What Is KYC? Know Your Customer Explained

KYC meaning: what it is and why it exists

KYC stands for Know Your Customer. It is the set of checks a business runs to confirm that a customer is a real person or legal entity, that they are who they say they are, and that the risk they bring is understood and acceptable. The checks happen at onboarding and continue for as long as the relationship lasts.

The legal basis is anti-money laundering (AML) and counter-terrorism financing law. The Financial Action Task Force (FATF) sets the international standard; its Recommendation 10 covers customer due diligence. Countries turn that standard into national rules, such as the Bank Secrecy Act and USA PATRIOT Act in the United States (supervised in part by FinCEN, whose Customer Identification Program and customer due diligence rules set the US baseline), the AML/CTF Act 2006 in Australia (supervised by AUSTRAC), and the Money Laundering Regulations 2017 in the United Kingdom. Requirements change, so check the current rules with your regulator or legal counsel. This page is information, not legal advice.

One point the short definitions miss: KYC is a risk decision, not just an identity check. Confirming a passport is genuine answers "is this person real?" KYC also asks "should we do business with them, on what terms, and how closely should we watch the account?"

The three components of KYC

1. Customer identification program (CIP)

Collect identifying information and verify it against reliable, independent sources. For an individual this is typically full name, date of birth, address and an identifier, verified through a government-issued ID document, a database match, or both. This is the step most people mean when they say "KYC verification".

2. Customer due diligence (CDD)

Build a risk profile. This includes screening against sanctions lists and for politically exposed persons (PEPs), understanding the purpose of the account, and identifying beneficial owners when the customer is a company. Higher-risk customers get enhanced due diligence (EDD): more documents, source-of-funds or source-of-wealth evidence, and senior approval. Lower-risk customers may qualify for simplified measures where local rules allow. See our AML screening product and the sanctions screening guide for how the screening part works.

3. Ongoing monitoring

Risk changes after onboarding. Ongoing monitoring covers transaction monitoring for unusual activity, re-screening customers when sanctions or PEP lists update, and periodic or event-driven refreshes of customer information. A customer who was low risk on day one can be high risk a year later.

Who must do KYC

Obligations attach to "regulated" or "reporting" entities defined in national law. The exact list differs by country, but commonly includes:

• Banks, credit unions and lenders: the original and most heavily regulated KYC population. See banking and finance.
• Payment providers, money transfer and other fintechs: often licensed or registered as money service businesses or payment institutions.
• Crypto asset service providers: FATF standards extend to virtual asset service providers. See crypto KYC.
• Insurers and brokers: mainly in life and investment products. See insurance.
• Gambling operators: casinos and online betting operators in many jurisdictions. See gaming and iGaming.
• Designated non-financial businesses and professions: such as real estate agents, lawyers, accountants and dealers in high-value goods. Australia's "Tranche 2" reforms extend obligations to more of these sectors; see Tranche 2 AML in Australia.

Unregulated businesses also run KYC-style checks voluntarily, for example marketplaces, sharing-economy platforms and e-commerce merchants that want to reduce fraud, chargebacks or underage sales. There the design is yours to choose, not a legal mandate.

Documents and data used in KYC

What you ask for should scale with risk and with local rules. Typical inputs:

• Identity documents: passport, national ID card or driver licence. See types of identity documents.
• Biometrics: a selfie matched to the ID photo, with liveness detection to confirm a live person is present.
• Database sources: electronic identity verification (eIDV) checks against credit, government or other data. See how eIDV works.
• Proof of address: a utility bill or bank statement, or an address check against data sources. See address verification.
• Contact and device signals: email, phone, IP and device intelligence, useful for fraud signals even where they are not legal KYC requirements.
• Business customers: registration documents, ownership structure and details of beneficial owners.

KYC online, in brief

Online KYC replaces branch visits and paper copies with a remote flow: the customer captures an ID and a selfie, the document and face are checked, details are matched against independent data, and the result is screened and risk-scored. Done well it takes minutes rather than days and applies the same rules to every applicant, though regulators set conditions on remote onboarding, so confirm what yours accepts. The full walk-through, with a comparison against traditional KYC, is in our guide to what eKYC is and how it works; ScreenlyyID provides the identity verification, AML screening and fraud-signal building blocks through one API.

KYC vs AML vs KYB

• AML is the whole framework of laws and controls for preventing money laundering and terrorism financing. KYC is one part of it, alongside transaction monitoring, suspicious activity reporting, training and governance.
• KYB (Know Your Business) applies KYC principles to companies: verifying the entity, then identifying and checking the people who own or control it.

Read more about the wider framework on our anti-money laundering page.

How long does KYC take, and what does it cost?

Time depends on method and risk. Automated checks on a clean case can finish in minutes. Cases sent to manual review, high-risk customers, and business customers with layered ownership take longer, sometimes days, mainly because of waiting on the customer for documents.

Cost depends on volume, the number of checks per customer (document, biometric, database, screening), your manual review rate and your re-screening frequency. The cheapest line item is often the check itself; the expensive one is staff time spent on avoidable reviews. See ScreenlyyID pricing for how our checks are priced.

Common KYC failures

• One-size-fits-all flows: asking every customer for everything frustrates low-risk users, while asking too little of high-risk ones creates regulatory exposure.
• Treating onboarding as the end: no re-screening or monitoring means sanctioned or newly PEP customers go unnoticed.
• Weak document and liveness checks: accepting a photo of a screen or a forged ID. See detecting forged IDs.
• Poor image capture: glare, blur and cropping cause false rejections and abandonment.
• Ignoring beneficial owners: verifying a company but not the people behind it.
• Gaps in records: a decision you cannot evidence to an auditor is, in practice, a decision you did not make.
• Unclear review rules: reviewers apply different standards because the policy is vague.

Start verifying customers

If you are building or replacing a KYC flow, you can sign up for ScreenlyyID self-serve and test identity verification, screening and validation checks through the API. Start with pricing and sign-up, or explore the wider KYC hub first.