What is KYC? Know Your Customer Meaning, Process, and Requirements

In July 2025 the Financial Conduct Authority fined Monzo £21,091,300 after finding the bank “failed to design, implement and maintain adequate customer onboarding, customer risk assessment and transaction monitoring systems to mitigate the risk of financial crime.” Some customers were signed up using well-known London landmarks as their home address.

Those three failures map onto the KYC requirements. There are four in all, and the last one, ongoing monitoring, runs for as long as the account stays open, and we’ll discuss it along with all the other three in this article.

What is KYC?

KYC, short for know your customer, is the set of obligations a regulated business carries to establish who its customers are and to keep that picture current for as long as the relationship lasts.

In the United States those obligations are written down. The Financial Crimes Enforcement Network (FinCEN) Customer Due Diligence Rule requires covered financial institutions to have written policies covering four things.

The four things KYC requires

Under the rule, a covered institution must have written policies that do four things.

• Identify and verify the customer: In the rule’s words, “identify and verify the identity of customers.” This is the document check, the database lookup, or the biometric match at sign-up.

• Identify and verify the beneficial owners: Firms must “identify and verify the identity of the beneficial owners of companies opening accounts,” meaning the real people behind a corporate customer.

• Understand the nature and purpose of the relationship: Firms must “understand the nature and purpose of customer relationships to develop customer risk profiles,” which means recording what the account is for before deciding how closely to watch it.

• Conduct ongoing monitoring: The rule asks firms to conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

The third requirement is worth pausing on, because the fourth depends on it. It asks a firm to record what a customer says they will do with the account, in enough detail that later behaviour can be compared against it. 

How KYC relates to CDD, EDD, KYB, and AML

These terms are often used loosely, and the differences matter once you are reading a regulation. The table below explains what CDD, EDD, KYB and AML mean and how they relate to KYC.

What is KYC data?

KYC data is the evidence a firm holds to support its conclusion about who a customer is and what risk they carry. It falls into four groups.

• Identity attributes: Full name, date of birth, nationality, and residential address, taken from a document or an authoritative database instead of a form the customer filled in.

• Evidence artefacts: The document image, the chip read, the biometric template, the database response, and the timestamps showing when each was captured.

• Risk attributes: Sanctions and politically exposed person status, adverse media results, source of funds, expected activity, and the risk rating built from them.

• Decision records: Who approved the customer, on what basis, against which version of the policy, and what changed at each later review.

What are the KYC requirements and regulations?

KYC requirements come from national law, and most national law traces back to one global standard. The Financial Action Task Force (FATF) Recommendations set customer due diligence as the baseline for countries.

Recommendation 10 says when it must be applied. The triggers are the start of a business relationship, an occasional transaction above a threshold, any suspicion of money laundering or terrorist financing, and any doubt about data the firm collected earlier.

Who has to do KYC?

FATF splits obliged parties into two groups, and both appear in national law in some form.

• Financial institutions: Banks, payment and e-money firms, lenders, insurers, investment firms and brokers, and crypto asset service providers in countries that have brought them into scope.
• Designated non-financial businesses and professions: Casinos and other gambling operators, real estate agents, dealers in precious metals and stones, and legal and accounting professionals when they handle client money or set up companies.
• Businesses outside the regulated perimeter: Marketplaces and gig platforms often run KYC without a legal duty, because payment partners require it by contract.

A firm operating in several countries has to satisfy each set of rules it touches, which is why multi-market programmes usually settle on the strictest requirement and apply it everywhere.

What are the steps in the KYC process?

The KYC process has five steps. Four of them happen at onboarding and take seconds to minutes. The fifth runs for the life of the relationship and has no end date.

The five checks

• Collect and verify identity: Capture a government document or query an authoritative database, then confirm the data is genuine and not simply well formatted.

• Match the person to the identity: A face capture with liveness detection confirms the applicant is physically present and is the person the document describes.

• Screen against risk lists: Sanctions and politically exposed person screening, plus adverse media, produces the signals that decide whether standard or enhanced due diligence applies.

• Build the risk profile: Occupation, country, expected activity, and product type combine into a rating that sets how closely the account is watched.

• Monitor and refresh: Transaction behaviour, biometric re-checks, and periodic review keep the profile accurate as the relationship ages.

What triggers a KYC refresh?

Reviewing every customer on a fixed calendar is the most common approach, and you could argue that it’s the weakest one, because criminals do not work on a schedule or on your review cycle. A risk-based programme also refreshes when something happens.

• A change in risk rating, from a new sanctions designation, an adverse media hit, or a change in the customer’s stated circumstances.
• A material change to customer details, such as a new address, a new phone number, or a new beneficial owner on a company file.
• Behaviour that departs from the profile, meaning money in, counterparties, or countries the original record did not anticipate.
• A product or limit upgrade, where the customer moves to a service carrying more risk than the one they were rated for.
• Expiry of the underlying evidence, including an identity document that has lapsed since it was captured.
• Doubt about data already held, which FATF names directly and which many internal policies leave without an owner.

What are the main KYC methods?

Step one of the process asks you to verify an identity. The method is how you do it. What you can use comes down to the evidence that exists in a given market, and five approaches cover most regulated onboarding.

What automated KYC means

The term describes how the five above are run when software handles capture, forensic document analysis, liveness & face matching, and screening without a person touching the file. Automation changes throughput, consistency, and cost per case, but does not change what the rules require.

Why does KYC fail after onboarding?

KYC fails after onboarding because the customer who passes verification and the customer who commits the fraud are often the same person at different points in time. A document check tells you nothing about what someone will do with the account in three months.

What the 2025 UK fraud data shows

Cifas recorded 444,000 fraud cases to the UK National Fraud Database in 2025, the highest number in a single year since the database opened. Four figures inside that total describe one movement.

• Identity fraud filings fell 3%: Cifas attributes that drop to criminals switching tactics rather than to less fraud overall.
• Account takeover rose 6% to more than 78,000 cases: These are cases where somebody seizes control of an account that already exists.
• Misuse of facility rose 43% to more than 106,000 cases: These are cases where an account obtained legitimately is later used for fraud.
• A new money mule filing category logged over 22,000 cases in its first year.

Why the gap exists

Onboarding usually sits with growth or product, measured on approval rate and time to account. On the other hand, ongoing monitoring usually sits with financial crime, measured on alert quality and analyst workload.

These are two separate owners, with two different budgets, following two different roadmaps, and the customer record often does not survive the transition that takes place between these two.

That division also explains how the fourth requirement passes audits while failing in practice. For example, if a supervisor asks to see the monitoring policy will be shown one, that’s easy. But the more useful question is which onboarding attributes the monitoring rules actually read, and for many firms the answer is very few.

How to extend KYC past onboarding

The pieces are usually already in the stack. What is missing is the decision to use them once the account is open.

• Re-check the biometric, not only the transaction rules: Compare a fresh selfie against the profile you captured at onboarding whenever an account’s risk changes. Transaction rules track the money, not the person holding the credentials, so this is the only check that tells you who is operating the account now.

• Feed the onboarding profile into monitoring: Your monitoring system needs the record of what the customer said they would do with the account. Without it, it scores them against a generic peer group, and that is where most false positives start.

• Trigger review on behaviour, not only on the calendar: A date set a year in advance has no relationship to when a customer’s risk changed. Add event triggers alongside the periodic cycle, so a new sanctions hit, a change in risk rating, or activity outside the stated profile pulls the file up on its own.

None of this replaces onboarding checks. It extends them.

What does a KYC analyst do?

A KYC analyst decides the cases that a software cannot decide alone. Their job typically involves:

• Deciding flagged onboarding cases, where a document anomaly, a failed biometric, or a partial screening match needs judgement.
• Running enhanced due diligence on higher-risk customers, which means establishing source of wealth and unpicking ownership structure.
• Handling periodic and event-driven review, revisiting customers whose risk rating has aged or whose behaviour has drifted from the profile on file.

What automation changed

Automation has changed the shape of the role without removing it. The clerical work of gathering documents, chasing database responses, and reading screening hits one source at a time is what automation can help with now. But the part that was always the actual job, which is forming a defensible view on an unclear file and writing down the reasoning, still stays with a human. 

That matters for the fourth FinCEN requirement, because a monitoring programme is only as defensible as its record of who reviewed what, when, and on what evidence.

How Shufti handles KYC after onboarding

The account that costs you money is usually one that passed verification cleanly. It opened, went unused for a few weeks, and then started moving money for somebody else. Most verification stacks never see that happen, because the check ended at sign-up and nothing was carried forward.

Shufti keeps the onboarding biometric as an enrolled profile the account can be tested against later. For a returning user, a live selfie is compared to that profile to support re-KYC, account recovery, or step-up verification, and the KYC solution re-verifies when risk changes instead of only at sign-up. It covers 240+ countries and territories and 150+ languages, and a genuine customer does not have to repeat full onboarding to clear the check.