Know-your-customer (KYC) requirements explained

Know-your-customer (KYC) requirements are the rules that make a financial institution find out who its customers are before and while it does business with them. KYC is not a single statute. It is a practice built from several regulations under the Bank Secrecy Act: customer identification programs, customer due diligence and, for higher-risk relationships, enhanced due diligence. Together, they let institutions spot and report money laundering, terrorist financing and fraud.

If you have ever been asked for a driver’s license, a Social Security number or business ownership documents when opening an account, you have met KYC. This guide explains what institutions must do, why, and how the rules differ for individuals and companies.

In brief

• KYC rests on the Bank Secrecy Act and its implementing rules in 31 CFR Chapter X.
• FinCEN’s customer due diligence (CDD) rule requires covered institutions to maintain written policies and procedures with four core elements.
• Covered institutions include US banks, mutual funds, securities broker-dealers, futures commission merchants and introducing brokers in commodities.
• For legal entity customers, institutions must identify the beneficial owners.
• KYC is continuing. Institutions must monitor accounts and update information based on risk.

Why KYC exists

Money laundering relies on anonymity. If an institution does not know who owns an account, it cannot tell whether activity is consistent with the customer’s profile, and it cannot give investigators useful information. FinCEN says the CDD rule amends BSA regulations to strengthen financial transparency and make it harder for bad actors to use companies to hide illicit activity.

KYC is also a risk management tool for the institution. Knowing the customer helps detect fraud, avoid dealing with sanctioned parties and decide which products suit which clients.

The layers of KYC

Customer identification

The customer identification program (CIP) rules, which implement Section 326 of the USA PATRIOT Act, require institutions to collect basic identifying information when an account is opened and to verify it using documents, nondocumentary methods or both. For an individual, the data typically includes name, date of birth, address and an identification number. Institutions must keep records of what they collected and how they verified it, and they must check names against government lists of known or suspected terrorists where such lists are designated for the purpose.

Customer due diligence

The CDD rule adds more. FinCEN states that covered institutions must maintain written policies and procedures designed to:

1. Identify and verify customers’ identities.
2. Identify and verify the beneficial owners of legal entities that open accounts.
3. Understand the nature and purpose of customer relationships so as to build customer risk profiles.
4. Conduct ongoing monitoring to detect and report suspicious transactions and, on a risk basis, update customer information.

The first element overlaps with CIP, while the other three are the heart of the CDD rule.

Enhanced due diligence

For customers or accounts that present higher risk, institutions apply more intensive measures. Examples include senior foreign political figures, correspondent accounts for foreign banks, and private banking accounts for non-US persons, where specific statutory provisions apply. Institutions also choose to apply enhanced scrutiny to categories their own risk assessment flags, such as cash-intensive businesses or customers in higher-risk jurisdictions.

Beneficial ownership

The beneficial ownership requirement is the part of KYC that confuses most business owners. According to FinCEN, beneficial owners are the natural persons who own, control and profit from a legal entity customer. A covered institution must identify and verify two kinds of people:

• Each individual who owns 25 percent or more of the equity interests of the legal entity customer.
• One individual who has significant responsibility to control, manage or direct the entity, such as an executive officer or senior manager.

If no one meets the ownership test, the institution still collects the control person. For some entities, such as certain regulated or publicly listed companies, exclusions apply. The institution may rely on the information provided by the customer, as long as it has no knowledge of facts that call its reliability into question, but it must verify the identity of each person it lists.

Separate from the CDD rule, the Corporate Transparency Act created a federal beneficial ownership reporting regime for companies. Its scope and requirements have been revised and litigated, so readers who must report should consult FinCEN’s current guidance. The CDD rule applies to financial institutions’ account opening and exists independently.

FinCEN has also granted exceptive relief in certain situations, such as for some account rollovers and renewals. Its CDD page lists administrative rulings and relief that institutions can use.

Who must comply

The CDD rule names US banks, mutual funds, brokers or dealers in securities, futures commission merchants and introducing brokers in commodities as covered financial institutions. Other businesses, such as money services businesses and casinos, have separate AML program rules that also include customer verification and risk-based procedures, although they are not all subject to the CDD rule’s text. The scope of coverage has been a subject of FinCEN rulemaking over time, so check current requirements for specific sectors such as investment advisers.

Ongoing monitoring

KYC does not end at onboarding. The fourth element in the CDD rule calls for ongoing monitoring to detect and report suspicious transactions and, on a risk basis, to maintain and update customer information. Triggers for refreshing a file might include a change in ownership, an unusual spike in activity, adverse news or an event that moves the customer into a higher risk category. Many institutions also run periodic reviews on a schedule keyed to risk: more often for high-risk customers, less often for low-risk ones.

Customer information that is updated this way supports the institution’s ability to file suspicious activity reports with a complete picture.

What customers can expect

Customers will usually be asked for a government-issued photo ID and an identifying number for individuals, and formation documents and ownership information for entities. Institutions may request source of funds or source of wealth documentation for larger or more complex relationships. Delays occur when records do not match, when entity structures are layered or when identification is expired.

Customers may feel that questions are intrusive. The institution’s own regulators examine it on these procedures, so staff typically cannot waive them. Privacy laws and the institution’s policies govern how customer information is protected and shared.

Common misconceptions

“KYC is a one-time form.” It is a continuing process that includes risk profiling and monitoring.

“KYC is only for banks.” Securities firms, futures firms and other businesses have analogous duties, and many nonfinancial companies conduct KYC-style checks for business reasons.

“Beneficial owner means anyone with a financial stake.” The CDD rule uses a 25 percent ownership prong and a control prong, and requires natural persons, not other companies.

“A KYC check protects against all fraud.” It reduces risk but does not remove it. Documents can be forged, and identity theft is common.

“KYC and sanctions screening are identical.” They are related but separate. Sanctions screening checks names against OFAC lists, while KYC builds the customer profile.

A worked example

A three-person consulting firm organized as a limited liability company applies for a business checking account at a bank. The bank collects the company’s name, address and tax identification number and verifies its existence through formation documents. It asks for the individuals who own 25 percent or more. Two partners each own 40 percent and a third owns 20 percent. The bank identifies and verifies the two 40 percent owners. It also asks for one control person; one of the owners serves as managing member and is designated.

The bank asks about the firm’s expected activity, including typical deposits and whether it will send international wires, and records a risk rating. Six months later, the account starts receiving large international transfers unrelated to consulting. Monitoring flags the change, the bank reviews and updates the file, and, if the activity remains unexplained, considers filing a SAR.

FAQ

Is KYC the same as customer due diligence?

KYC is the general term. Customer due diligence is the specific regulatory term in FinCEN’s rule. KYC also includes the customer identification program.

What is the ownership threshold for beneficial owners?

Under the CDD rule, 25 percent or more of the equity interests, plus one control person. Always check the current text on FinCEN’s site and the eCFR.

Do institutions have to verify beneficial owners with documents?

They must verify identity using risk-based procedures, which can include documents or other methods. The institution may rely on the certification provided by the customer for the ownership information itself.

Can an institution refuse to open an account?

Yes. If it cannot form a reasonable belief that it knows the customer’s identity, its program must say what happens, which may include declining the account or closing it.

Where can I read the rule?

FinCEN’s CDD page and FAQs explain the rule, and the regulatory text is in 31 CFR Chapter X.