Know Your Customer (KYC) in Banking Explained

Know Your Customer (KYC) procedures are a legal requirement for banks and financial institutions to know who they’re doing business with. They are a critical part of anti-money laundering (AML) legislation, required by virtually every country around the globe.

While specific KYC requirements may vary by country, KYC programs typically include three parts: identity verification, customer due diligence, and ongoing monitoring.

• Identity verification: Confirming that the individual or business customer is who they say they are by checking names, addresses, and social security numbers on government-issued IDs against government and third-party databases.
• Customer due diligence: Ensuring that the customer doesn’t engage in illegal activities by screening them against sanctions and terrorist watchlists, reviewing executive bios, company reports, and media press, and analyzing past transactions and behavior. Banks also need to identify politically exposed persons (PEP) who are in positions of power and therefore at higher risk of corruption and people and companies doing business in regions that are known to have more money laundering violations, such as Iraq or North Korea. Customers determined to be at higher risk of involvement in financial crime undergo enhanced due diligence screening.
• Ongoing monitoring: Continuously reviewing customers and their transactions to detect any changes in risk, suspicious activity, or fraud.

KYC is part of overall customer lifecycle management (CLM), which begins at customer onboarding and follows the customer throughout their entire association with the bank. CLM also includes account maintenance, marketing, product openings, tax declarations, and more.

Money laundering is a big business, and growing. About 2.7% of the global GDP gets laundered each year, according to research from The Financial Accountability, Transparency and Integrity (FACTI) Panel, a UN-affiliated group. Money laundering costs US banks more than $2 billion per year in fines.

Many cases of money laundering are connected to fraud and drug trafficking, and recently, identity theft has become a major strategy in money laundering schemes—increasing the importance of Know Your Customer (KYC). Given the amount of money laundering that slips through the cracks, stronger KYC processes have become a necessity for many organizations.

Bad actors may use stolen identities in several ways:

• Account takeover (ATO): Account takeover occurs when bad actors use victims’ funds, and then continue to use victims’ bank accounts to hide illegally gained funds and transfer them to other accounts.
• Identity theft: Identity theft occurs when bad actors don’t steal victims’ funds, but they use their stolen identity to open accounts, take out loans, and establish corporations.
• Synthetic identity: Synthetic identity is when bad actors create a new identity by using nonexistent social security numbers, names, and addresses. Since the identity is not real, it is not flagged on any watchlists.

Imagine placing your items at a store checkout, only to be told by the cashier that they need to decide whether they’ll agree to sell to you. That’s the situation today for banks and their prospective clients—both individuals and business customers–at onboarding: The bank must conduct a thorough KYC verification before they can agree to create an account for a client. This obstacle can create friction in the customer experience, and to make matters worse, KYC verification takes a long time—often more than three weeks.

Why does the KYC process typically take so long? Banks and financial institutions face several speed challenges:

First, the sheer volume of information a bank needs to collect for KYC is staggering, both in paper and digital forms, such as emails. For business customers, banks need to collect identifying materials and photos for each individual connected to the business, as well as business documentation such as tax certificates or articles of incorporation. They also need to review executive bios, press releases, annual reports, and other materials.

Process automation can play a key role here, speeding up previously manual tasks. For example, robotic process automation (RPA), just one part of a holistic automation strategy, handles repetitive data entry tasks. Intelligent document processing (IDP), another tool that’s part of a complete automation approach, pulls data from digital documents.

Data silos and disparate systems across the organization are also a big speed bump in the KYC process. Today’s banks and financial institutions have some of the world’s most complex technology stacks—legacy systems and all. With B2B customers, banks can use strategy and technology to balance the customer’s desire for speed and the bank’s need to manage risk of financial crime. Data strategy proves critical in all four stages of the financial crime lifecycle:

• Compliance - Governance structures and crime strategies.
• Prevention and detection - Fraud management, including advanced analytics.
• Investigation and remediation - Evaluating allegations, responding to regulatory requests, addressing issues.
• Monitoring and reporting - Ongoing monitoring for signals of AML risk.

Banks also need to contend with an ever-changing regulatory environment. As bad actors invent novel ways to commit financial crime, regulators amend AML/BSA and other laws to stem the attacks. Banks must adapt their workflows to conform.