Know Your Customer (KYC)

Overview

How it works and why it matters

KYC is the identification and verification of an individual customer as part of risk management and, where required, financial-crime compliance. Requirements vary by jurisdiction, activity and provider. It may involve identity checks, ongoing monitoring and risk-based enhanced due diligence.

Important technical and operational details

Activities may include verifying identity, beneficial ownership, business purpose, expected activity, geography, source information, and relevant risk indicators.

Exact requirements depend on jurisdiction, activity, customer type, transaction thresholds, and licensing status. KYC is broader than collecting an identity document, and successful verification does not guarantee that future transactions are legitimate or accurately explained.

Organizations should gather proportionate evidence, protect personal data, resolve inconsistencies, rate risk , monitor changes, and refresh information when required. Automated tools support verification but need human escalation, quality control, and accessible correction processes. Retention and deletion rules should reflect both legal duties and privacy risk.

Operators should validate identifiers, timestamps, completeness, provenance, currency or asset units, status semantics, and linkage across onboarding, verification, screening, monitoring, investigation, approval, reporting, and periodic-review events; missing or delayed evidence should create an explicit uncertainty state.

Practical decision points

KYC programs need a specified legal basis, product scope and escalation path. Collect only appropriate identity evidence, validate it against reliable sources and maintain controls against synthetic identities, impersonation and document fraud. An existing customer may require renewed checks after sanctions, account ownership or risk changes. Privacy protection matters because copies of identity documents can create serious exposure if breached. Operators should distinguish customer identification from transaction monitoring: one validates who the user is; the other evaluates ongoing payment behavior and exposure. Neither process is automatically triggered by every direct on-chain payment between private wallets.

Related concepts

Transaction; Rate Risk

Further reading

• fatf-gafi.org documentation
• fatf-gafi.org documentation