Definition
Know Your Customer (KYC) is the set of controls a regulated institution uses to establish a customer's true identity, understand the purpose and intended nature of the relationship, and maintain that understanding for as long as the relationship exists. KYC is not a one-time onboarding gate — it is a living record.
Why it exists
Money laundering depends on anonymity. If a criminal can move value through an account without the institution knowing who ultimately controls it, every downstream control — monitoring, sanctions screening, reporting — is operating blind. KYC exists to remove anonymity at the entry point and keep it removed.
Real example
A jewellery trading company opened a current account declaring annual turnover of ₹2 crore. Within four months the account received ₹41 crore from eighteen counterparties across four states, each transfer just below the reporting threshold. The KYC file had never been refreshed against actual behaviour. The gap between the declared profile and the observed profile was the alert — and nobody was looking at it.
Visual walkthrough
Identify
Collect identity data on the customer and its controllers.
Verify
Confirm that data against independent, reliable sources.
Understand
Establish expected activity, source of funds and purpose.
Monitor
Compare real behaviour to the expected profile, continuously.
Refresh
Update the file on trigger events and risk-based cycles.
The four pillars of a KYC programme
- Customer Identification Programme (CIP) — who is this person or entity?
- Customer Due Diligence (CDD) — what do we expect them to do?
- Ongoing Monitoring — is that what they are actually doing?
- Record Keeping — can we prove all of the above, years later?
KYC is risk-tiered
A salaried individual with a savings account and a trust with offshore beneficiaries do not receive the same treatment. Low risk gets simplified measures, standard risk gets baseline CDD, and high risk gets Enhanced Due Diligence with senior sign-off.
Trigger events that force a refresh
- Change in beneficial ownership or control
- Significant unexplained change in transaction volume or geography
- Adverse media or a new sanctions/PEP match
- Expiry of identity documents or periodic review falling due
Common mistakes
- Treating KYC as an onboarding task that ends once the account opens.
- Verifying the front person while never establishing ultimate beneficial ownership.
- Accepting a declared source of funds without a single corroborating document.
- Copying the customer's own description of their business into the risk rationale.
- Refreshing files on a calendar only, ignoring behaviour-driven triggers.
Quick summary
— KYC = identify + verify + understand + monitor + refresh.
— The expected profile is the benchmark every transaction is judged against.
— Depth of KYC is set by risk, never by relationship value.
— If it is not documented, it did not happen.
Mini quiz
Question 1
A customer's declared turnover is ₹2 crore but the account receives ₹41 crore in four months. What has primarily failed?
Question 2
When must a KYC file be refreshed?
Question 3
Which of these is NOT part of Customer Due Diligence?
Flashcards
Related regulations
- FATF Recommendation 10 — Customer Due Diligence
- PMLA, 2002 & PML (Maintenance of Records) Rules, 2005
- RBI Master Direction on KYC
- SEBI KYC Registration Agency Regulations
Continue in this track
Customer Due Diligence (CDD)
The baseline set of measures applied to every customer to understand identity, ownership and purpose.
Enhanced Due Diligence (EDD)
Additional scrutiny applied where risk is high: deeper sourcing, senior approval, tighter review cycles.
Beneficial Ownership
Identifying the natural persons who ultimately own or control a legal entity, through every layer.