What is know your customer (KYC)?
Know your customer (KYC) is the set of checks a regulated firm runs to confirm a customer’s identity, understand the customer’s business, and decide how much risk the relationship carries. Banks, credit unions, broker-dealers, payment companies, and money services businesses must all run KYC programs, and many countries apply similar duties to lawyers, accountants, and real estate agents.
KYC is the front end of an anti-money laundering (AML) program. Transaction monitoring can only spot unusual activity if the firm has recorded what normal activity looks like for each customer.
How KYC works
A KYC program has four parts. Identification collects and verifies the customer’s name, date of birth, address, and identity number. Due diligence records the purpose of the account, the expected activity, and, for a business, the people who own or control it. Screening checks every name against sanctions lists, politically exposed person lists, and adverse news. Ongoing review refreshes the file on a cycle set by the risk rating, or sooner when ownership or activity changes.
AI handles much of the mechanical work. Intelligent document processing reads passports, driver’s licenses, and company formation papers. Face matching, a narrow use of facial recognition, compares a selfie with the document photo, and liveness detection rejects printed photos and deepfakes. Fuzzy name matching cuts the false hits that common names and transliterated spellings produce. Language models read news articles and judge whether the person named is the customer.
KYC in practice
A regional bank collects formation documents, an ownership certification, and owner identification through its online application for small business accounts. The bank extracts fields from the uploads and groups screening hits that refer to the same person. A language model then drafts a one-page due diligence summary that cites the source of each fact. An analyst reviews the summary, resolves the remaining hits, and assigns the risk rating. Low-risk files clear in one sitting, leaving analysts time for the files that need enhanced due diligence.
A KYC file holds some of the most sensitive personally identifiable information a firm keeps. In Kirk Tech Solutions engagements, identity documents and screening results stay on infrastructure the institution controls, and no risk rating reaches the core banking system without an analyst’s approval.
What to watch for
- Face matching creates biometric data, which some jurisdictions regulate with separate consent and retention rules.
- Generative tools make forged documents and synthetic selfies easy to produce, so test tamper and liveness checks regularly.
- Fuzzy name matching performs unevenly across languages and naming conventions, so test it on the names the firm actually sees.
- Examiners expect a reason for each risk rating and a record of who approved it.