The full form of KYC is Know Your Customer.

Know Your Customer (KYC) procedures are a critical function to assess customer risk and a legal requirement to comply with Anti-Money Laundering (AML) laws. Effective KYC involves knowing a customers identity, their financial activities and the risk they pose.

“KYC” refers to the steps taken by a financial institution (or business) to:

• Establish customer identity
• Understand the nature of the customer’s activities (primary goal is to satisfy that the source of the customer’s funds is legitimate)
• Assess money laundering risks associated with that customer for purposes of monitoring the customer’s activities

To create and run an effective KYC program requires the following elements:

In recent years, authorities in the US and abroad have increased their focus on modernizing and enforcing anti-money laundering and terrorism financing (AML) regulations. As part of these efforts, the US’s Financial Crimes Enforcement Network (FinCEN) proposed Know Your Customer (KYC) requirements in 2014, which we expect to be finalized this year. [1]

FinCEN’s KYC requirements were proposed as part of a broader regulation setting out the core elements of a customer due diligence program. [2] Taken together, these elements are intended to help financial institutions avoid illicit transactions by improving their view of their clients’ identities and business relationships.

Importantly, the proposed requirements establish only a baseline for performing customer due diligence, which should be supplemented by the institution’s own assessment of each client’s risk profile. [3] While the proposal clearly outlines its baseline requirements, criteria for internal customer risk assessments are largely left open to interpretation. This lack of clarity has caused some confusion within the industry, especially with respect to identifying “beneficial owners” of customers that are legal entities (i.e., identifying people who own a large portion of the legal entity customer) because the ownership threshold that triggers the proposed KYC requirements is determined in part based on the institution’s internal customer risk assessment.

Performing internal AML risk assessments and collecting the required customer information will no doubt be operationally challenging. While institutions can rely on third parties to provide needed information in certain cases, the ultimate compliance responsibility rests with the financial institutions themselves.

Given the consequences of non-compliance (evidenced by unprecedented AML-related penalties levied against the industry in the past few years), institutions should begin their implementation efforts as soon as possible, based on the proposed requirements and industry best practices. This is particularly important for global institutions that are subject to similar requirements in other jurisdictions (e.g., the EU’s AML Directive IV) [4] that will need to reconcile regulatory differences across jurisdictions, and for institutions that are currently undertaking remediation in response to regulatory scrutiny.

This post provides our view of (a) the risk-based approach to establishing beneficial ownership thresholds, (b) factors to consider when relying on customer information provided by third parties, and (c) what institutions should be doing now.