What Is KYC? Know Your Customer Meaning and Requirements

Search Fintrev

Search our guides, reviews and glossary.

KYC (Know Your Customer, also called Know Your Client) is the process financial institutions use to verify who a customer is, understand what the account will be used for, and assess the risk that the relationship could be used for money laundering, terrorist financing, fraud or other financial crime. In practice, KYC means collecting identifying information when an account is opened, checking it against reliable sources, and keeping that customer profile current for as long as the relationship lasts.

The term has two related senses. In banking and anti-money laundering (AML) rules, KYC is about identity and risk. In the US securities industry, it is also a broker-dealer conduct rule requiring firms to understand each client’s profile.

How KYC Works

Customer Identification Program (CIP)

The CIP is the entry point. Under US rules, a covered financial institution must collect at least four pieces of information before opening an account: name, date of birth, address, and an identification number (for US persons, typically a Social Security number or taxpayer ID). The institution then verifies that information, either with documents such as a government-issued photo ID or through non-documentary methods such as checking a credit bureau or public database.

Customer Due Diligence (CDD)

CDD goes beyond confirming identity. The institution needs to understand the nature and purpose of the relationship: what the account is for, where the money comes from, and what activity is expected. From that, it builds a risk profile for the customer. FinCEN’s CDD rule also requires institutions to identify the beneficial owners of legal entity customers: individuals who own 25% or more of the company, plus one person with significant control, such as a CEO or managing partner. This prevents a shell company from serving as an anonymous front.

CDD is ongoing. Institutions must keep customer information accurate and up to date and monitor accounts for activity that does not match the profile.

Enhanced Due Diligence (EDD)

EDD applies to customers whose risk profile is higher than normal, for example politically exposed persons, customers in high-risk jurisdictions, businesses that handle large volumes of cash, or accounts with complex ownership structures. EDD can mean collecting more documentation on source of funds and source of wealth, senior management approval to open the account, and more frequent reviews of transactions.

Interpreting a KYC Risk Rating

The output of KYC is not a simple pass or fail. A customer can be verified and still be rated higher risk, which changes how closely the account is watched rather than whether it exists. When monitoring flags activity that may be illegal, US institutions must report it to FinCEN, generally through a suspicious activity report.

Example of KYC

Hypothetical example. A small import company applies for a business checking account.

1. CIP: the bank collects the company’s legal name, address and employer identification number, and verifies them against formation documents. It also collects and verifies the name, date of birth, address and ID number of the person opening the account.
2. CDD: the company lists two owners at 40% each and an operations director who runs the business. The bank identifies and verifies both owners and the director as the control person. The application states expected monthly deposits from overseas customers and outgoing wires to suppliers.
3. EDD trigger: one supplier country is on the bank’s high-risk list, so the bank requests invoices and supplier contracts and sets a shorter review cycle.
4. Monitoring: six months later, deposits arrive in large cash amounts that do not fit an import business that invoices by wire. The mismatch with the stated profile is what triggers an internal investigation and, if unresolved, a report.

Regulatory Rules for KYC Compliance

Bank Secrecy Act and FinCEN. The Bank Secrecy Act of 1970, expanded by the USA PATRIOT Act of 2001, is the backbone of US AML law. The PATRIOT Act introduced the CIP requirement, and FinCEN’s CDD rule (effective 2018) added beneficial ownership and formalized ongoing monitoring.

FINRA Rule 2090 (Know Your Customer). Broker-dealers must use reasonable diligence when opening and maintaining accounts, know and keep records of the essential facts about each customer, and identify every person with authority to act on the customer’s behalf.

FINRA Rule 2111 (Suitability). A broker-dealer must have a reasonable basis to believe a recommended transaction or strategy is suitable for the customer, based on the customer’s investment profile: financial situation, needs, other holdings, objectives and risk tolerance.

Other countries have their own versions, generally shaped by the recommendations of the Financial Action Task Force (FATF), so the documents requested and thresholds applied differ by jurisdiction.

KYC vs. AML

AML is the full set of policies, controls and reporting a firm uses to detect and prevent money laundering. KYC is the part that establishes who the customer is and what normal activity looks like; transaction monitoring, sanctions screening, suspicious activity reporting, staff training and independent audits are other parts. A firm can verify every customer perfectly and still have a weak AML program if it never reviews what those customers do.

KYC vs. Suitability

In securities, KYC asks who the customer is and what their profile looks like; suitability asks whether a specific recommendation fits that profile. The first is a precondition for the second.

KYC in Banking and Fintech

The same KYC obligations that apply to banks also apply to many fintech firms, payment apps and digital wallets, which is why services that move money often ask for ID and a Social Security number before allowing larger transfers or withdrawals. Without verification, a regulated institution can refuse to open an account, restrict it, or freeze withdrawals until the requested information is provided.

How KYC Applies to Cryptocurrency

Crypto’s pseudonymous design makes money laundering harder to detect, and regulators have pushed KYC into the sector. Under FinCEN guidance, crypto exchanges and other businesses that transmit virtual currency are generally treated as money services businesses, which brings registration, customer identification and reporting duties. Fiat-to-crypto exchanges also connect to bank accounts, so customers who fund them through a bank have already passed that bank’s KYC.

Enforcement has reached services built to obscure transactions. FinCEN assessed a $60 million civil penalty against Larry Dean Harmon, operator of the Helix bitcoin mixer, for violating anti-money laundering laws. Separately, FinCEN proposed a rule in December 2020 that would have required recordkeeping and identity verification for certain transactions involving unhosted crypto wallets; the proposal was withdrawn on August 16, 2024.

KYC Documents

Most institutions ask for a government-issued photo ID, such as a passport or driver’s license; some require a second form, such as a birth certificate or Social Security card. The address must be confirmed from the ID or from a separate document such as a utility bill or bank statement. Business accounts add formation documents and beneficial ownership details, and EDD cases may require proof of source of funds.

Limitations of KYC

• Documents can be forged or stolen. Verification confirms that information is consistent, not that the person presenting it is honest. Synthetic identities, built from a mix of real and invented data, are designed to pass these checks.
• A profile is only as good as its updates. A customer verified years ago may have changed business, ownership or behavior; stale records weaken monitoring.
• It can exclude legitimate customers. People without standard ID or a fixed address can struggle to open accounts.
• Rules vary across borders. Different national standards create gaps that criminals can exploit by routing activity through weaker jurisdictions.

The Bottom Line

Anyone opening a bank, brokerage, payment app or crypto exchange account will go through KYC, and missing information can lead an institution to refuse, restrict or freeze the account. Having a photo ID, proof of address and, for businesses, ownership details ready makes the process smoother. KYC is only one part of an AML program, and its checks are only as reliable as the documents and updates behind them.