How it works

KYC typically covers collecting identifying information (name, date of birth, address, identification number), verifying it against documents or reliable electronic sources, screening the customer against sanctions and PEP lists, and assigning a risk rating. The risk rating then determines how much due diligence applies and how often the profile is refreshed. KYC is the identity layer of broader customer due diligence (CDD).

Requirements by jurisdiction

• US: Banks must run a Customer Identification Program (31 CFR 1020.220) that collects at least name, date of birth, address and identification number before account opening and verifies identity within a reasonable time. The CDD Rule adds beneficial ownership and customer risk profiles. FinCEN's April 2026 proposed AML/CFT program rule would further emphasize risk-based programs but is not final.

• EU: The AML Regulation (EU) 2024/1624 harmonizes identification and verification requirements across member states from 10 July 2027, replacing divergent national transpositions of the AML directives. Customer information for higher-risk customers must be updated at least annually.

• UK: The Money Laundering Regulations 2017 require identification and verification before establishing a business relationship. Amendments in force from 30 June 2026 (SI 2026/621) replaced euro thresholds with sterling amounts, for example setting the occasional-transaction transfer-of-funds trigger at £800.

Common challenges

Remote onboarding increases exposure to synthetic and stolen identities. Data quality issues make screening noisy, and periodic refreshes are often backlogged. Firms operating across the US, EU and UK must reconcile different document standards and thresholds. The FATF's 2025 revision of its standards notes that non-face-to-face onboarding is not automatically higher risk where appropriate mitigation, such as reliable digital identity, is in place.

How teams handle it in practice

Teams usually combine document and biometric verification vendors with sanctions and PEP screening, then apply a rules- or model-based risk score. Event-driven refreshes (triggered by changes in behavior or ownership) supplement fixed review cycles. Compliance platforms like Corsa can orchestrate these checks and keep risk ratings current as new data arrives.