The KYC Process: Steps, Checks and Documents Explained

KYC is the foundational compliance process for any business that handles money or financial assets on behalf of customers. Banks, fintechs, payment processors, crypto exchanges, fund managers, insurers and lending platforms are all required to run KYC programmes proportionate to their risk.

Done well, KYC protects a firm from unknowingly facilitating money laundering, terrorist financing, sanctions evasion, fraud and tax evasion. Done poorly, it exposes the firm to enforcement action, reputational damage and — in the most serious cases — personal liability for senior management.

The financial cost of KYC failures has grown substantially over the past decade. Regulators in the US, EU, UK and Singapore have imposed penalties running into billions of dollars on institutions that failed to verify customer identities adequately or onboarded customers without understanding their true beneficial ownership. Beyond the headline fines, the consequences typically include remediation programmes that can run for years, restrictions on onboarding new customers, and individual liability for compliance officers and senior management.

The commercial stakes are just as real. Customers expect fast digital onboarding. A KYC process that takes days, demands repeated document uploads, or rejects genuine customers because of poor data quality directly damages conversion and acquisition costs. Modern customer onboarding platforms resolve this tension by combining automated identity verification with risk-based workflows that complete most cases in minutes and reserve manual review for genuinely higher-risk profiles.

A complete KYC programme has four components. Regulators expect a firm to show how each is designed, how it is operated, and how the four work together to deliver its risk-based approach.

The CIP is the foundational identity step. The firm obtains and verifies specific identifying information for every customer at onboarding. For individuals this is typically full legal name, date of birth, residential address and a government-issued identification number, verified against a passport, national identity card or driving licence — or through reliable electronic verification. For corporate customers it is the legal name, registered address, jurisdiction, registration number and evidence of legal existence.

Modern CIP relies increasingly on digital verification — document authentication, biometric face matching and liveness detection — to confirm that the person presenting the document is its genuine owner. Automated KYC verification platforms complete this in about a minute for most customers.

Once identity is verified, CDD assesses the customer's risk: the purpose and intended nature of the relationship, the customer's occupation or business, and their expected activity, together with screening against sanctions lists, politically exposed person (PEP) databases and adverse media. The output is a risk rating — typically low, medium or high — that sets the intensity of monitoring and the frequency of periodic review. See our CDD guide for the detail.

EDD applies when risk is higher — PEPs, customers connected to high-risk jurisdictions, complex corporate structures, or activity inconsistent with the stated profile. It typically adds source-of-funds and source-of-wealth evidence, additional identity checks and senior management approval before the relationship is established. See when EDD is required.

KYC does not end at onboarding. Throughout the relationship the firm monitors transactions for activity inconsistent with the customer's profile, rescreens against sanctions and PEP lists as they change, and refreshes customer information so the risk rating stays accurate. Transaction monitoring systems automate this at scale and route alerts to analysts for investigation.

The documents most commonly accepted for KYC are a valid passport or national identity card for identity, and — where required — a recent utility bill or bank statement for address. Many regulators now accept reliable electronic or government digital-ID verification instead of document uploads, and higher-risk customers may also need source-of-funds and source-of-wealth evidence.

For the full list by customer type, including what to collect from businesses, see our KYC checklist: documents and steps for onboarding.

Until the mid-2010s, KYC was largely manual: paper forms, in-branch identity checks and back-office review. It was slow, expensive and error-prone, and account opening routinely took days — long enough for many applicants to give up before they were onboarded.

eKYC — electronic Know Your Customer — compresses this into minutes. The customer captures their identity document and a live selfie in an app or browser; the platform authenticates the document, matches the selfie to the document photo, runs liveness detection to defeat spoofing, and screens against sanctions and PEP lists in parallel. Where the data is clean and the risk is low, the whole process completes without human intervention.

The benefits are faster onboarding, lower drop-off, lower review costs and more consistent decisions. The trade-off — automated systems can falsely reject genuine customers — is managed with risk-based escalation that routes edge cases to human review rather than rejecting them outright. Our eKYC and digital identity guide covers the technology in depth.

Traditional programmes refresh customer information on a fixed cycle — commonly every one, three or five years depending on risk. That leaves customers' information out of date between reviews and creates large, recurring review backlogs.

Perpetual KYC (pKYC) replaces the calendar with events: a change of address, ownership or behaviour, a new sanctions or adverse media hit, or unusual activity triggers a targeted review when it happens. See our perpetual KYC guide.