Every individual's file has to show an examiner or an auditor two things: that the applicant is the person named on the document, and the day the firm knew it. The seven steps below cover the first. The second has a different answer in each market, from Singapore's MAS notices to Australia's AUSTRAC rules.
What is KYC verification?
In AML, the meaning of KYC verification is the identity check inside know your customer (KYC). Identification collects the details a customer gives; verification tests them against a source the customer does not control. FATF Recommendation 10 requires financial institutions to verify identity "using reliable, independent source documents, data or information" (FATF Recommendations, June 2026 text).
Verification is the first of the four customer due diligence (CDD) measures. What makes KYC verification important is fraud prevention: the check is meant to stop an applicant using another person's identity. A firm that cannot complete it may not open the account. A file is KYC verified when every required check has passed and is on record.
How is KYC verification different from KYB verification?
KYC verification checks one person. KYB verification checks a business: its registration, the authority of whoever acts for it, and who owns or controls it, whose identity the firm takes reasonable measures to verify (Recommendation 10(b)).
What are the steps in the KYC verification process?
The KYC verification process runs in seven steps: four establish identity and three act on it. Each step is a KYC check.
- Identity data collection. The KYC form takes name, date of birth, address and an ID number, the four items a US bank must obtain "prior to opening an account" (31 CFR 1020.220). From 10 July 2027, EU rules also list place of birth and nationality (Regulation (EU) 2024/1624 (AMLR), Article 22(1)(a)).
- Document verification. In a remote check, the passport, ID card or driver's license is checked for security features, altered data, a valid machine readable zone, and an image not "displayed on a screen" (the EBA's remote onboarding guidelines, EBA/GL/2022/15, guideline 33). Optical character recognition may read the data, provided it captures it accurately and consistently (guideline 34).
- Match the person. The person must match the document (guideline 38(a)). Biometric verification is optional (guideline 39 applies only where a solution uses it), but unattended remote checks need liveness detection (guideline 41(c)). Biometric data that identifies someone is special category data under UK GDPR Article 9(1). A face match shows the person holds the document; it cannot show that the identity is real, which leaves room for synthetic identities.
- Address, where required. EU and US rules collect an address. Whether a document must prove it depends on the market and the firm's risk policy; the US rule asks for none.
- Sanctions, PEP screening and adverse media. US banks compare the customer with federal lists of known or suspected terrorists (1020.220(a)(4)). From 10 July 2027, EU firms check targeted financial sanctions and politically exposed person (PEP) status (AMLR Article 20(1)(d), (g)).
- Decide. Approve, escalate to enhanced due diligence (EDD), or decline. If identity cannot be verified, no account opens and a suspicious transaction report is considered (Recommendation 10).
- Record and hand over. Records stay at least five years (Recommendation 11; MLR regulation 40). Ongoing monitoring then reviews the customer; identity need not be verified again unless the firm doubts the data (Interpretive Note to Recommendation 10, para 10).
When must KYC verification be complete?
Table 1. The KYC verification rules list (as of October 2026).
| Rule | What it requires | Timing | Note |
|---|---|---|---|
| FATF Recommendation 10; Interpretive Note, paras 11 and 12 | Verification with reliable, independent sources | Before or during the relationship; after it starts only "as soon as reasonably practicable", with risks managed and where needed not to interrupt normal business | Non face to face business is FATF's example; transactions limited by number, type or amount until verified |
| Directive (EU) 2015/849, Articles 13(1)(a) and 14 | A reliable and independent source, including electronic identification | Before; during if necessary not to interrupt normal business and there is little risk; account open, no transactions until verified (14(3)) | Applies through national laws until 10 July 2027; cannot comply, no relationship (14(4)) |
| Regulation (EU) 2024/1624, Articles 22(6) and 23 | An identity document, with independent sources where relevant, or electronic identification (eID) at the "substantial" or "high" level | The same three options (23(1) to (3)) | Applies from 10 July 2027 |
| AMLA standards on customer due diligence, Articles 7 and 8 | Remote checks without eID: controls that the presenter is the document holder | Not a timing rule; the process stops on any doubt (7(2)(d)) | Final report published 30 September 2026, to be submitted to the European Commission for adoption |
| EBA/GL/2022/15, guidelines 9(d) and 38 to 41 | Person matched to document; liveness when unattended | First transaction only after initial CDD | Applies since 2 October 2023 |
| UK MLR 2017, regulations 28(18), 28(19) and 30 | A reliable source independent of the person, or a secure electronic identification process | Before; during if necessary not to interrupt normal business and there is little risk; account open, no transactions until verified (30(4)) | Since 30 June 2026, regulation 30 does not apply to a credit institution's insolvent bank customers under regulation 30ZA |
| 31 CFR 1020.220(a)(2) | Name, date of birth, address and ID number; documents, non documentary methods or both | Collect before opening; verify "within a reasonable time after the account is opened" | The CIP sets terms for using the account meanwhile ((a)(2)(iii)) |
Global regulatory requirements fix when KYC verification must be finished and say nothing about how fast it runs. In the UK and the EU, a bank may open an account before verification ends only if no transaction runs until it is complete (MLR regulation 30(4), regulation 30ZA aside; Directive 2015/849 Article 14(3); AMLR Article 23(3) from 10 July 2027). A US bank collects the four items of step 1 before opening and verifies them "within a reasonable time after the account is opened" (31 CFR 1020.220(a)(2)(ii)). Its CIP sets the terms for using the account meanwhile ((a)(2)(iii)).
Which verification methods do the rules accept?
Three methods count, alone or combined. A document: the passport or ID card of step 2. Independent data: under the US rule's non documentary methods, a bank may compare what the customer gives with a consumer reporting agency or a public database (1020.220(a)(2)(ii)(B)). Electronic identification: eID at the "substantial" or "high" level in the EU from July 2027, or in the UK a process "secure from fraud and misuse" (regulation 28(19)).
Where does KYC verification fail?
Picture an applicant (illustrative) who photographs a genuine passport off a laptop screen, holds a printed photo up to the selfie camera and pays money in before the checks finish. Each move is a common challenge of identity fraud at onboarding, and the rules write down the best practice for each:
- The screen photo. EBA guideline 33(e): the reproduction "has not been displayed on a screen".
- The printed selfie. Liveness detection (guideline 41(c)); for remote checks without eID, AMLA's text calls for controls that the person presenting the document "is the document holder" (Article 7(2)(a)).
- The early payment. No first transaction before initial CDD (guideline 9(d)); in the UK, none before verification (regulation 30(4)).
On any doubt, the process "does not continue" (AMLA Article 7(2)(d)); on poor evidence, EBA guideline 40 restarts it or moves it to a face to face check.
A passport photographed off a screen is a real document. A check that reads only its data passes it, however accurate the reader; the screen test in guideline 33(e) is what catches it.
Who runs each KYC verification step in an AML program?
KYC verification sits at the front of an AML program, and each step has an owner:
- Onboarding team and identity verification (IDV) provider, steps 1 to 4. Document and face checks run on specialist tools.
- Compliance analysts, steps 5 and 6. Hits and scores need judgment, and a foreign PEP needs senior management approval (Recommendation 12).
- MLRO or BSA officer, step 7. The examiner reads the record and the written procedure.
In complead, formerly Sanction Scanner, document and biometric identity verification "operates separately and is handled by your IDV provider". The verified identity is an input to the customer risk assessment model. Customer onboarding then runs KYC checks, screening and adverse media on one record in a single request and logs each decision with its evidence.
What changed for KYC verification in 2026?
- 30 June. S.I. 2026/621 added regulation 30ZA to the UK MLR. A credit institution may let an insolvent bank's customer open an account and transact before customer due diligence is complete, once the customer is identified. The other measures follow as soon as practicable.
- 30 September. AMLA published its final report on the customer due diligence standards under AMLR Article 28(1), including Article 7 on remote checks without eID. It is to be submitted to the European Commission for adoption.
For each product, the firm still decides which steps finish before the account opens, which may finish after it where the rule allows, and where its written procedure says so.
Related terms
- Identity fraud. Using another real person's identifying details.
- Synthetic identity fraud. Building a person who does not exist from real and invented details.
- eKYC. KYC verification done electronically, from document and face checks to data lookups.
- Electronic identity verification. Proving identity without paper: eID schemes, chip reading and databases.
- Customer due diligence. The four measures a firm applies to each customer, identity verification first.
- KYB verification. The same checks for a business, its officers and its owners.
How this entry was checked. Its legal lines go back to Directive (EU) 2015/849 Articles 13 and 14, Directive (EU) 2024/1640 Article 77, Regulation (EU) 2024/1624 Articles 20, 22 and 23, FATF Recommendations 10, 11 and 12 with the Interpretive Note to Recommendation 10 (June 2026 text), AMLA's final report of 30 September 2026 on the customer due diligence standards, the EBA Guidelines on remote customer onboarding (EBA/GL/2022/15), the UK Money Laundering Regulations 2017 (regulations 28, 30, 30ZA and 40, as amended on 30 June 2026), UK GDPR Article 9 and 31 CFR 1020.220. Each was reopened at its source on 28 October 2026. The author is Melis Alparslan (Regional Sales Manager, complead); the fact checker is Dilara Diker (Head of Compliance), and the last review date is 28 October 2026. The seven steps group the duties these rules set, and the applicant in the failure section is illustrative.
