Know Your Customer (KYC)

The mandatory baseline for onboarding any customer, requiring the collection and verification of four core identifiers: name, date of birth, address, and government-issued identification number. For legal entities, this extends to verifying the entity's legal status, business address, and authorized signatories.

• Documentary verification: Validating passports, driver's licenses, or articles of incorporation against trusted sources
• Non-documentary verification: Cross-referencing credit bureau data, public records, or proprietary databases when physical documents are unavailable
• Recordkeeping: Maintaining verified identity records for five years after account closure per FinCEN requirements

CIP forms the legal backbone of a KYC program under Section 326 of the USA PATRIOT Act.

The risk assessment layer that goes beyond identity verification to build a baseline behavioral profile. CDD collects information about the customer's anticipated transaction patterns, source of funds, and business purpose to establish what constitutes normal activity.

• Standard CDD: Applied to all customers, capturing occupation, expected transaction volume, and account purpose
• Risk rating: Assigning a composite score based on product type, geography, and customer segment
• Profile creation: Establishing the expected behavioral baseline against which future anomalies are measured

This profile becomes the reference point for ongoing transaction monitoring and anomaly detection systems.

A deeper investigative layer triggered when a customer is classified as high-risk. EDD requires additional scrutiny beyond standard CDD to understand complex ownership structures and the true source of wealth.

• Politically Exposed Persons (PEPs): Mandatory EDD for foreign officials and their immediate family members
• Source of Wealth verification: Tracing the origin of assets through pay stubs, tax returns, or sale agreements—not just the source of funds for a single transaction
• Beneficial ownership mapping: Piercing through shell corporations and layered entities to identify the natural person with 25% or more ownership or control
• Senior management approval: Required to onboard or maintain high-risk relationships

EDD is not a one-time event; it requires periodic refresh cycles aligned with the customer's risk rating.

The continuous vigilance layer that ensures the customer's risk profile remains current. This component connects KYC directly to transaction monitoring and sanctions screening systems.

• Periodic refresh cycles: Low-risk customers reviewed every 3 years; high-risk customers reviewed annually or more frequently
• Trigger events: Material changes in account activity, adverse media alerts, or new PEP status require immediate CDD/EDD refresh
• Watchlist re-screening: Continuous or batch screening against updated sanctions, law enforcement, and adverse media lists
• Profile deviation detection: When actual transaction behavior diverges from the CDD baseline, triggering investigation or SAR filing

This component closes the loop between static identity verification and dynamic behavioral anomaly detection.

The Fifth Pillar mandated by FinCEN's CDD Rule, requiring financial institutions to identify and verify the natural persons behind legal entity customers. This component is designed to pierce through shell corporations and complex ownership structures.

• 25% ownership threshold: Any individual owning 25% or more of a legal entity must be identified
• Control prong: One individual with significant managerial control must be identified, regardless of ownership percentage
• Certification form: Collection of a standardized beneficial ownership form at account opening
• Verification: Identity verification of beneficial owners using the same CIP standards applied to individual customers

This component directly addresses the exploitation of anonymous shell companies for money laundering and sanctions evasion.

The overarching principle that governs how the other components are applied. Not all customers require the same level of scrutiny; resources must be allocated proportionally to the level of identified risk.

• Risk factors: Product complexity, geographic exposure, customer type, delivery channel, and transaction volume
• Tiered application: Low-risk mass retail customers receive streamlined CDD; high-risk correspondent banks receive exhaustive EDD
• Dynamic adjustment: Risk ratings are not static—they evolve based on monitoring outputs, triggering escalations or downgrades
• Regulatory expectation: A risk-based approach is not optional; it is the core expectation of FATF Recommendation 10 and national AML regulations

This calibration ensures that investigative resources focus on the highest-risk relationships rather than being diluted across the entire customer base.