In plain words
Think of a hotel check-in. Before you get a room key, the desk looks at your passport, checks the booking is yours and notes how long you are staying. KYC is the same idea for money: before a financial firm gives you an account, it checks who you are and what you plan to do with it.
In practice, a new customer types in their name, date of birth and address, photographs an ID document and takes a short selfie. Software compares the face with the photo on the ID, checks the document is genuine, and screens the name against sanctions and politically exposed person (PEP) lists. If everything matches and the risk is normal, the account opens. If something does not, a person on the compliance team looks at it.
KYC is one part of anti-money laundering (AML). The law requires it because a financial system that does not know its customers is easy to use for fraud, money laundering and sanctions evasion. In the UK, the duty comes from the Money Laundering Regulations 2017. 1
How it works
How KYC works at sign-up
What the customer does on the left. What the firm checks behind it.
-
1
Collect the basics
Name, date of birth, address, nationality, and what the account will be used for.
-
2
Verify the person
A photo of the ID document plus a live selfie. The provider checks the document is genuine and the face matches.
-
3
Screen and score the risk
The name is checked against sanctions, PEP and adverse media lists, and the customer gets a risk rating.
-
4
Decide and keep the evidence
Approve, reject or send to manual review. Every result, document and decision is stored for audit.
Standard, simplified and enhanced checks
KYC is risk-based. The law does not ask for the same checks on every customer. It asks firms to match the depth of the check to the risk. These levels are known as customer due diligence (CDD) and enhanced due diligence (EDD). 1
| Level | When it applies | What it usually involves |
|---|---|---|
| Simplified due diligence | Low-risk situations the firm has assessed and documented | Lighter checks, but never none. Ongoing monitoring still applies |
| Customer due diligence (CDD) | Most customers | Identify and verify the person, understand the purpose of the account, monitor it over time |
| Enhanced due diligence (EDD) | Higher-risk customers: PEPs, links to high-risk countries, unusual patterns | Source of funds and wealth, senior management approval, closer monitoring |
Verification tiers in a real product
Many wallets and neobanks turn these levels into tiers. Each tier allows higher limits or more features once the customer has passed more checks. Where tiers are allowed, and at what limits, depends on your licence, your partner’s policy and local rules.
Tier 1
Basic
Contact details and screening. Very low limits, or a view-only account, where the rules allow it.
Tier 2
Verified
ID document and selfie checked. Normal account limits, cards and transfers.
Tier 3
Enhanced
Source of funds or wealth reviewed by a person. Higher limits and higher-risk features.
KYC also continues after sign-up. Firms must keep customer data current and look again when an ID expires, details change or transaction monitoring flags something unusual. For a business customer, the same process is called KYB.
KYC in the UK, EU and Gulf
The global standard comes from the Financial Action Task Force (FATF), whose recommendations most countries follow. 2 The principles are the same everywhere. The details, documents and digital identity tools differ.
| Market | Main rules | What is different |
|---|---|---|
| United Kingdom | Money Laundering Regulations 2017, supervised by the FCA for most fintechs 1 | Industry guidance from the JMLSG is widely used to interpret the rules 3 |
| European Union | National laws based on the EU anti-money laundering directives | A single EU AML Regulation is due to apply from July 2027, so the rules will become more uniform across member states |
| UAE | Federal AML law and CBUAE rules; free zones have their own regulators | National ID and digital identity services are widely used for remote onboarding |
| Saudi Arabia | Saudi AML law and SAMA rules | Onboarding usually relies on national identity data and local digital identity services |
If you plan to launch in several countries, design KYC so the documents, checks and decision rules can be set per country. We cover what to make configurable in the GCC expansion config matrix.
Example: Omar opens a wallet
Omar downloads a multi-currency wallet that runs under a partner EMI’s licence.
- Sign-up. He enters his details and says he will use the wallet to pay suppliers abroad. He reaches Tier 1 and can look around, but not send money.
- Verification. He photographs his passport and records a short selfie. The KYC provider confirms the document is genuine and the face matches in under two minutes.
- Screening. His name gets a partial match on a sanctions list. The system does not decide alone: it sends the case to the back-office review queue.
- Review. An analyst compares date of birth and nationality, confirms it is a different person, and records why. Omar reaches Tier 2 the same day.
- Later. A year on, Omar wants to move larger sums. The app asks for evidence of his source of funds, and a reviewer approves Tier 3.
Common misconceptions
“KYC is a one-off check at sign-up.”
No. The law requires ongoing monitoring and keeping customer information up to date for as long as the relationship lasts.
“Our KYC provider is responsible if something goes wrong.”
The regulated firm stays responsible. A provider runs checks, but the firm decides the policy, reviews the edge cases and must be able to show its reasoning.
“Stricter KYC is always safer.”
Checks that do not match the risk turn away good customers and bury the compliance team in reviews. Regulators expect a risk-based approach, not the maximum on everyone.
FAQ
What does KYC mean?
KYC stands for Know Your Customer. It is the process a regulated financial firm uses to confirm who a customer is, understand what they will use the account for, and judge how risky they are before and during the relationship.
What documents are needed for KYC?
Usually a government-issued photo ID such as a passport or driving licence, a live selfie or short video to prove the person is real and matches the ID, and sometimes proof of address. Higher-risk customers may also be asked where their money comes from.
How long does KYC take?
With an automated identity verification provider, most customers are checked in a few minutes. Cases that fail an automatic check, or need enhanced due diligence, go to a human reviewer and can take hours or days.
What is the difference between KYC and AML?
AML is the whole programme of rules and controls that stops criminal money entering the financial system. KYC is one part of it: knowing who your customers are. AML also covers sanctions screening, transaction monitoring and reporting suspicious activity.
What is the difference between KYC and KYB?
KYC checks a person. KYB checks a business: that the company exists, who runs it and who really owns it. KYB includes KYC on the directors and beneficial owners behind the company.
Does a fintech have to do KYC itself?
Someone regulated must do it. If you launch under a partner's licence, the partner sets the KYC standard and stays responsible, but your app usually runs the checks through a KYC provider and keeps the evidence.
Is KYC only done once?
No. Firms must keep customer information up to date and refresh checks when something changes, such as an expired ID, a new address, unusual activity or a customer becoming higher risk.
Sources
-
1
LG
legislation.gov.uk The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017
https://www.legislation.gov.uk/uksi/2017/692/contents -
2
F
FATF Financial Action Task Force
https://www.fatf-gafi.org/ -
3
J
JMLSG Joint Money Laundering Steering Group guidance
https://www.jmlsg.org.uk/
