence.
- Trust and company service providers (TCSPs). Firms that form companies or act as trustees, directors or nominee shareholders, and run KYC for the work Recommendation 22 lists.
- Know your transaction (KYT). Testing each payment against what the customer's file says.
How this entry was checked. Burçak Aydın (Finance Manager, complead) wrote this parent entry, and Ufuk Gürdaş (Compliance Specialist) holds each rule, threshold and date in it up against the source text before it is published. Fact checked by: Ufuk Gürdaş, Compliance Specialist, 29 October 2026. Last reviewed: 29 October 2026. Each text was reread at the paragraph cited on 28 October 2026: FATF Recommendations 1, 6, 7, 10 to 13, 15, 16, 19, 22 and 26 with their interpretive notes (June 2026 text); Directive (EU) 2015/849; Regulation (EU) 2024/1624; AMLA's final report of 30 September 2026; UK Money Laundering Regulations 2017, regulations 27, 28, 31 and 40, with S.I. 2026/621; 31 CFR 1010.230, 1020.210 and 1020.220; FINRA Rule 2090; the RBI's Know Your Customer Directions, 2025. The name search covered all of the FATF Recommendations, both EU acts, MLR 2017 and 31 CFR parts 1010 and 1020. The seven parts are this entry's reading of Recommendations 1 and 10 to 12. The Frankfurt and London bank is illustrative.
