Know Your Customer

The foundational element of KYC requiring financial institutions to collect and verify four core pieces of identifying information before opening an account:

• Name: Full legal name verified against government-issued documentation
• Date of Birth: Confirmed via identity documents or credit bureau records
• Address: Residential or business street address, not a P.O. box
• Identification Number: Social Security Number, Taxpayer Identification Number, or passport number for non-U.S. persons

The CIP must be completed within a reasonable time after account opening, with documentary or non-documentary verification methods applied based on the institution's risk-based procedures.

The investigative process of collecting and evaluating information about a customer's identity, beneficial ownership, and the nature of their business relationship to mitigate financial crime risk. CDD operates on a risk-based spectrum:

• Standard CDD: Applied to lower-risk customers, verifying basic identity and intended account usage
• Enhanced Due Diligence (EDD): Required for high-risk categories including politically exposed persons (PEPs), correspondent banking relationships, and jurisdictions with weak AML controls
• Simplified Due Diligence (SDD): Permitted for demonstrably low-risk products or customers where full verification is disproportionate to risk

The Financial Action Task Force (FATF) Recommendation 10 establishes the global standard for CDD measures.

The legal requirement to identify the natural persons who ultimately own or control a legal entity, piercing the corporate veil of shell companies and complex ownership structures. Key thresholds:

• 25% Ownership Rule: Any individual owning 25% or more of the equity interests must be identified
• Control Prong: At least one individual with significant managerial control must be identified, regardless of ownership percentage
• Multi-Layer Structures: Beneficial ownership must be traced through multiple intermediary entities until the natural person is reached

This component directly targets the exploitation of anonymous shell companies in synthetic identity fraud and money laundering schemes.

KYC is not a one-time event but a continuous lifecycle obligation. Institutions must:

• Transaction Monitoring: Screen customer activity against expected behavioral profiles to detect anomalies indicative of money laundering or fraud
• Periodic Reviews: Update customer risk ratings and refresh identity documentation at intervals determined by risk level (annually for high-risk, every 3-5 years for low-risk)
• Suspicious Activity Reports (SARs): File mandatory reports with FinCEN within 30 calendar days of detecting a known or suspected violation of law or suspicious transaction involving $5,000 or more
• Event-Driven Reviews: Trigger re-verification upon material changes such as negative media, law enforcement inquiries, or unusual transaction spikes

The automated process of screening customer names, aliases, and associated entities against government-issued sanctions lists and internal watchlists at onboarding and on an ongoing basis. Critical screening sources include:

• OFAC SDN List: The Office of Foreign Assets Control's Specially Designated Nationals and Blocked Persons List, prohibiting transactions with designated individuals and entities
• UN and Regional Sanctions: Consolidated lists from the United Nations Security Council, European Union, and HM Treasury
• Internal Blacklists: Institution-specific lists of previously terminated relationships, confirmed fraudsters, and entities flagged through internal investigations

Effective screening requires fuzzy matching algorithms to catch transliteration variations, aliases, and deliberate misspellings designed to evade detection.

The systematic methodology for assigning a risk score to each customer based on a composite of factors that influence their potential for money laundering or terrorist financing. Common risk dimensions include:

• Geographic Risk: Country of residence, nationality, and transaction corridors involving high-risk jurisdictions or those with weak AML regimes
• Product Risk: Inherent vulnerability of specific products (e.g., private banking, cross-border wire transfers, virtual currency services)
• Customer Type Risk: PEP status, cash-intensive businesses, non-resident accounts, and complex corporate structures
• Channel Risk: Non-face-to-face onboarding, reliance on third-party introducers, and digital-only relationships

The resulting risk tier (low, medium, high) determines the intensity of ongoing monitoring and the frequency of periodic reviews.

The foundational investigative process of collecting and verifying a customer's identity, understanding the nature of their business, and assessing their risk profile before establishing a financial relationship. CDD requires identifying beneficial owners who ultimately control legal entities, piercing through shell companies and complex corporate structures. Enhanced Due Diligence (EDD) applies additional scrutiny to high-risk customers, such as politically exposed persons (PEPs) or those in high-risk jurisdictions.

• Standard CDD: Identity verification, business nature assessment
• Enhanced CDD: Source of wealth, source of funds, ongoing monitoring
• Triggered by risk factors: geography, product type, delivery channel

The technical process of confirming that a claimed identity corresponds to a real, unique individual. This multi-layered approach combines document verification (validating government-issued IDs using OCR and computer vision), biometric comparison (matching a selfie to the document photo), and database cross-referencing (checking against credit bureaus, utility records, and government registries). Liveness detection ensures the presenter is physically present and not a spoofing artifact such as a photograph, video mask, or deepfake.

• Document-centric: Passport, driver's license, national ID
• Biometric-centric: Facial matching, fingerprint, iris scan
• Knowledge-based: Dynamic questions from credit file data

The computational engine behind modern KYC that identifies, links, and merges disparate records referring to the same real-world entity across siloed data sources. Without a common unique identifier, entity resolution relies on fuzzy matching algorithms (Levenshtein distance, Jaro-Winkler similarity) and probabilistic record linkage (Fellegi-Sunter model) to calculate match likelihoods. Graph-based entity resolution models records as nodes and similarity scores as edges, applying community detection to resolve identities and uncover hidden synthetic identity rings.

• Deterministic matching: Exact key joins on SSN, passport number
• Probabilistic matching: Likelihood ratios for name, DOB, address
• Blocking keys: Partitioning data to reduce O(n²) comparison complexity

The legal principle requiring financial institutions to identify the natural persons who ultimately own or control a legal entity, typically defined as individuals holding 25% or more equity or exercising significant control. This is the critical mechanism for piercing the corporate veil of shell companies used in synthetic identity fraud and money laundering. The Financial Action Task Force (FATF) mandates that beneficial ownership information be accurate and up-to-date, driving the need for automated ownership structure analysis.

• Ownership threshold: ≥25% equity interest (varies by jurisdiction)
• Control threshold: Senior managing officials, voting rights
• Challenge: Complex multi-jurisdictional corporate structures

A mandatory regulatory filing submitted by a financial institution to the Financial Crimes Enforcement Network (FinCEN) upon detecting a known or suspected violation of law or suspicious transaction. SARs are the primary output of KYC and transaction monitoring programs, triggered when anomalies—such as structuring, rapid movement of funds, or activity inconsistent with a customer's profile—are identified. Machine learning models increasingly prioritize alert triage to reduce false positives and surface the highest-risk activity for SAR filing decisions.

• Filing deadline: 30 days from detection (60 with extension)
• Confidentiality: Prohibition on disclosing SAR filing to the subject
• Key fields: Narrative, transaction details, subject information

Cryptographic protocols enabling the matching of records across disparate databases without revealing plaintext personally identifiable information (PII). Techniques like Bloom filter encoding convert sensitive identity attributes (names, dates of birth) into irreversible bit arrays, allowing fuzzy matching on encoded data. This enables collaborative KYC across institutions or jurisdictions while maintaining compliance with data localization laws and privacy regulations like GDPR. Secure multi-party computation (SMPC) extends this to full joint analysis without any party seeing the other's raw data.

• Bloom filters: Space-efficient probabilistic encoding for fuzzy matching
• Homomorphic encryption: Computation on encrypted data
• Use case: Cross-border KYC utility, consortium due diligence