Know your customer, often shortened to KYC, is the process financial institutions use to identify a customer and verify that identity before opening or maintaining an account.

Know your customer, often shortened to KYC, is the process financial institutions use to identify a customer and verify that identity before opening or maintaining an account. In United States anti money laundering rules, covered financial institutions must establish and maintain written procedures that are reasonably designed to identify and verify the identity of each customer.

For a customer who is an individual, the minimum identifying information that must be collected includes the customer’s name, date of birth, address, and an identification number. The identification number for a United States person is a taxpayer identification number, and for a non United States person it can be one or more of several government issued document numbers such as a passport number and country of issuance, an alien identification card number, or another government issued document showing nationality or residence and bearing a photograph or similar safeguard.

Verification means the institution uses risk based procedures to form a reasonable belief that it knows the true identity of the customer. Those procedures can use documentary methods, non documentary methods, or a combination of both. Documentary verification can include checking an unexpired government issued identification document that shows nationality or residence and bears a photograph or similar safeguard. Non documentary verification can include contacting the customer, independently verifying identity through comparison with information from a consumer reporting agency, public database, or other source, checking references with other financial institutions, or obtaining a financial statement.

The purpose of these checks is to make it harder for criminals to misuse the financial system through anonymous or false identities. KYC is a core part of anti money laundering controls and customer due diligence. Customer due diligence also extends beyond basic identity collection and verification. It includes identifying and verifying beneficial owners of legal entity customers, understanding the nature and purpose of customer relationships to develop a customer risk profile, and conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

Record retention is part of the obligation. A financial institution must keep a record of the identifying information it obtained, and it must keep a description of any document relied on for verification, any non documentary methods and results, and the resolution of any substantive discrepancy discovered when verifying identity. These records must generally be retained for five years after the account is closed, except that a record of the identifying information itself must be retained for five years after the record is made.

In practice, this means a firm does not simply accept a name on a form and move funds. It collects the core identity fields, applies verification steps that fit the customer’s risk, documents how verification was completed, and preserves that evidence for the required retention period. For model risk assessment and control design, the important point is that identity verification is a mandatory control embedded in account opening and customer due diligence, not an optional operational preference.

Covered in depth in the From research to publishing pillar hub.