Know Your Customer

Anyone opening an account at a bank has to prove their identity. This isn’t a courtesy on the bank’s part, but a legal requirement. It’s called “Know Your Customer” in English, abbreviated KYC. The company has to know who is behind an account and record this information in a verifiable way. This includes name, date of birth, address, and an official identity document. The obligation applies not only to banks, but also to insurers, crypto exchanges, real estate agents, and payment service providers.

Why the state wants to know who owns an account

Criminal money only becomes useful once it looks inconspicuous. For exactly that purpose, you need accounts that are held by no one in particular or under false names. If every bank verifies the identity of its customers, this route becomes significantly harder. KYC is therefore at the core of anti-money-laundering rules, that is, rules against smuggling illegal proceeds into the normal economic cycle.

For companies, this is not a voluntary extra. Violations can become very expensive. Large banks have paid fines in the billions in recent years because their controls had gaps. In the worst case, the loss of a license looms, meaning the end of the business. That’s why banks employ entire departments dedicated solely to this topic.

But there is also a downside. Every check costs time and deters customers who are in a hurry. And people without a permanent address or without common identity documents have a hard time getting an account at all. KYC is thus always a trade-off between security and accessibility.

From the ID photo to ongoing monitoring

The first step is identification. In the past, you would go to the post office or a branch for this. Today it’s usually done via video or an app: you hold your ID up to the camera, turn it, and speak or move your head. Software checks the security features of the document and compares the photo ID with the live image.

After that comes the comparison against lists. It is checked whether a person appears on a sanctions list, meaning they are subject to punitive measures. It is also checked whether they hold a high political office or appear in investigations. For corporate customers, there is the additional question of which person ultimately really owns the company. This person is called the beneficial owner.

KYC doesn’t end with account opening. After that, systems continuously monitor payments. If a student account suddenly receives large sums from abroad, the system raises an alarm. This is increasingly where artificial intelligence comes into play, that is, software that has learned patterns from millions of past cases. It is meant to distinguish genuine irregularities from harmless exceptions. This matters because classic rule-based systems generate a great many false alarms that employees have to process by hand.

KYC at neobanks, crypto exchanges, and in acquisition news

Most commonly, people encounter KYC when signing up for financial apps. A brokerage account with an online broker, an account with a smartphone bank, an account with a crypto exchange: everywhere, an identity check follows registration. Providers that trade cryptocurrencies are now also subject to the same rules as banks in the EU.

In business news, the term usually appears in two contexts. Either a regulator has penalized a company for poor controls. Or a provider of verification software gets acquired, because this market is growing strongly. Companies like IDnow, Sumsub, or Onfido make their living from exactly this.

A common misconception is that KYC is the same as data protection. The opposite is closer to the truth: KYC obliges companies to collect personal data and retain it for years. Data protection rules, in turn, limit what else may be done with that data. Both areas therefore exist in a tension that companies have to balance.