What Is KYC (Know Your Customer) and Why Do Companies Need It?

KYC stands for Know Your Customer: the set of legally mandated procedures through which a company or website verifies the true identity of its customers and assesses each customer's risk for money laundering, fraud and related crimes. Put simply, KYC means that before a business gives a user access to financial or sensitive services, it makes sure that the user really is who they claim to be.

If you have ever opened an account at a bank, a crypto exchange or an international payment service and were asked for a photo of your passport, ID card or a utility bill, you have gone through a KYC process. Today KYC is no longer limited to banks: from crypto exchanges and payment gateways to marketplaces and subscription services, any business that moves or holds people's money is required to perform KYC in some form. This guide explains in full what KYC exactly is, what it consists of, why it is legally mandatory, and how it unfolds from your point of view as a user.

What is KYC?

KYC is a set of identity-verification and risk-assessment actions carried out before a business relationship begins and continued throughout that relationship. It has three goals: confirming the customer's real identity, understanding the nature of their activity (where their money comes from and where it goes), and assessing the likelihood that the customer could be involved in money laundering or terrorism financing. KYC is not merely an industry custom; it is an inseparable part of anti-money-laundering (AML) law around the world.

The concept traces back to the United States Bank Secrecy Act of 1970, which required banks to keep records of their customers' currency transactions. Its modern, global form took shape with the creation of the Financial Action Task Force (FATF) by the G7 in 1989. FATF is now the world's anti-money-laundering standard-setter, and its 40 Recommendations are the reference for legislation in more than 200 countries and jurisdictions through its network of nine FATF-style regional bodies. In the United States, Section 326 of the USA PATRIOT Act (2001) made a Customer Identification Program mandatory for all financial institutions, and in the European Union the chain of AML directives — from the 4th (2015/849) to the 5th (2018/843) — culminating in the unified 2024 AML package with its new AMLA supervisory authority, extends the same obligation to an ever-wider range of businesses.

The core components of a KYC program

A standard KYC program is built from several complementary components — known in compliance language as CIP, CDD and EDD — which together with ongoing monitoring form the complete know-your-customer lifecycle.

Customer Identification Program (CIP)

The Customer Identification Program is the foundational step of KYC: collecting the minimum information needed to identify an individual — full name, date of birth, national or tax identification number and residential address — and verifying it against an official document such as a passport, national ID card or driver's license. In many legal systems, institutions are required to retain these records for a set period and to produce them to supervisors on request.

Customer Due Diligence (CDD)

Customer Due Diligence goes beyond matching documents and asks: who is this customer, what is their occupation and source of funds, and what is their expected transaction volume? The output of CDD is a risk profile that determines the customer's risk tier and the depth of review they require.

Enhanced Due Diligence (EDD)

If a customer falls into a higher-risk category — for example Politically Exposed Persons (PEPs), residents of high-risk countries, or participants in sensitive industries — Enhanced Due Diligence applies: deeper investigation of the source of wealth, adverse media history and ownership structures. Banks typically request supplementary documentation and an introductory interview at this level.

Ongoing monitoring

KYC is not a one-time event. Accounts are continuously monitored so that unusual behavior — a sudden spike in transaction volume, deposits structured just under reporting thresholds, or repeated transfers to high-risk destinations — is flagged and, where necessary, reported. The customer's risk profile is updated as circumstances change.

Why do companies and websites have to perform KYC?

The reasons KYC is required can be grouped into five themes — and each one alone is enough for a business to take the process seriously.

• Legal obligation and heavy fines: for banks, exchanges and payment services, KYC is law, not choice. In November 2023 the Binance crypto exchange paid roughly $4.3 billion to US authorities for KYC and anti-money-laundering failures — the largest settlement in the industry's history. Earlier, in December 2022, Danske Bank paid about €2 billion in fines over roughly €200 billion in suspicious flows routed through its Estonia branch between 2007 and 2015.
• Preventing fraud and identity theft: KYC is the first line of defense against fake accounts, unauthorized withdrawals and purchases made with someone else's identity. When withdrawals are possible only for the verified owner of an account, hacked accounts lose most of their value to criminals.
• Fighting money laundering and terrorism financing: criminal proceeds need to be "washed", and that laundering almost always passes through real but unidentified accounts. KYC closes exactly that route.
• Compliance with international sanctions: businesses must not transact with sanctioned individuals or countries; without identity verification and screening against sanctions lists (OFAC, the United Nations, the European Union) this obligation is impossible to meet.
• Trust and commercial health: high chargeback and fraud rates mean direct losses and higher processing tariffs. A business that verifies its users enjoys lower fraud costs and greater trust from financial partners.

Which businesses are required to perform KYC?

Any business that receives, holds or moves people's money, or sells sensitive assets, is covered by KYC obligations in some form. The most important groups are: banks and credit institutions; payment services and e-wallets such as PayPal and Wise; cryptocurrency exchanges — explicitly covered since January 2020 by the EU's 5th Anti-Money-Laundering Directive and later by the MiCA regulation; forex and gold brokers and dealers; insurance companies; online gambling and betting platforms; telecom operators and SIM card sellers; auction houses and dealers in luxury goods and art; and credit fintechs. Even some marketplaces and SaaS providers run voluntary KYC — not because of a direct legal mandate, but to cut fraud risk and satisfy the KYC expectations of their payment partners.

The KYC process step by step, from the user's perspective

From your point of view as a user, a typical KYC process runs through six steps; most online services today complete the journey automatically within minutes.

Step 1 — entering personal data: you provide your full name, date of birth, nationality and address in the sign-up form. This data must match your official documents; even a small mismatch (such as a rearranged date of birth or a dropped middle name) can halt the process automatically.

Step 2 — uploading an identity document: you submit a photo or scan of your passport, national ID card or driver's license. Photo quality matters a lot: the image must be complete, uncropped, free of glare, and legible in detail. Keep in mind that mobile photos can carry hidden Exif metadata such as capture location and time, which some automated review systems analyze.

Step 3 — proving your address: many services also want your residential address verified, usually with a bank statement or a utility bill (electricity, water, gas, internet) issued in your own name within the last three months.

Step 4 — confirming live presence: in digital onboarding you are usually asked for a selfie or a short video, so that your face can be matched against the document photo and your "liveness" confirmed through actions such as turning your head or blinking.

Step 5 — automated screening: your name is checked against sanctions lists (OFAC, the United Nations, the European Union), PEP lists and adverse-media databases, and the document's authenticity (such as the MRZ pattern of a passport) is validated.

Step 6 — decision and monitoring: the verdict takes minutes at best and a few days when manual review is involved; from then on your account is monitored on an ongoing basis, and significant changes (like a jump in transaction volume) can trigger a KYC refresh request.

What is the difference between KYC, AML and CDD?

These three terms are related but not identical. AML (Anti-Money Laundering) is the umbrella of laws, regulations and controls that the international community has designed to curb money laundering and terrorism financing; KYC is one of the main instruments for executing that program at the customer level. CDD, as you have read, is the component inside KYC that deals with risk assessment. The relationship can be summarized like this: AML is the goal and the legal framework, KYC is the operational process of knowing the customer inside that framework, and CDD is the depth of risk analysis at the heart of KYC.

eKYC and the future of digital identity verification

eKYC (electronic KYC) is the fully digital, remote version of the process — one that works without a physical branch: automatic document reading with OCR, reading the NFC chip of modern passports, biometric face matching and liveness detection, and connections to official registries. A prominent example is India's Aadhaar system, whose more than one billion enrollments turned in-person verification into a seconds-long transaction. For users, eKYC's advantage is speed (minutes instead of days); for businesses, it means lower cost and wider geographic reach — which is why it is now the default standard among fintechs and online exchanges.

What happens if you fail KYC?

Failing KYC is not always a "security problem" — most rejections come from fixable issues: a blurry or cropped photo, an expired document, a name or address that does not match official records, an invalid file format, or an address history in sanctioned countries. In those cases you can usually upload a corrected document or ask support for a manual review. When the rejection stems from a screening result (such as a name matching a sanctions list), the process is harder and often cannot be resolved through normal channels, because the provider is not allowed to accept a high-risk customer. On the data-rights side your position is clear: in the European Union the GDPR obliges businesses to minimize the data they collect and to keep KYC documents only as long as necessary and for a defined period — and you have the right to know what data is held, why, and for how long.

Frequently asked questions about KYC

What does KYC stand for?

KYC stands for Know Your Customer — the set of processes through which a business verifies a customer's identity and assesses their risk.

Is KYC legally mandatory?

Yes. For banks, financial institutions, exchanges and payment services in nearly every country, performing KYC is a direct legal requirement, and skipping it can lead to multi-billion-dollar fines. For some other businesses, KYC becomes obligatory indirectly through their payment partners or AML laws.

Which documents are needed for KYC?

Three categories: an identity document (passport, national ID card or driver's license), proof of address (a bank statement or utility bill in your own name, usually issued within the last three months), and in digital processes a selfie or short video to confirm live presence.

How long does KYC take?

With automated checks on modern services: from a few minutes to a few hours; at banks and in cases needing manual review: typically one to five business days. High-risk cases that reach EDD can take several weeks.

Is it safe to give my ID documents to websites?

If the service is reputable, yes. Such businesses must store documents encrypted, restrict access to them, and keep them only as long as necessary (a GDPR requirement in Europe). Prefer services with a transparent privacy policy and a public track record, and never send your documents through informal channels such as chat or email.

What is the difference between KYC and AML?

AML is the legal framework for fighting money laundering; KYC is its operational tool at the customer level. In other words, KYC is a subset of every organization's AML program.

Is KYC possible without identity documents?

Not in the standard case; but alternative eKYC methods — connecting to an official identity registry, reading a passport's NFC chip, or bank-grade biometric verification — can remove the need to upload a traditional document, while still relying on a digital identity document in the background.