Glossary

KYC is the process of verifying that a customer is who they say they are, and by extension, that a financial organization is able to legally conduct business with that customer. KYC roots are in legislation laying out requirements for financial entities to protect against money laundering and the financing of terrorism. This includes the USA Patriot Act and the European Anti-Money Laundering Directive, among others.

KYC procedures need to be followed from the start of any business relationship. This includes verifying the identity of the customer as part of a customer identification program (CIP). In the case of businesses, this extends to identifying the ownership structure and ultimate beneficial owner (UBO) of the organization. Customers, organizations or UBOs may not be on any sanctions lists. Other steps include identifying the customer’s business activities, verifying a legitimate source of funding and assessing money laundering risks. All of these steps are parts of due diligence.

However, this process does not end once a customer is onboarded. This is an ongoing process. Depending on the customer’s risk profile, the customer needs to be reviewed periodically, with higher risk clients reviewed more frequently.

In general terms, KYC applies to financial and credit institutions, though this definition is broad. For example, the EU imposes an upper limit of EUR 50 on the value of pre-paid anonymous cards that may be sold. This is to prevent these cards from being abused for illegal purposes.

Legislation governing KYC differs from jurisdiction to jurisdiction. Two of the most important pieces of legislation are the USA Patriot Act and the EU’s Anti-Money Laundering Directive.

The EU’s Anti-Money Laundering Directive refers to “obliged entities” who must implement KYC. These include insurance companies, investment firms, credit institutions and financial services. The most recent update to the directive, Anti-Money Laundering Directive 5, also added wallet service providers and crypto companies to the list of obliged entities.

In the USA, the Patriot Act applies to banks and financial institutions, including those based in other countries who maintain correspondent accounts with banks and financial institutions in the US.

When onboarding merchants, payment facilitators must collect information on the merchant. This information is then used to verify the identity of the merchant, for example against government and industry databases. 

As well as establishing the identity of the merchant, the provider must ensure that the merchant is not on any sanction or watch lists. This includes lists like Mastercard’s Member Alert to control High Risk Merchants (MATCH) list, a collection of merchants terminated by other payment providers.

eKYC stands for “electronic KYC”. It refers to the process of using the internet or other digital means to verify the identity of a customer. Necessary documents can be submitted digitally, and the identity of a person established using a variety of methods. These include video or photo verification in conjunction with a physical ID, or purely electronic verification using electronic signatures.