Know your customer

Know Your Customer (KYC) refers to both:

• The activities of customer due diligence that financial institutions and other regulated companies must perform to identify their clients and ascertain relevant information pertinent to doing financial business with them
• And the bank regulation which governs those activities

In the USA, KYC is typically a policy and process implemented to conform to a customer identification program (CIP) mandated under the Bank Secrecy Act and USA PATRIOT Act. Know your customer policies are becoming increasingly important globally to prevent identity theft, financial fraud, money laundering and terrorist financing.

KYC controls typically include:

• Collection and analysis of basic identity information (CIP)
• Name matching against lists of known parties (such as politically exposed person)
• Determination of the customer's risk in terms of propensity to commit money laundering or identity theft
• Creation of an expectation of a customer's transactional behavior
• Monitoring of a customer's transactions against their expected behavior and recorded profile as well as that of the customer's peers.

Banks doing KYC monitoring for anti-money laundering (AML) and checks relating to combating the financing of terrorism (CFT) increasingly use specialized software such as names analysis software and risk scoring algorithm software. Typically, these software systems will identify potentially suspicious or risky customer accounts. The systems create "alerts" which are then subject to manual due diligence or Enhanced Due Diligence (EDD) investigative processes.

KYC has different connotations and the definition above is from an AML/CFT perspective.

Know Your Customer processes are also employed by companies of all sizes for the purpose of ensuring their proposed agents', consultants' or distributors' anti-bribery compliance. Banks, insurers and export credit agencies are increasingly demanding that customers provide detailed anti-corruption due diligence information, to verify their probity and integrity.

Some specialist consultancies help multinational companies and SMEs conduct Know Your Customer processes when entering new markets.

Know Your Customer' Standards

The objective of KYC guidelines is to prevent banks from being used, intentionally or unintentionally, by criminal elements for money laundering activities. KYC procedures also enable banks to know/understand their customers and their financial dealings better which in turn help them manage their risks prudently. Banks should frame their KYC policies incorporating the following four key elements:
- Customer Acceptance Policy;
- Customer Identification Procedures;
- Monitoring of Transactions; and
- Risk management.

For the purpose of KYC policy, a ‘Customer’ may be defined as :

- a person or entity that maintains an account and/or has a business relationship with the bank;
- one on whose behalf the account is maintained (i.e. the beneficial owner);
- beneficiaries of transactions conducted by professional intermediaries, such as Stock Brokers,  Chartered Accountants, Solicitors etc. as permitted under the law, and
- any person or entity connected with a financial transaction which can pose significant reputational or other risks to the bank, say, a wire transfer or issue of a high value demand draft as a single transaction.

Enhanced due diligence

While EDD has not been internationally defined, the USA PATRIOT Act dictates that institutions "shall establish appropriate, specific, and, where necessary, enhanced, due diligence policies, procedures, and controls that are reasonably designed to detect and report instances of money laundering through those accounts."

US regulations require that EDD measures are applied to account types such as Private banking, Correspondent account, and Offshore banking institutions.

Because regulatory definitions are neither globally consistent nor prescriptive, financial institutions are at risk of being held to differing standards dependent upon their jurisdiction and regulatory environment. An article published by Peter Warrack in the July 2006 edition of ACAMS Today (Association of Certified Anti-Money Laundering Specialists) suggests the following:

“A rigorous and robust process of investigation over and above (KYC) procedures, that seeks with reasonable assurance to verify and validate the customer’s identity; understand and test the customer’s profile, business and account activity; identify relevant adverse information and risk assess the potential for money laundering and / or terrorist financing to support actionable decisions to mitigate against financial, regulatory and reputational risk and ensure regulatory compliance.”

Characteristics of EDD

Rigorous and robust

Generally this means consistent, thorough and accurate. The process must be documented and available for inspection by regulators.

The process must be SMART (Specific, Measurable, Achievable, Relevant and Timebound), scalable and proportionate to the risk and resources.

An IT workflow system ensuring that the KYC process and procedures are Defined, Repeatable and Measurable is recommended.

Over and above KYC procedures

EDD files rely upon initial client screening. This definition requires revalidation of the customer’s identity – knowing the client’s identity, not who they say they are. EDD processes should use a tiered approach dependent upon the risk.

Crucial to the integrity of any EDD process is the reliability of information and information sources, the type and quality of information sources used, properly trained analysts who know where to look for information, how to look and how to corroborate, interpret and decide the results. Open source intelligence companies such as World Compliance and C6, aggregate this information and compile it daily into a comprehensive database. Estate Engineer (Civil) Sunil Ch.Das, Agartala Searching on Google, for example, means different things to different people. Experience has shown poor returns from staff that believed they were experienced, but in practice were not and consequently failed to find relevant information.

Reasonable assurance

What is reasonable depends upon factors including jurisdiction, risk, resources, and technology state of the art. For sanction matches it depends upon information provided by regulators. In all cases the suggested standard is to the civil standard of proof i.e. on the balance of probability.

Relevant adverse information

Information obtained from any source, including the Internet, free and subscription databases and the media, which is directly or indirectly indicative of involvement in money laundering, terrorist financing or predicate offenses.

Examples include fraud and other dishonesty, drug trafficking, smuggling or other proscribed offences, references to money laundering, or conducting business, residing in or frequenting countries deemed by the Financial Action Task Force and/or (institution) as being countries under sanction or countries with which (institution) does not do business; to official sanctions or watch lists; and to investigations, convictions or disciplinary findings by authorized regulatory bodies.

KYC Process Capability Maturity Model

A draft KYC Capability Maturity Model was published [1] and shared with a range of international KYC practitioners in 2009 and 2010. An updated and peer-reviewed version will be published in the ACAMS [2] ACAMS Today magazine in early 2011.

The KYC Maturity Model is based on the typical 5 levels of the standard Capability Maturity Model. These levels are typically described as Initial, Repeatable, Defined, Managed and Optimized and have very strict meanings. The KYC maturity has however been somewhat simplified, renamed and re-built as follows: Chaotic, Reactive, Proactive, Service Managed and Value Managed. Practical process improvement learnings have also been taken from common manufacturing and IT productivity methodologies such as Lean, Agile, 6-Sigma, ITIL and Balanced Scorecard.

Customer Due Diligence

CDD refers to the efforts required to understand the customer's profile and establish an expectation about the customer's behavior.

Laws by country

• India: The Reserve Bank of India introduced KYC guidelines for all banks in 2002. In 2004, RBI directed that all banks ensure that they are fully compliant with the KYC provisions before December 31, 2005. The purpose was to prevent money laundering, terrorist financing and theft.
• South Africa: The Financial Intelligence Centre Act 38 of 2001 (FICA)
• USA: Pursuant to the USA Patriot Act of 2001, the Secretary of the Treasury was required to finalize regulations before October 26, 2002, so KYC is now mandatory for all US banks
• New Zealand: Updated KYC laws were enacted in late 2009, and entered into force in 2010. KYC is mandatory for all registered banks and financial institutions (the latter being given an extremely wide meaning).

See also

• Anti-money laundering
• Anti-money laundering software
• Anti-bribery
• Anti-corruption
• Politically exposed person
• Certified copy