What is KYC?
Know Your Customer
📖 Definition
KYC, short for Know Your Customer, is the legally required process a bank, exchange, or payment platform runs to verify who a customer is, assess the risk they carry, and keep watching their account over time. It exists so regulated businesses can comply with anti-money laundering law, and in practice it means submitting a government ID, proof of address, and often a selfie before an account is approved.
KYC is not a single form or a one-time checkbox. It is the operational half of what regulators call customer due diligence, the set of obligations that require a firm to know who it is doing business with before money moves, and to keep asking that question for as long as the relationship lasts. A verified account today does not mean the platform stops checking tomorrow, ongoing monitoring is built into the requirement itself.
The concept traces back to anti-money laundering and counter-terrorist-financing standards set by the Financial Action Task Force, an intergovernmental body that first issued its recommendations in the 1990s. FATF does not use the term KYC directly, it sets the customer due diligence and identification requirements, and individual countries turn those recommendations into binding law. More than 190 countries now follow FATF guidance in some form. In the United States, that translated into the Bank Secrecy Act and later Title III of the USA PATRIOT Act in 2001, which created the Customer Identification Program rule that American banks still operate under today. The European Union achieved the same goal through its Anti-Money Laundering Directives.
The problem KYC solves is straightforward even if the paperwork is not. Anonymous accounts are exactly what money launderers, sanctioned entities, and fraud rings need, and a financial system with no verification step is trivially easy to exploit. By forcing an identity check at onboarding and a risk-based review afterward, regulators make it dramatically harder to move illicit funds through legitimate institutions without either the customer or a suspicious pattern eventually surfacing.
🔎 What KYC Actually Checks
Most KYC programs are built from the same four building blocks, whether the business is a bank, a crypto exchange, or a fintech app. The labels vary slightly by source and jurisdiction, but the underlying checks are consistent.
| Component | What It Verifies | Example |
|---|---|---|
| Identity verification | Confirms the customer is a real person and matches the name, date of birth, and ID number on file, sometimes with a liveness or selfie check. | Uploading a passport or driver's license that is checked against a government or third-party database. |
| Address verification | Confirms where the customer actually lives, which supports risk scoring and confirms jurisdiction for legal and tax purposes. | A recent utility bill, bank statement, or government letter showing the applicant's name and address. |
| Risk based due diligence | Assesses how much money laundering or fraud risk this specific customer carries, based on who they are, where they are from, and what they plan to use the account for. | A politically exposed person or a customer from a high-risk country receives enhanced due diligence instead of a standard check. |
| Ongoing monitoring | Tracks account activity after approval to catch behavior that no longer matches the customer's stated profile. | A sudden spike in transfers to a sanctioned country triggers a manual review or a suspicious activity report. |
🏢 Where You Will See This
KYC shows up anywhere money or regulated services change hands. Banks and credit unions are the original case, but the same requirement now applies to crypto exchanges like Binance and Coinbase, payment platforms like PayPal, investment and brokerage firms, insurance providers, and real estate transactions above certain value thresholds. Gig and freelance platforms such as Upwork, along with online gambling operators, run KYC checks too, usually because they are licensed as payment institutions or money services businesses rather than because they are financial institutions in the traditional sense.
Frequently Asked Questions
Is KYC the same as AML?
No. KYC is one component inside the broader AML framework. AML covers the full set of laws, monitoring, and reporting obligations designed to stop money laundering and terrorist financing, while KYC specifically refers to the identity verification and customer due diligence steps a business runs before and during a relationship with a customer.
Which industries legally require KYC?
Banks and credit unions have run KYC since the practice was formalized, and the same obligation now extends to investment and trading firms, insurance providers, and real estate transactions above certain value thresholds. Crypto exchanges and other virtual asset service providers are treated as AML-obliged entities in most major jurisdictions, and any payment processor or platform licensed as a money services business inherits the same requirement.
How long has KYC existed as a requirement?
Modern KYC traces back to FATF's anti-money laundering standards, introduced in the 1990s and adopted by more than 190 countries since. In the United States, the requirement became concrete law with the Bank Secrecy Act and was sharpened further by Title III of the USA PATRIOT Act in 2001, which created the Customer Identification Program rule banks still follow today.
What happens if a company skips KYC?
A regulated business that fails to run KYC checks can face significant fines, loss of its operating license, and personal liability for compliance officers in some jurisdictions. Beyond the legal exposure, skipping KYC leaves a platform open to money laundering, fraud, and sanctions violations, which is exactly the harm the requirement was built to prevent.
Having KYC Issues?
Try our free AI analysis or get expert help for guaranteed approval.