KYC/AML
Also known as: Know Your Customer, Anti-Money Laundering, AML compliance, identity verification, customer due diligence
KYC (Know Your Customer) and AML (Anti-Money Laundering) are two related regulatory compliance frameworks required of financial services businesses.
KYC refers to the process of verifying the identity of customers (and sometimes their source of funds) when onboarding them, typically using government-issued ID, proof of address, and business documentation. AML refers to the broader policies, procedures, and monitoring systems designed to detect, prevent, and report financial transactions that may be related to money laundering, terrorist financing, or other financial crimes. Together, KYC/AML compliance is a legal obligation for banks, crypto exchanges, payment processors, money transmitters, and many fintech companies.
KYC/AML, explained at three levels
At home
KYC (Know Your Customer) is why you have to show your passport or driver's license when opening a bank account or signing up for a financial service. Banks and financial apps are legally required to verify your identity before providing services; this is to prevent criminals from using anonymous accounts for money laundering or financing crime. AML (Anti-Money Laundering) is the ongoing monitoring that happens after you open the account: the bank's systems watch for unusual transaction patterns that might indicate the account is being used for financial crime.
At work
If your business provides financial services (payments, lending, crypto, money transfers), you are likely subject to KYC/AML requirements. This means verifying customer identities before onboarding, screening customers against government watchlists (sanctions lists, politically exposed persons), filing Suspicious Activity Reports (SARs) when you observe potentially illegal transaction patterns, and maintaining records for regulatory examination. Non-compliance can result in significant fines (banks have paid billions in AML penalties) and criminal prosecution for serious violations.
At home
KYC tiers: basic KYC (name, date of birth, address, government ID verification) is required for most financial account opening. Enhanced Due Diligence (EDD) applies to higher-risk customers: politically exposed persons (PEPs, politicians, government officials), customers from high-risk jurisdictions, and customers with complex ownership structures. EDD requires deeper investigation into source of funds, business purpose, and beneficial ownership. Financial institutions must apply risk-based approaches: more scrutiny for higher-risk customers, proportionate checks for lower-risk ones.
At work
KYC technology platforms (Onfido, Jumio, Persona, Sumsub) automate identity verification: document capture and AI-powered verification (checking ID authenticity, facial matching), global database checks (sanctions, PEP, adverse media), address verification, and liveness detection (preventing fake photo attacks). APIs from these platforms integrate into product onboarding flows, reducing manual review time for standard KYC from hours to seconds. Manual review queues handle edge cases and higher-risk profiles that automated systems flag.
At home
Crypto-specific AML requirements: the FATF Travel Rule requires Virtual Asset Service Providers (VASPs, crypto exchanges, custodians) to collect and transmit originator and beneficiary information for cryptocurrency transactions above set thresholds ($3,000 in the US and $1,000 in Canada; the EU's rules, in force since December 2024, apply to transfers of any size). This creates a significant technical challenge: blockchain transactions don't natively carry this data. Travel Rule compliance solutions (Notabene, Sygna Bridge) create secure data exchange channels between VASPs to transmit the required information alongside blockchain transactions.
At work
AML transaction monitoring systems analyze customer transaction patterns in real time against behavioural rules and machine learning models to identify suspicious activity. Sophisticated systems (Chainalysis for crypto, NICE Actimize for banking) flag transactions that deviate from a customer's expected pattern, match known money laundering typologies, or involve high-risk counterparties. Flagged transactions are reviewed by compliance analysts who determine whether to file a Suspicious Activity Report (SAR) with FinCEN in the US, FINTRAC in Canada (where it is called a suspicious transaction report), or the equivalent financial intelligence unit. SAR filing numbers, alert-to-SAR rates, and false positive rates are key compliance program performance metrics.
Real-world examples
At home
Carlos opened a crypto exchange account and was required to complete KYC verification: he uploaded his passport photo, took a selfie for facial matching, and provided his address. The platform's automated system verified his ID in under two minutes and his account was approved. He later initiated a large wire withdrawal and was asked additional questions about the source of funds: Enhanced Due Diligence triggered by the transaction size.
At work
Sophie was the compliance officer at a fintech startup offering money transfer services. Her team implemented a KYC platform (Persona) that automated ID verification and sanctions screening at onboarding, and integrated with a transaction monitoring system that flagged patterns consistent with structuring (breaking large amounts into smaller transactions to avoid reporting thresholds). The compliance program satisfied regulatory examination requirements and enabled the company to obtain a money transmitter license in 30 states.
Common confusions
- Many founders assume KYC/AML compliance is only required for traditional banks — KYC/AML obligations extend to money services businesses (MSBs), which include money transmitters, check cashers, currency exchanges, and increasingly, crypto exchanges and some fintech companies. If your product moves money between parties, you likely have FinCEN registration and AML program requirements regardless of whether you're a bank. The MSB definition is broader than most founders expect, and the consequences of operating as an unlicensed MSB without AML compliance can include criminal prosecution in addition to fines.
- Some assume that using a licensed payment processor for transactions means they have no AML obligations of their own — Using Stripe or another payment processor means the processor handles KYC for its own compliance, but it does not transfer your AML obligations to them. If your business is independently subject to AML requirements (because you are an MSB, crypto exchange, or lending platform), you must have your own KYC/AML program regardless of which payment processor you use. The processor's compliance covers their own regulatory relationship; it does not create a compliance umbrella for your business.
For analysts
When a fintech or crypto client is designing their product, the regulatory perimeter question should be addressed early: does this product trigger money transmitter, broker-dealer, or other financial services licensing requirements that mandate a KYC/AML program? This determination should involve legal counsel specializing in financial regulation in every jurisdiction of planned operation. Getting this wrong is expensive to fix after launch: retroactively implementing KYC on an existing user base, applying for delayed licensing, or negotiating with regulators about past non-compliance is far more costly than building compliance into the product from the start.
History & origin
Modern KYC/AML regulation in the US is rooted in the Bank Secrecy Act (1970), which required financial institutions to report suspicious transactions to the government. The Financial Action Task Force (FATF), established in 1989, created international AML standards adopted across member countries. The September 11, 2001 terrorist attacks dramatically intensified AML regulation globally: the USA PATRIOT Act (2001) expanded KYC requirements and created new obligations for financial institutions to prevent terrorist financing. The EU's Anti-Money Laundering Directives (AMLD series, from 1991 through AMLD6 in 2021) created unified European AML requirements. Crypto exchange KYC/AML obligations have been progressively clarified and expanded: the FATF Travel Rule (requiring customer data to travel with cryptocurrency transactions) was extended to crypto service providers, creating significant compliance infrastructure requirements for exchanges globally.