KYC Verification Process: The Steps, Methods, and Documents You Need

This guide walks through the KYC verification process step by step, the three core stages, the checks and documents each one runs on, the methods providers use, and how to choose or implement it.

Every regulated business asks new customers the same question before letting them in. Are you really who you say you are? KYC verification, short for Know Your Customer verification, is the process that answers it, and this guide is about that process itself, not the theory behind it.

Below is the three-step sequence in order, the checks and documents each step actually runs on, the methods providers use to run them, how the process changes by region, and what to look for when you choose a provider or build the process yourself.

The KYC verification process: three core steps

The KYC verification process runs in three steps, and every regulated sector follows the same underlying sequence even when the depth of each step changes with the customer’s risk. And it does not end once a customer is onboarded. A customer who passes every check on day one can still become a money-laundering risk six months later, which is why the third step never really switches off.

1. Customer Identification Program (CIP): Collects and verifies who the customer is.
2. Customer Due Diligence (CDD): Assesses how risky that customer is and screens them against watchlists.
3. Ongoing monitoring: Tracks the customer’s activity for as long as the relationship continues.

Regulators require all three steps by law, and if you get them wrong, you can face penalties. The EU’s Anti-Money Laundering Authority can fine serious breaches up to €10 million or 10% of annual turnover, whichever is higher, and FinCEN has issued US penalties in the hundreds of millions of dollars for a single bank. 

Here is what happens at each stage.

Step 1: Customer Identification Program (CIP)

Customer Identification Program answers a simple question: ‘Is this person really who they say they are?’ To do so, a business collects four core data points under CIP, the customer’s full name, date of birth, residential address, and an identification number, then verifies each against a reliable source, usually a government-issued document. 

In the United States, these steps are stated in Section 326 of the USA PATRIOT Act, codified at 31 CFR 1020.220, which requires banks to maintain a written Customer Identification Program that does exactly this.

Step 2: Customer Due Diligence (CDD)

Once identity is confirmed, Customer Due Diligence decides how risky the customer is. The process entails screening the customer against sanctions lists, watchlists, and politically exposed person (PEP) databases, meaning individuals who hold or have held a prominent public position and therefore carry higher corruption risk, then assigns a risk rating to that individual.

Most customers clear standard due diligence without ever needing an enhanced review because of their low risk. On the other hand, the customers who do trigger EDD are the ones a compliance team should focus on, and that is exactly what the next section addresses.

Step 3: Ongoing monitoring

The third step is ongoing monitoring that watches transactions and behaviour for signs of new risk after the account has been opened, including unusual transaction patterns, logins from unexpected locations, and activity that no longer matches the customer’s original profile. When something looks off, the customer can be re-verified or escalated for review.

Security teams often call this model perpetual KYC, or pKYC, since it replaces a fixed annual review with continuous, trigger-based re-checks. The section on periodic refresh below sets out how often that should happen by risk tier.

Is it three steps or four? Where EDD fits

Some frameworks present a four-step model, but it is an extension of the three-step process rather than a replacement for it.

The four-step view simply breaks Enhanced Due Diligence out of CDD and gives it its own named stage. That makes operational sense for a fintech, crypto exchange, or wealth manager that runs EDD often enough to justify a dedicated workflow and escalation team. 

A different four, inside the regulation itself

A separate four shows up in the regulatory text, and it is easy to confuse with the four-step question above. FinCEN’s CDD Rule, at 31 CFR 1020.210(b), sets out four core elements a bank’s due diligence programme must cover: identifying and verifying customer identity, identifying and verifying beneficial owners, understanding the nature and purpose of the relationship, and ongoing monitoring. 

Those four elements sit entirely inside the three steps above rather than beside them. The first maps to CIP, the middle two sit inside CDD, and the fourth is the ongoing monitoring step. They describe what CDD has to contain in detail, not a fourth step layered on top of it.

What are KYC checks?

A KYC step is the framework, whereas a KYC check is the individual verification performed inside it, and these two should not be confused as one.

KYC verification documents

KYC verification usually requires a government-issued photo ID and proof of address, with additional source of funds documents required for higher-risk customers. Below is a list of some KYC documents that can be used for KYC verification.

Documents for business customers

Business customers need a different document set that proves the company is real and shows who stands behind it. That means a certificate of incorporation, a registered business address, an ultimate beneficial ownership (UBO) register showing who actually owns and controls the company, and identification for its directors. 

Business verification is a distinct discipline called Know Your Business (KYB), which applies the same logic as KYC to a legal entity instead of a person.

How long does KYC verification take?

Automated KYC verification typically takes seconds to a few minutes. Manual or document-heavy reviews can take one to several business days, depending on the customer’s risk level, document quality, and whether enhanced due diligence applies. Speed comes down to how much of the process runs without a human in the loop.

KYC review and periodic refresh

KYC obligations continue well past onboarding. Regulators now expect proof that a customer’s profile stays current for as long as the relationship lasts, not just on the day it started. Three review models exist side by side. 

How Shufti handles KYC verification end to end

If you have ever watched a genuine customer abandon onboarding on the third document retry, you have seen the real cost of a KYC stack that was not built for the markets your customers are actually in. Most identity verification vendors patch that gap with a third-party liveness engine bolted onto someone else’s document OCR, which is exactly where the handoffs between vendors tend to break.

Shufti runs identity verification, biometric liveness, and AML screening as one workflow it owns end to end, across 240+ countries and territories and in 150+ languages, with iBeta Level 3 conformance under ISO/IEC 30107-3 for liveness attack detection. Macropay, a cross-border payments fintech, runs its KYB and KYC compliance through that single layer instead of stitching together separate tools.