Rather than a single check, regulatory authorities (such as FATF and FinCEN) define KYC through three progressive stages:
Customer Identification Program (CIP):
The initial identity verification stage during onboarding. Businesses collect, validate, and authenticate official documents—such as government-issued IDs, proof of address, biometric scans, and corporate registries for legal entities.
Customer Due Diligence (CDD) & Risk Assessment:
Evaluating the customer’s risk profile based on their activity, jurisdiction, and background:
Simplified Due Diligence (SDD): Applied to low-risk accounts with low transaction thresholds.
Standard Due Diligence (CDD): Verification of beneficial ownership (UBO) and source of funds for standard accounts.
Enhanced Due Diligence (EDD): Mandatory in-depth scrutiny for high-risk profiles, such as Politically Exposed Persons (PEPs), sanctions-list matches, or clients operating in high-risk jurisdictions.
Ongoing Monitoring:
Continuous surveillance of account activity after onboarding. Transactions are audited against normal customer behavior patterns to detect suspicious spikes, sanctions changes, or sudden red flags requiring a Suspicious Activity Report (SAR).
KYC obligations fall on “obliged entities” under local and international financial regulations:
Banking & Lending: Retail, commercial, and investment banks.
Fintech & Payments: Payment gateways, digital wallets, money transfer operators, and Buy Now, Pay Later (BNPL) platforms.
Cryptocurrency & Web3: Virtual Asset Service Providers (VASPs) and crypto exchanges.
Wealth Management & Insurance: Brokerages, asset managers, and life insurance providers.
Designated Non-Financial Businesses (DNFBPs): Real estate brokers, casinos/gambling operators, and luxury goods dealers.
Fraud & Financial Crime Prevention: Stops synthetic identities, chargeback fraud, and terrorist financing at account creation.
Regulatory Compliance: Avoids severe regulatory enforcement actions, multi-million dollar fines, and license revocations.
Reputation & Operational Trust: Protects business integrity by preventing associations with illicit funds and sanctioned entities.