KYC and AML: What Due Diligence Asks

Know-your-customer and anti-money-laundering rules exist to stop banks and other regulated firms being used to move the proceeds of crime. They are often described as paperwork, and the description is wrong. The rules require a firm to establish who its customer is, to understand the business it is doing, to identify the people who ultimately own or control it, and to keep watching the relationship for as long as it lasts.

What KYC asks for at the start

The first step is identity. For a person, that means reliable documents and enough information to be confident the documents belong to the person in front of the firm. For a company, it means the corporate documents, the registered details, the directors and, importantly, the ownership structure. A firm is not expected to accept a certificate of incorporation as the whole answer, because a company can be owned by another company, which is owned by a trust, which is owned by no one who appears in any register. The question of who ultimately benefits is the one the rules are built around.

Alongside identity sits purpose. What is the customer's business, and what relationship is being proposed? A firm that cannot answer this is not merely missing a form; it has no basis on which to judge whether later activity is normal or odd. That judgement is the practical value of the whole exercise.

Beneficial ownership, and why the layers matter

Beneficial ownership means the natural person who ultimately owns or controls the customer, even when the shares are held by another entity. Many countries now keep a register of beneficial owners, though who may consult it and on what terms varies widely. Where a register is open, it is a fast route to the answer. Where it is not, the firm has to obtain the information from the customer, and to test it against what it can see. The section on due diligence covers the same exercise from a commercial angle, and the glossary defines the terms.

Risk assessment, which decides how much work is enough

Not every customer needs the same level of checking. The rules expect a firm to assess risk, using factors such as the customer's country, the sector, the ownership structure, the products involved and the channel through which the relationship is established. A lower-risk customer may need standard checks. A higher-risk one needs enhanced due diligence, which goes further into the source of funds, the source of wealth and the reason for the transaction. Politically exposed persons, complex ownership chains, high-risk jurisdictions and unusual transaction patterns all push a relationship into the enhanced category.

The risk assessment is not a single decision made at onboarding. It is a judgement that is revisited as the relationship develops, because a customer who was unremarkable at the start can become a concern later.

Source of funds and source of wealth

The two phrases are related and often confused. Source of funds is where the money for a particular transaction came from: the sale of a property, the proceeds of a business, an inheritance. Source of wealth is how the person accumulated their overall wealth over time. Source of funds answers a question about one payment; source of wealth answers a question about a life. Both are asked in higher-risk cases, and both require evidence rather than an explanation. A customer who cannot show how a large sum was earned is a problem for the firm even when there is no evidence of crime, because the firm cannot demonstrate that it asked the right question.

Monitoring, which never stops

Onboarding is a moment. A relationship is a duration. The rules expect a firm to monitor what a customer does: to watch transactions for patterns that do not fit the customer's stated business, to keep sanctions screening current as lists change, and to refresh identity and ownership information when a relationship is reviewed. Monitoring is where most failures occur, because it is continuous and unglamorous. An alert that is closed without being examined, a list that is not updated, a review that is not done: each is a gap that only becomes visible when something goes wrong.

Reporting suspicion

When a firm suspects that money is connected to crime, the rules usually require it to file a report with a national financial intelligence unit. The timing, the form and the consequences differ by country, and one rule is common: the firm must not tell the customer that a report has been made. That prohibition, usually called tipping off, is why suspicious activity reports are handled by a small number of people within a firm, and why a customer relationship may change without explanation.

Where KYC ends and commercial due diligence begins

KYC and AML are obligations, imposed by law on regulated firms, and their purpose is the public one of keeping crime out of the financial system. Commercial due diligence is a choice, made by a company that wants to understand a counterparty before a deal. They overlap, and a firm often runs them together, but they are not the same. A bank must ask who its customer is; a buyer chooses to ask who it is dealing with. The guide to what corporate due diligence covers sets out the commercial version, and the guide to compliance monitoring covers what happens when a firm's own programme is tested from outside.

Where to read the international standards

The Wolfsberg Group, an association of global banks, publishes principles and guidance on anti-money-laundering and financial crime compliance that are widely used as a practical reference alongside the national rules. The address is wolfsberg-principles.com.