Know Your Customer (KYC) obligations require regulated institutions to verify customer identity, assess the risk each relationship carries, and keep that assessment current as circumstances change. Every bank, fintech, and payments firm operating under AML obligations runs a KYC program, and regulators check whether it leaves a trail that proves it worked.
In November 2025, BaFin issued a record €45 million fine against J.P. Morgan SE for systematically failing to submit suspicious transaction reports without undue delay, with no missed watchlist match involved. The penalty targeted the program’s internal reporting controls rather than its screening coverage.
This guide covers what KYC is, how it escalates to enhanced due diligence, and what regulators examine when they review a compliance file.
Key takeaways:
- KYC obligation extends across the full customer lifecycle
Verification at the start of a relationship is one step in an ongoing program that runs through monitoring, review, and exit.
- Risk rating determines how closely each customer is monitored
Customer due diligence produces a risk rating that sets monitoring intensity and determines whether the relationship escalates to enhanced due diligence.
- Most KYC enforcement actions target program weaknesses, not missed individual matches
Regulatory findings point to structural failures in documentation, review cadence, and reporting rather than screening gaps.
- Regulatory requirements are tightening across every major jurisdiction
FATF, FinCEN, the FCA, and the EU AMLR are all moving toward stricter documentation standards and closer scrutiny of how institutions handle high-risk relationships.
- Sigma360 supports KYC from initial screening through continuous monitoring
Sigma360 brings together data coverage, AI-assisted alert triage, and automated audit logging so compliance teams can run KYC at scale.
What is KYC?
KYC is a regulatory obligation, and what the frameworks require extends beyond a one-time identity check. Institutions must maintain a running record of who each customer is, what risk they represent at each stage of the relationship, and what decisions were made along the way.
When regulators examine a program, they look at the evidence behind each decision as much as the decision itself. The question isn’t only whether the right call was made but whether the documentation supports it. Cleared alerts with no rationale, risk ratings with no supporting analysis, and customer profiles that haven’t been reviewed since onboarding all represent weak points in the evidentiary trail programs are required to maintain.
KYC operates within a broader financial crime compliance framework, alongside transaction monitoring, suspicious activity reporting, and record-keeping. It’s the starting point for all of them, because monitoring activity that hasn’t been properly verified and risk-rated produces unreliable outputs.
The three components of a KYC program
KYC obligations vary by jurisdiction and institution type, but every compliant program is built on three interconnected elements.
Customer identification and verification
Customer identification is what regulators call the Customer Identification Program (CIP), the requirement to collect and verify identity information before a business relationship begins. The FinCEN Customer Due Diligence Rule and FATF Recommendation 10 both define the minimum scope for individual customers.
Individual customer verification covers:
- Full legal name and date of birth
- Government-issued identification
- Residential address and proof of address documentation
- Nationality and tax identification details
Verifying a legal entity requires tracing the ownership structure to the natural persons who exercise control, confirming their identities, and documenting each layer of ownership. Stopping at the company name and registration number leaves the file incomplete, and incomplete files don’t survive examination.
Customer due diligence
Customer due diligence is the risk assessment layer that follows identification. Where CIP establishes who the customer is, CDD measures what risk that customer presents and how closely the relationship needs to be monitored.
The assessment draws on the following:
- Nature and purpose of the business relationship
- Transaction patterns and expected volumes
- Source of funds
- Occupation or business activity
- Connections to PEPs, sanctions lists, or adverse media
The output is a risk rating that drives how the customer is monitored going forward. Customers assessed as high-risk move into enhanced due diligence, which requires deeper investigation, source of wealth verification, and senior management approval. The most common triggers are PEP status, connections to high-risk jurisdictions, and complex ownership structures.
Ongoing monitoring and risk reassessment
A customer’s risk profile captured at the start of a relationship becomes outdated well before the next scheduled review, and most periodic-review programs have no mechanism to detect the change between cycles. Corporate restructuring, new beneficial owners, sanctions updates, adverse media, or shifts in transaction behavior can each alter the risk picture significantly before the review date.
The table below covers what the three phases of the KYC lifecycle require and where programs most often fall short:
| Phase | Core obligations | Common failure mode |
| Onboarding | Identity verification, beneficial ownership, CDD, risk rating | Incomplete UBO mapping; CDD file records outcome without documented reasoning |
| Ongoing monitoring | Transaction monitoring, screening updates, periodic review, alert triage | Fixed review cycles that miss mid-relationship risk changes |
| Exit/offboarding | Relationship termination documentation, SAR consideration, record retention | No documented decision rationale; records not retained for the required period |
When KYC escalates: From CDD to EDD
The risk-based approach runs through FATF, FinCEN, the FCA, and the EU AMLR, requiring institutions to deepen scrutiny when defined risk conditions are present. The depth of due diligence must match the risk level the customer presents.
EDD triggers include PEPs and their associates, customers linked to high-risk jurisdictions on the FATF grey or black list, complex or opaque ownership structures, correspondent banking relationships, and large or unexplained transactions. When triggered, the institution must verify the source of funds and source of wealth separately, trace ownership to the ultimate beneficial owner, and obtain senior management approval.
Read more:
KYC regulatory requirements
Four frameworks set the binding KYC obligations that banks, fintechs, payments firms, and regulated corporates must meet.
The table summarizes the key obligations under each framework:
| Framework | Jurisdiction | Primary instrument | Key KYC obligations |
| FATF | Global | Recommendations 10 and 12 | CDD, beneficial ownership, PEP controls, risk-based approach |
| FinCEN / BSA | United States | CDD Final Rule, 31 CFR Part 1010 | Customer identification, UBO verification, ongoing monitoring, SAR filing |
| FCA / MLRs | United Kingdom | Money Laundering Regulations 2017 | Risk-based CDD, EDD for high-risk customers, senior management approval |
| EU AMLR | European Union | Regulation (EU) 2024/1624 | Harmonized CDD and EDD, high-risk country controls, AMLA direct supervision |
The AMLR will apply from July 10, 2027, with AMLA direct supervision of the highest-risk entities beginning January 2028. According to 2025 global enforcement data, North American penalties fell 58% in 2025 while EMEA enforcement rose 767%, reflecting a sharp regional divergence in how quickly regulators are moving.
What enforcement actions reveal about KYC programs
Regulatory findings across jurisdictions point to the same five control weaknesses, regardless of institution type or size:
- Incomplete beneficial ownership mapping: The institution verifies the customer but doesn’t trace the natural persons behind a corporate structure to the required depth. A registration document and a named director aren’t UBO identification. Regulators expect the full ownership chain to be confirmed against independent sources and recorded in the file.
- CDD files that record outcomes without reasoning: A risk rating assigned with no documented rationale doesn’t meet the evidentiary standard regulators apply. The file must document the assessment, the findings, and the reasoning that led to the decision.
- Fixed review cycles that miss mid-relationship changes: A quarterly or annual review schedule can’t keep pace with risk events that occur between cycles. Corporate restructuring, a FATF jurisdiction update, or adverse media surfacing mid-cycle can all go undetected until the program’s next scheduled review.
- Inadequate adverse media screening scope: Screening a customer’s name against a single-language news source doesn’t satisfy the depth regulators expect, particularly in high-risk relationships. A materiality assessment must accompany the screening output.
- Late or missed suspicious activity reporting: The J.P. Morgan SE fine was issued for systemic delays in filing reports after suspicion thresholds were met. SAR filing failures carry the same enforcement weight as control weaknesses at onboarding.
KYC and KYB: What changes when the customer is a business
Know Your Business (KYB) applies the same verification logic as KYC to legal entities, covering legal identity, ownership structure, directors, and ultimate beneficial ownership. The output feeds directly into the CDD risk assessment.
KYB operates within the same regulatory framework as KYC, rather than running parallel to it. FATF, FinCEN, and FCA requirements that mandate identity verification for individuals require the same depth for businesses, reaching through to the natural persons who own or control them. A corporate relationship can involve layered holding companies, multiple jurisdictions, and beneficial owners several steps removed from the registered name, each requiring a separate documentation trail.
Institutions onboarding corporate customers at scale need a perpetual KYC program capable of tracking ownership changes and risk shifts across every layer as they happen.
Running KYC at scale with Sigma360
At volume, the KYC workload shifts from a compliance process into a capacity problem. Analysts spend the majority of their time triaging alerts and compiling case records, leaving less time for actual investigations. Periodic review queues accumulate faster between cycles than scheduled reviews can clear them.
Sigma360 draws on 100B+ data points across 150+ corporate registries, global watchlist and sanctions screening, and adverse media from global sources, all tied into one entity record per customer. Each screening action, analyst decision, and review outcome is captured automatically, so the audit file builds as the program runs.
The platform has three specific capabilities that address KYC-specific failure points:
- Perpetual KYC: Continuously monitors each customer against watchlists, registries, sanctions, and adverse media, surfacing risk changes between scheduled reviews so mid-cycle events reach the analyst queue when they occur
- Match Agent: Scores and clears identifiable false positives before analysts see them, cutting manual match reviews by 90% and directing analyst time toward cases where judgment is required
- Entity Summary: Pulls KYC data, watchlist hits, adverse media, corporate registry detail, and network relationships into a structured risk summary for each case, giving analysts the full picture before an AML investigation begins
Request a demo to see how the platform handles the full KYC process at scale.
FAQ
How long must KYC records be retained?
The minimum retention period is five years from the end of the customer relationship or the relevant transaction under most major frameworks, including the BSA and AMLR Article 77. Some competent authorities might extend the period by a further five years on a case-by-case basis.
Can a financial institution rely on a third party to carry out KYC?
Institutions can delegate KYC tasks to third parties under FATF Recommendation 17 and the FinCEN CDD Rule, but the compliance obligation stays with the institution. If the third party’s procedures are found deficient, the enforcement action falls on the regulated firm.
What is the beneficial ownership threshold under the FinCEN CDD Rule?
The FinCEN CDD Rule sets the threshold at 25% ownership, plus one individual who exercises control regardless of ownership percentage. The EU AMLR retains the 25% threshold but adds mandatory consultation with the beneficial ownership register as a required step alongside independent verification.
How does the AMLR change KYC requirements for European institutions?
The AMLR will replace national CDD rules with a single EU standard from July 10, 2027, covering customer identification, beneficial ownership verification, ongoing monitoring, and PEP controls. Mandatory register consultation for beneficial ownership and direct AMLA supervision of the highest-risk cross-border institutions from January 2028 are the two changes with the most operational impact.
How does risk appetite affect KYC program design?
Risk appetite sets the thresholds that determine which customers receive enhanced scrutiny, how often files are reviewed, and what triggers escalation or exit. A program without clearly defined thresholds applies uniform treatment across the portfolio, which increases cost and reduces the signal-to-noise ratio on genuine risk.
What is the difference between KYC at onboarding and a KYC refresh?
Onboarding KYC establishes identity and an initial risk rating before the relationship begins. A KYC refresh updates that file at a scheduled interval or when a triggering event occurs, and regulators apply the same evidentiary standard to both.
