What Is KYC (Know Your Customer)? Meaning, Process and Requirements
KYC (Know Your Customer) is the process a business uses to verify who its customers are, assess how risky each one is, and keep monitoring them over time. It is a core part of anti-money laundering (AML) compliance, legally required for banks, fintechs, crypto exchanges and gambling operators, and increasingly used by marketplaces, telcos and mobility services to stop fraud before it starts.
In a digital world where anyone can sign up from anywhere, KYC is the digital identity check that makes online trust possible. This guide explains what KYC means, how the process works step by step, which documents and regulations apply, and when a lighter, risk-based approach is enough.
Key takeaways
KYC verifies identity, assesses risk and monitors customers throughout the relationship, not just at sign-up.
It has three components: Customer Identification Program (CIP), Customer Due Diligence (CDD) and ongoing monitoring.
KYC is one part of AML. AML is the wider legal framework; KYC is the customer-facing process inside it.
Requirements are risk-based: low-risk customers get simplified checks, high-risk customers get enhanced due diligence (EDD).
Regulated sectors must do KYC by law.
Other industries often adopt "lightweight KYC" to fight fraud without hurting conversion.
In the EU, the new AML Regulation (AMLR) applies from 10 July 2027, so now is the time to review your setup.
What does KYC mean?
KYC stands for Know Your Customer (also written Know Your Client). It is the due diligence a business performs to make sure that John Smith is really John Smith, and not someone using a stolen or synthetic identity.
A good KYC process answers three questions:
Who is the customer?
Identity
How risky are they?
Financial crime and fraud risk
Is their behaviour expected?
Monitoring
The purpose is to stop bad actors, such as people attempting money laundering, fraud or terrorist financing, from using your service. The scale of the problem is large: the United Nations Office on Drugs and Crime (UNODC) estimates that 2% to 5% of global GDP, roughly US$800 billion to US$2 trillion a year, is laundered.
KYC also protects honest customers. Verified platforms are harder to abuse (e.g., online marketplaces) with fake accounts, account takeovers and impersonation, which is why trust, brand reputation and compliance all depend on it.
KYC vs AML vs CDD
These terms are often used interchangeably, but they are not the same thing.
AML (Anti-Money Laundering)
The full legal and regulatory framework: KYC, transaction monitoring, sanctions screening, suspicious activity reporting, record-keeping.
KYC (Know Your Customer)
Identifying and verifying a customer and understanding their risk.
CDD (Customer Due Diligence)
The risk-assessment layer of KYC: understanding the customer, the purpose of the relationship and expected activity
The simple way to remember it: AML is the big security umbrella. KYC is the first and most visible step under it.
How does the KYC process work?
A complete KYC programme has three parts. Together they cover the whole customer lifecycle.
1. Customer Identification Program (CIP)
CIP is the identity verification step. The business collects basic details (full name, date of birth, address, ID number) and checks that they are real and belong to the person applying. Modern digital flows typically include:
Verifying that a government-issued ID is genuine and not forged
Checking the document holder's liveness, so a photo, mask or deepfake cannot pass
Matching the selfie to the portrait on the ID
Age verification where required
2. Customer Due Diligence (CDD)
Once identity is established, the business looks deeper. Is the customer on a sanctions or watchlist? Are they a Politically Exposed Person (PEP)? What is the purpose of the relationship and what activity is expected? The answers produce a risk rating that decides how much scrutiny follows.
Due diligence is tiered, which is what makes KYC proportionate:
Level | When it applies |
Simplified Due Diligence (SDD) | Low risk, such as low-value products |
Standard CDD | Most customers |
Enhanced Due Diligence (EDD) | High risk, such as PEPs, high-risk jurisdictions, complex ownership |
3. Ongoing monitoring
Compliance is not a one-time event. Customers change, and so does their risk. Ongoing monitoring means watching transactions and behavior, re-screening against sanctions, PEP and adverse media lists, and refreshing records. Typical triggers for re-verification include unusual transaction activity, a change in the customer's business or occupation, new parties added to an account, or an expiring ID.
Many firms are moving from fixed review cycles (commonly annual for high-risk customers and every three to five years for low-risk ones) to perpetual KYC, where reviews are triggered in near real time by changes in behavior or risk signals.
The KYC onboarding flow in six steps:
Collect the customer's personal details.
Verify the ID document (authenticity, expiry, tampering).
Verify ID document ownership (check liveness and match the face to the document).
Verify address where the rules or the risk require it.
Screen against sanctions, PEP and adverse media lists.
Score the risk and decide: approve, request more information, escalate for manual review or reject.
Which documents are needed for KYC?
Exact requirements depend on the country, the industry and the customer's risk level, but most processes ask for:
Proof of identity: a government-issued photo ID such as a passport, national ID card. In some cases driving licence and residence permit are also accepted.
Proof of address: a recent utility bill or bank statement (often dated within three months), second ID document, or a database check.
A selfie or short video for biometric matching and liveness to prove ID ownership.
For higher-risk customers: source of funds or source of wealth evidence.
For businesses (KYB): registration documents, ownership structure and identification of UBOs, usually anyone owning or controlling 25% or more.
Types of KYC verification
Method | How it works |
In-person (traditional) KYC | Customer presents documents at a branch |
Digital KYC / eKYC | ID capture, selfie and liveness done remotely on a phone |
Automated KYC | AI reads the document, checks authenticity and decides instantly, with manual review only for edge cases |
Video identification | A trained agent verifies the customer in a live video session |
Database verification | Customer data is checked against trusted government or credit sources |
Most regulated businesses combine several of these, adding checks as risk increases.
Who needs KYC?
KYC is mandatory for any business covered by AML law. Typical examples:
Banks, credit unions and neobanks: the strictest requirements.
Fintechs and payment providers: digital wallets, payment apps and lenders.
Crypto exchanges and wallet providers: subject to FATF virtual asset rules, including the Travel Rule.
Betting and iGaming operators: to verify age, identity and location, and to prevent underage play, bonus abuse and money laundering.
Insurance, real estate, lawyers, accountants and dealers in high-value goods: often covered as "designated non-financial businesses and professions".
Beyond the legally obliged, many businesses choose to verify users because fraud, account abuse and money-mule activity affect them too. Industries where high trust, like online marketplaces or rental, is a real business differentiator, need to invest in some version of the KYC. That is where lightweight KYC comes in.
What is lightweight KYC?
Lightweight KYC is a streamlined, risk-based identity check for high-volume, lower-risk services. It confirms who the user is and screens for essential risks without the full due diligence of a bank, striking a balance between speed, cost and compliance.
It is commonly used in:
Mobility and rental: car sharing, scooters, vehicle rental (identity, driving licence).
Online marketplaces: verifying buyers and sellers to reduce scams and fake accounts.
Telecom: SIM registration and contract sign-up.
Certain levels of gaming and gambling: age and identity checks before play.
Lightweight KYC | Standard KYC | Enhanced due diligence | |
Typical users | Rental, marketplaces, telco, lower-tier gaming | Banks, fintechs, crypto | PEPs, high-risk jurisdictions, complex ownership |
Checks | ID document, selfie and liveness, essential screening | Full CIP, CDD, risk scoring, monitoring | Source of funds and wealth, senior sign-off, frequent review |
Speed | Seconds to minutes | Minutes to days | Days or longer |
Goal | Stop fraud with minimal friction | Meet AML obligations | Manage elevated financial crime risk |
Important: lightweight KYC is only appropriate where the law and your risk assessment allow it. If your business falls under AML obligations, you must apply the standard your regulator requires. Start light and add checks as the risk signals grow.
KYC regulations around the world
No one does KYC for fun. It is enforced by regulators, and nearly all of them trace back to the Financial Action Task Force (FATF), the global body whose recommendations on customer due diligence, beneficial ownership and the risk-based approach shape AML laws in nearly 200 jurisdictions.
Region | Key framework | What to know |
European Union | AML Regulation (EU) 2024/1624 (AMLR), AMLD6 (Directive (EU) 2024/1640), AMLA | AMLR applies directly from 10 July 2027 and replaces differing national rules with one rulebook. The EU's new AML Authority (AMLA) is based in Frankfurt and began operating in July 2025, with direct supervision of selected high-risk institutions from 2028. |
United States | Bank Secrecy Act (BSA), USA PATRIOT Act, FinCEN's CDD Rule | Financial institutions must run a Customer Identification Program, perform due diligence and identify beneficial owners holding 25% or more of a legal entity. |
United Kingdom | Money Laundering Regulations 2017, supervised by the FCA and other bodies | Risk-based CDD and EDD, similar in spirit to the EU framework. |
Canada | PCMLTFA, enforced by FINTRAC | Triggers are often threshold-based. For example, identity must be verified when initiating or receiving an international electronic funds transfer of CAD 1,000 or more. |
Japan | Act on Prevention of Transfer of Criminal Proceeds (APTCP) | Covers banks, crypto exchanges and other specified businesses; verification and transaction records must be kept for seven years. |
Requirements change frequently, so always confirm current rules with your regulator or legal counsel. This article is general information, not legal advice.
What happens if a business gets KYC wrong?
Penalties go well beyond fines: restrictions on growth, remediation orders, loss of licence, criminal liability for individuals and lasting reputational damage. Recent examples show regulators are looking at the effectiveness of controls, not only onboarding checks:
Saxo Bank (Denmark, January 2026): fined DKK 313 million (about US$50 million) for breaches of the Money Laundering Act, even though the inspection found no actual money laundering. Structural control failures were enough.
J.P. Morgan SE (Germany, 2025): a record EUR 45 million BaFin fine for delays in filing suspicious activity reports.
Nine financial institutions (Singapore, July 2025): S$27.45 million in combined MAS penalties, citing weak customer due diligence and delayed reporting.
TD Bank (USA, 2024): a US$3 billion penalty tied to money laundering failures.
The cost of getting compliance right is rising too. Juniper Research forecasts that financial firms will spend about US$30.5 billion globally on KYC and KYB systems by 2030, up roughly 40% from 2025.
KYC trends to watch
AI-generated fake IDs and deepfakes: Fraud tools have become cheap and convincing, so upload-only checks are increasingly weak. Liveness detection, document forensics and NFC chip reading are becoming standard.
Perpetual KYC: Event-triggered reviews are replacing fixed calendars, so risk changes are caught in near real time.
EU harmonization: With AMLR arriving in July 2027, businesses operating across Europe should map their onboarding and monitoring against the new single rulebook.
Digital identity wallets: European digital identity wallets and eID schemes promise faster, reusable verification. Adoption is rising, but still not there.
Risk-based friction. Instead of one flow for everyone, leading businesses add checks only when risk signals appear, protecting conversion without lowering protection.
How to choose a KYC provider?
Since doing all of this manually is impossible, most businesses use an external partner. Choose your identity verification or KYC/AML vendor with extreme care. Don't look at it as just buying another software tool, you are actually looking for a long-term strategic partner who will directly impact your user conversion, compliance safety, and bottom line. If you need step by step guide, check out our blog: How to choose an identity verification or KYC vendor?
KYC FAQ
What does KYC stand for?
KYC stands for Know Your Customer, sometimes written Know Your Client. It is the process of verifying a customer's identity and assessing their risk.
Is KYC mandatory?
Yes for businesses covered by AML laws, such as banks, fintechs, crypto platforms, gambling operators and several professional services. Other businesses are not legally required to do KYC but often choose to, to reduce fraud and protect users.
What is the difference between KYC and AML?
AML (Anti-Money Laundering) is the broad framework of laws and controls that prevent money laundering. KYC is one core part of it: the process of identifying and verifying customers and understanding their risk.
What documents do I need for KYC?
Usually a government-issued photo ID (passport, national ID or driving licence), proof of address, and a selfie for biometric matching. Higher-risk customers may also need to show source of funds.
How long does KYC verification take?
Automated digital KYC can take seconds to minutes. Manual reviews can take days, and enhanced due diligence can take longer.
What is eKYC?
eKYC (electronic KYC) is KYC completed remotely using digital tools such as document scanning, facial biometrics, liveness detection and database checks, with no branch visit required.
What triggers KYC re-verification?
Common triggers are unusual transaction activity, changes in the customer's business or personal details, new parties added to an account, an expiring ID document, or new sanctions, PEP or adverse media matches.
What happens if KYC verification fails?
The business may request more information, apply enhanced due diligence or decline the relationship. In regulated sectors it cannot proceed with onboarding until identity is established.
