Know Your Customer is the part of AML compliance your staff actually perform, every time they onboard a client. Done well it is a short, proportionate process. Done badly it is either meaningless paperwork or so onerous that people quietly skip it — and a skipped check is the one an inspector finds.
What KYC due diligence requires
- Identify the customer and verify identity from reliable, independent documents
- Identify the ultimate beneficial owner where the customer is a company — the natural person who ultimately owns or controls it
- Understand the purpose and intended nature of the relationship
- Screen against sanctions and PEP lists at onboarding and periodically thereafter
- Assess risk and apply enhanced measures where it is elevated
- Monitor the relationship so activity remains consistent with what you were told
- Keep records for a minimum of five years
Beneficial ownership is where files fail
Recording the company that signed the contract is not identifying the beneficial owner. You need the natural person at the end of the chain — and where the structure runs through several jurisdictions, that requires actually working through it.
This is the most common gap we find in existing files. A corporate customer is onboarded, the trade licence is filed, and nobody has established who ultimately controls it. Offshore and multi-layered structures need particular care — see offshore company formation for why those structures attract scrutiny in the first place.
Risk-based, not uniform
The regime expects proportionality. Applying identical checks to every customer wastes effort on low-risk relationships and gives insufficient attention to high-risk ones.
Standard due diligence for ordinary customers in low-risk categories. Enhanced due diligence where risk is elevated: politically exposed persons, higher-risk jurisdictions, complex ownership structures, unusually large or unexplained transactions, or relationships conducted entirely remotely.
Enhanced measures typically mean establishing source of wealth as well as source of funds, senior management approval to onboard, and closer ongoing monitoring.
Politically exposed persons
A PEP is someone entrusted with a prominent public function, and the definition extends to close family members and known associates.
PEP status is not a prohibition — you may deal with them. It requires enhanced due diligence, senior approval, and establishing source of wealth. What you cannot do is fail to identify the status, which is why screening at onboarding and periodically thereafter matters rather than a one-off check.
When checks must be done
Before establishing the relationship, or before carrying out an occasional transaction above the applicable threshold. Not afterwards, and not when convenient.
Existing customers need periodic refresh too. A file completed three years ago on a customer whose activity has since changed materially is not current, and "we checked them when they joined" is not an answer at inspection.
When due diligence produces a suspicion
If checks raise suspicion of money laundering or terrorist financing, you file a suspicious transaction report through goAML — generally within 24 to 48 hours of discovery.
You must not tip off the customer that a report has been made. That is a separate offence, and it is the point where staff most need training, because the instinct to explain a delay is strong. Training is part of the wider programme for exactly this reason.
Making it workable
The programmes that survive contact with a busy office are the simple ones: a one-page onboarding form, a clear escalation route when something looks unusual, and a named person who decides. Elaborate procedures get bypassed under time pressure.
We build templates around how your team actually onboards clients, then train them on the judgement calls — because the documentation is easy and knowing when to escalate is not.
Frequently asked questions
Trade licence, memorandum, register of shareholders and directors, and identification for the ultimate beneficial owners - the natural persons at the end of the ownership chain.
Work through the ownership chain to the natural person who ultimately owns or controls the entity. Recording the immediate corporate shareholder is not sufficient.
Yes, with enhanced due diligence, senior management approval and source of wealth established. The failure is not identifying the status.
Periodically, risk-based - more frequently for higher-risk relationships, and whenever the customer's activity changes materially.
No. Tipping off is a separate offence. This is the point where staff most need clear training and a script.
A minimum of five years, and the obligation continues after the relationship ends.
Getting started
Send us a sample of your current onboarding file. Whether beneficial ownership is actually identified in it tells us more about your position than any policy document would.