Know Your Customer (KYC) guidelines and regulations in financial services require professionals to verify the identity, suitability, and risks involved with maintaining a business relationship with a customer. The procedures fit within the broader scope of anti-money laundering (AML) and counter terrorism financing (CTF) regulations.
KYC processes are also employed by companies of all sizes for the purpose of ensuring their proposed customers, agents, consultants, or distributors are anti-bribery compliant and are actually who they claim to be. Banks, insurers, export creditors, and other financial institutions are increasingly required to make sure that customers provide detailed due-diligence information. Initially, these regulations were imposed only on the financial institutions, but now the non-financial industry, fintech, virtual assets dealers, and even non-profit organizations are included in regulations in many countries.
In the United States, the Financial Industry Regulatory Authority (FINRA) Rule 2090 states that financial institutions must use reasonable diligence to identify and retain the identity of every customer and every person acting on behalf of those customers.[1] In enforcing this rule these organizations are expected to collect all information essential to knowing their customers. Information deemed necessary for enforcing Know Your Customer Requirements include the Customer Identification Program (CIP), Customer Due Diligence (CDD), and Enhanced Due Diligence (EDD).[2]
Section 326 of the USA Patriot Act requires banks and other financial institutions to have a Customer Identification Program (CIP). Financial institutions must collect four pieces of identifying information about its customers including:
The Bank Secrecy Act, the common name for the Currency and Foreign Transaction Reporting Act of 1970 and its amendments and other statutes[3] established the Customer Due Diligence (CDD) rule as part of their efforts to improve financial transparency and deter money laundering. The CDD Rule enhances CDD requirements for "U.S. banks, mutual funds, brokers or dealers in securities, futures commission merchants, and introducing brokers in commodities.[4]" The CDD rule requires that financial institutions identify and verify the identity of customers associated with open accounts. The CDD Rule has four core requirements:[4]
Identify and verify the identity of customers
Identify and verify the identity of the beneficial owners of companies opening accounts
understand the nature and purpose of customer relationships to develop customer risk profiles
conduct ongoing monitoring to identify and report suspicious transactions, and on a risk basis, to maintain and update customer information
Beneficial owner information is required for any individual who owns 25 percent or more of a legal entity and an individual who controls the legal entity.[4]
Enhanced Due Diligence[5] is required when initial identity checks have been completed and high-risk factors have been identified for an individual or a business. When these requirements have been met "enhanced" or additional due diligence above and beyond CDD is conducted which identifies the following information:[5]
KYCC or Know Your Customer's Customer is a process that identifies a customer's customer activities and nature. This includes the identification of the customer's customers and assessing the risk levels associated with their activities.[6]
KYCC is a derivative of the standard KYC process that arose because of the growing risk of fraud obscured by second-tier business relationships (e.g. a customer's supplier).[6]
Know Your Business or simply KYB is an extension of KYC laws implemented to reduce money laundering. KYB is a set of practices to verify a business. It includes verification of registration credentials, location, the UBOs (Ultimate Beneficial Owners) of that business, etc. Also, the business is screened against blacklists and grey lists to check if it was involved in any sort of criminal activity such as money laundering, terrorist financing, corruption, etc. KYB is significant in identifying fake business entities and shell companies. It is crucial for efficient KYC and AML compliance.
According to the European Union's 5th AML directive,[7] KYB is required for the following AML-regulated entities:
Electronic know your customer (eKYC) involves the use of internet or digital means of identity verification.[8] This may involve checking information provided is valid by using systems to validate ID and proof of address documents or by checking information against government databases such as the official passport database of a country.[9]
Canada: The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), established in 2000, is Canada's financial intelligence unit. It updated its regulations in June 2016 regarding acceptable methods to determine the identity of individual clients to ensure compliance with AML and KYC regulations. A pending lawsuit is active in Canada challenging the constitutionality of the new legislation.[12]
Italy: The Banca d'Italia exercises regulation power for the financial industry, in 2007 set KYC requirements for financial institutions that operate on Italian territory.[14]
Japan: Act on identification of customers by financial institutions 2003[15]
Mexico: The "Federal Law for Prevention and Identification of Operations with Resources from Illicit Origin", promulgated in 2012 with president Felipe Calderon's administration and came into force in 2013 with the president Enrique Peña Nieto administration.[16]
Namibia: Financial Intelligence Act, 2012 (Act No. 13 of 2012) published as Government Notice 299 in Gazette 5096 of 14 December 2012.[17]
New Zealand: Updated KYC laws were enacted in late 2009 and entered into force in 2010. KYC is mandatory for all registered banks and financial institutions (the latter has an extremely wide meaning).[18]
South Korea: Act on Reporting and Use of Certain Financial Transaction Information regulates due diligence in the country.[19]
United Kingdom: The Money Laundering Regulations 2017[20] are the underlying rules that govern KYC in the UK. Many UK businesses use the guidance provided by the European Joint Money Laundering Steering Group along with the Financial Conduct Authority's 'Financial Crime: A guide for firms' as an aid to compliance.[21]
Know your customer places a costly burden on businesses operating in the financial industry, especially smaller financial companies, where compliance costs are disproportionately heavy.[22]
Customers may feel the information requested to be intrusive and burdensome, and may choose not to enter the business relationship as a result.[23] Relatedly, there may be privacy concerns with how the information is used.[24]
Innocent, law-abiding individuals such as digital nomads are very likely disproportionately disadvantaged as living a nomadic life makes it increasingly difficult or even impossible to hold any formal banking relationship anywhere in the world due to lack of proof of address, bills, and/or debt documentation required by KYC.[25]
Some citizens in other countries (Canada) are fighting back against the USA over-reach into their sovereign banking system and have challenged new USA law in their courts.[26][27]
