Due Diligence and KYC (Know Your Customer): What They Are and How They Are Done
What the international standard asks you to know about each customer, the three levels of due diligence and when the enhanced one applies.
Customer due diligence is the set of measures a regulated business applies to know who it is dealing with: identify the customer and verify that identity, identify the beneficial owner, understand the purpose of the relationship and monitor it while it lasts. KYC, or know your customer, is the common name for that process.
The Four Steps of Due Diligence
Recommendation 10 of the Financial Action Task Force (FATF), the international standard that the anti-money laundering laws of the region follow, sets four measures.
1. Identify and verify the customer
Collect the customer's identity data and verify it using reliable, independent source documents, data or information.
2. Identify the beneficial owner
Find the natural person who ultimately owns or controls the customer and take reasonable measures to verify their identity. For companies and other legal structures, this means understanding who owns them and who controls them.
3. Understand the purpose of the relationship
Understand, and where appropriate obtain information on, the purpose and intended nature of the business relationship: what the customer expects to do with you and why.
4. Monitor the relationship
Scrutinise transactions throughout the relationship to check that they match what you know about the customer, their business and their risk profile, including the source of funds where necessary, and keep the file up to date.
Recommendation 22 extends these measures to certain non-financial businesses and professions, not only to banks.
When Due Diligence Is Required
- When a business relationship is established
- When an occasional transaction exceeds the threshold set by the rules
- When there is a suspicion of money laundering or terrorist financing, whatever the amount
- When there are doubts about the identification data obtained earlier
The thresholds and the details change from country to country. This guide does not give them on purpose: check them in your country's rules or with your adviser.
Simplified, Standard and Enhanced Due Diligence
Not every customer requires the same effort. Under the risk-based approach (FATF Recommendation 1), each business assesses its risks and applies measures proportionate to them, within what its country's rules allow.
| Simplified | Standard | Enhanced | |
|---|---|---|---|
| When it applies | Lower risk, where the rules allow it | The general rule for every customer | Higher risk, identified by your assessment or required by the rules |
| What it involves | Reduced measures, such as less frequent updates or lighter monitoring | The four steps above | The four steps plus more information on the customer and the source of funds, senior management approval and closer monitoring |
| Limit | Never allowed when there is a suspicion of money laundering or terrorist financing | Adjusted to the risk of each customer | Does not mean refusing the customer: it means knowing them better |
When Enhanced Due Diligence Applies
The international standard names some cases, and each country's rules may add others.
Politically exposed persons
People who hold or held a prominent public function, their family members and close associates (FATF Recommendation 12).
Higher-risk countries
Relationships and transactions with persons from countries for which the FATF calls for it (FATF Recommendation 19).
Unusual or complex structures
Companies whose ownership structure appears unusual or excessively complex, which makes it hard to know who is behind them.
High risk in your own assessment
Customers that your risk matrix rates as high risk because of their activity, their products, their channel or their geography.
Who Is the Beneficial Owner
The beneficial owner is the natural person who ultimately owns or controls a customer, or on whose behalf a transaction is carried out. It is always a person, never a company: when the customer belongs to another company, you go up the chain until you reach people.
A percentage of ownership is one way to identify them, but control by other means also counts. The percentage that makes someone a beneficial owner varies by country and by regime, so this guide does not give a single figure.
Due Diligence in COX
One file per customer, from the digital onboarding form to approval: identity documents, beneficial owners and related parties, restrictive list and PEP screening, adverse media, and a risk matrix your company configures. When the matrix requires enhanced due diligence, the file says why and cannot be approved until it is recorded. Reviews fall due according to the risk level.
Digital onboarding Restrictive list screeningFrequently Asked Questions
This guide is for informational purposes only and does not constitute legal advice. It summarises the FATF international standard without replacing your country's rules: confirm thresholds, periods and requirements in the official text or with an adviser.
Know Every Customer, and Prove It
One file per customer, with the evidence of every step and every decision.
Talk to us on WhatsApp See every service Estimate your costs
Explore more COX solutions:
Digital onboarding Restrictive list screening PEP screening SAGRILAFT, SARLAFT and PTEE