What it means
At its simplest the process answers three questions: who is this customer, who ultimately owns and controls them, and does the activity we expect from them make commercial sense? Answering those questions means collecting identity evidence, checking it against reliable independent sources, and keeping the record current afterwards.
The requirement exists because financial firms sit at the gateway of the payments system. Governments make them responsible for checking who comes through that gateway, and the penalties for failing are heavy fines, restrictions on the licence to operate and, in serious cases, personal liability for named executives.
In practice the work is tiered by risk rather than applied uniformly. A salaried customer opening a modest savings account gets light-touch verification, while a company with layered ownership across several countries triggers enhanced due diligence, including documented proof of who ultimately benefits from the relationship.
It is not a single exercise completed at sign-up either. Firms are expected to monitor activity for behaviour that does not match the profile they built, and to refresh customer records periodically or whenever something material changes, e.g. a change of ownership or a new country of operation.
The commercial nuance is friction. Every additional document requested loses a share of genuine applicants, so the design challenge is to make the checks proportionate to risk rather than simply heavy, and firms that get that balance right consistently win business from those that do not.
In practice
Real-world examples.
Example
A commercial bank onboards a haulage company as a new borrower. It verifies the registered company details, identifies the two shareholders who each hold more than 25%, checks both against sanctions and politically exposed person lists, and asks for two years of accounts to confirm that the expected payment volumes are consistent with the size of the business.
Example
A firm of accountants takes on a new client whose fees will be paid from an overseas trust. Because the source of funds is not obvious from the client's stated occupation, the engagement partner applies enhanced due diligence, requests documentation of how the trust was funded, and records the reasoning before the engagement letter is signed.
Example
A payments start-up automates identity verification for consumer sign-ups and clears 82% of applicants within four minutes. The remaining cases are routed to a small analyst team, which allows the business to grow quickly without loosening the standard applied to the harder files.
Think of it
“KYC is understanding who your customer is-verifying identity and risk.
Case study
Seen in the real world.
Meridian Coast Bank is an illustrative and entirely fictional mid-sized commercial bank used here to show how these obligations play out. Its business banking arm had grown quickly by promising same-day account opening, and to hit that promise the onboarding team had gradually reduced the ownership evidence it demanded from applicants with complicated corporate structures.
An internal audit found that roughly one in six business accounts opened over an eighteen-month period had no properly documented beneficial owner. None of those accounts had produced a confirmed instance of financial crime, but the bank could not demonstrate to its regulator that it knew who it was dealing with, which was itself the failure.
Meridian's response, in this illustrative story, was to split the process rather than slow all of it down. Simple sole trader and single-owner applications kept the same-day path, while structures with multiple layers or overseas holding companies moved to a five-day queue with a named reviewer. Average onboarding time rose slightly, the documentation gap was closed within two quarters, and the sales team kept the fast route it actually depended on.
Watch out
Common mistakes.
- Treating the checks as a form-filling exercise that ends once an account is opened, when the obligation to monitor and refresh the relationship continues for as long as it lasts.
- Verifying only the person signing the application and never establishing who ultimately owns or controls the business behind them.
- Applying the same level of scrutiny to every customer, which wastes effort on low-risk cases while leaving too little capacity for the genuinely complicated ones.
Questions
People also ask.
Which businesses are legally required to do it?
Regulated financial firms are the obvious group, but the obligation also extends to accountants, lawyers, estate agents, casinos, high-value dealers and many crypto and payment service providers.
What documents are usually needed?
For individuals, government-issued photographic identity plus evidence of address, and for companies, incorporation documents, a list of directors and evidence of who owns more than a stated percentage of the shares.
What happens if a customer refuses to provide the information?
The firm generally cannot proceed with the relationship, and if an existing customer will not cooperate at refresh, the account is normally restricted and then closed, with an internal report considered if the refusal itself looks suspicious.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%