Know Your Customer KYC

No. KYC is the everyday name for a duty that EU law calls customer due diligence. The phrase "know your customer" does not appear anywhere in the Anti-Money Laundering Regulation (AMLR). The regulation sets out customer due diligence in Chapter III, and that chapter is what a firm's KYC procedure has to satisfy.

In practice the two names are used for the same work. KYC often means the checks at the start: collecting a client's details and confirming them. Customer due diligence is the wider legal duty. It also covers the risk analysis behind the checks and the monitoring that continues for as long as the client stays.

The AMLR applies from 10 July 2027 (Article 90). Until then the rules come from national laws that implement the earlier EU directive, Directive (EU) 2015/849.

A KYC check works through the measures listed in Article 20(1) of the AMLR. For a new client they usually run in this order.

1. Identify the client. Collect the details the regulation requires for a person or a company.
2. Verify the identity. Confirm those details against an identity document or an electronic identity.
3. Find the beneficial owners. For a company or a trust, establish which natural persons ultimately own or control it.
4. Understand the purpose. Establish why the client wants the service and what their business or occupation is.
5. Screen the client. Check whether the client or its beneficial owners are subject to targeted financial sanctions, and whether any of them is a politically exposed person.
6. Keep monitoring. Review transactions and keep the client's information up to date for as long as the relationship lasts.

How far each step goes depends on risk. Under Article 20(2), a firm sets the extent of the measures by analysing the risk that each client and each relationship presents.

Article 22(1) of the AMLR sets a minimum list. For a natural person it is all names and surnames, place and full date of birth, nationalities, the national identification number where applicable, and the usual place of residence.

For a legal entity it is the legal form and name, the address of the registered office, the country of creation, and the names of the legal representatives. Where available, the firm also records the registration number, the tax identification number and the Legal Entity Identifier.

The firm then has to verify the identity, and Article 22(6) allows two routes. The first is an identity document, passport or equivalent, supported where relevant by information from reliable and independent sources. The second is electronic: electronic identification means at assurance level substantial or high, and relevant qualified trust services, under the eIDAS Regulation.

Before the business relationship starts or the transaction is carried out. Article 23(1) requires the identity of the client and of the beneficial owner to be verified by then.

There is one general exception. Verification may be completed while the relationship is being set up, if that is needed to avoid interrupting the normal conduct of business and there is little risk of money laundering or terrorist financing. It must then be finished as soon as practicable after the first contact (Article 23(2)).

A firm that cannot complete the checks must not go ahead. Article 21(1) requires it to refrain from the transaction or the relationship.

Every business that the AMLR lists as an obliged entity. Article 3 names credit institutions and financial institutions first. It then lists professions, among them auditors, external accountants, tax advisors, trust or company service providers and estate agents.

Notaries and lawyers are covered for particular work. They are obliged entities when they act for a client in a financial or real estate transaction. The same applies when they help plan or carry out transactions such as buying and selling real property or business entities, managing client money, or creating companies and trusts.