KYC and Customer Due Diligence

Know Your Customer, or KYC, is the process of identifying and verifying a customer before the bank does business with them. For an individual, this means collecting identity documents, proof of address and information about the source of funds and the purpose of the account. For a company, it means understanding the business, its directors, and its ultimate beneficial owners, the real people who own or control it, even if ownership passes through several layers of companies. The bank must be satisfied that it knows who it is dealing with, and that the customer's expected activity makes sense for who they are. A student account that suddenly receives large business payments is a red flag, because the activity does not fit the profile. Customer Due Diligence, or CDD, is the ongoing work of keeping that understanding current. Standard CDD applies to most customers, while Enhanced Due Diligence applies to higher risk customers, such as politically exposed persons, customers from high risk countries, or businesses in cash intensive sectors. Enhanced due diligence might involve senior management approval, extra verification of the source of wealth, and more frequent reviews. Simplified due diligence is allowed for very low risk customers, such as some regulated institutions, but the bank must still be able to justify the lower level of scrutiny. Risk ratings are usually calculated from factors like geography, product, channel and customer type, and they drive how often the customer is reviewed and how closely their transactions are monitored. KYC is also where many payment problems begin. If the customer's data is incomplete or out of date, payments can be held, accounts can be frozen, and the customer experience suffers. BAs working on onboarding systems should therefore treat KYC data as a shared asset that payments, compliance and operations all depend on. Good requirements cover data quality rules, document expiry handling, periodic review triggers, and the handover of information between onboarding and transaction monitoring. A well designed KYC process collects the right information once and uses it everywhere, instead of asking the customer the same questions every time they use a new product. The customer risk rating is the model that decides how much due diligence a customer gets. The rating is based on the customer type, the geography, the product, the channel, and the transaction behaviour. A retail customer in a low-risk country using a domestic instant payment is low risk, and gets simplified due diligence. A corporate customer in a high-risk country using cross-border payments is high risk, and gets enhanced due diligence. The rating must be calculated by the system, not by the analyst's judgement, because judgement is inconsistent, and the rating must be reviewed when the customer's behaviour changes, because a low-risk customer who starts sending large cross-border payments is no longer low risk. Enhanced due diligence is triggered by specific events, and the analyst must know them. A customer who is a politically exposed person triggers EDD. A customer from a high-risk jurisdiction triggers EDD. A customer whose beneficial owner is unknown triggers EDD. A customer whose transaction pattern does not match the expected profile triggers EDD. EDD means collecting more information, verifying the source of funds, understanding the purpose of the relationship, and monitoring more closely. The EDD must be documented, and the documentation must be reviewed by a senior analyst, because the decision to accept a high-risk customer is a decision the bank must be able to defend. The beneficial ownership register is the tool that makes EDD possible. In the European Union, each member state maintains a register of the beneficial owners of companies, and the bank must check it. In the United Kingdom, the register is held by Companies House. The register shows who owns 25 percent or more of a company, and who controls it. A corporate customer whose beneficial owner is a trust in a secrecy jurisdiction, or whose ownership chain passes through three countries, is a high-risk customer, and the bank must understand the full chain before it can accept them. The requirements must state which registers are checked, and how the check is recorded.