Where This Lesson Fits
Lesson 18.2 detailed the documentation and data collection requirements — what must be gathered and how. Lesson 18.3 examines what the firm does with the identity-related portion of that collected documentation: the verification procedures that confirm the client's identity is genuine, the screening processes that check the client against sanctions lists and PEP databases, and the risk assessment that determines the appropriate level of ongoing monitoring for the relationship.
KYC is not a one-time gate at account opening — it establishes a risk profile that governs the firm's relationship with the client throughout the account lifecycle. The initial verification determines whether the account can be opened at all. The risk assessment determines the level of ongoing transaction monitoring and periodic review. And the ongoing KYC refresh requirement means that the identity verification performed at account opening must be updated periodically to ensure the firm's understanding of the client remains current and accurate.
Lesson Objective
By the end of this lesson, students should be able to describe the components of a Customer Identification Program and its regulatory basis, explain the procedures for verifying individual and entity identities using documentary and non-documentary methods, articulate the beneficial ownership identification requirements under FinCEN's Customer Due Diligence Rule, describe sanctions screening and PEP checking processes and their role in preventing financial crime, explain how risk-based KYC assessment determines the level of enhanced due diligence and ongoing monitoring, and identify the triggers and procedures for periodic KYC refresh throughout the account lifecycle.
Lesson Overview
Know Your Customer (KYC) is the cornerstone of anti-money laundering (AML) compliance in financial services. At its most fundamental level, KYC answers three questions: Who is the client? (identity verification), What is the nature of the client's activities? (understanding the expected account behavior), and What risks does the client relationship present? (risk assessment and classification). The answers to these questions determine whether the firm should accept the client, what level of due diligence is appropriate, and how intensively the account should be monitored on an ongoing basis.
The regulatory framework for KYC in the United States is established primarily by the Bank Secrecy Act (BSA), as implemented through FinCEN regulations, and enforced by the relevant regulatory authorities (SEC, FINRA, OCC, and state regulators depending on the type of institution). The USA PATRIOT Act of 2001 significantly strengthened KYC requirements by mandating Customer Identification Programs (CIPs) for all financial institutions. FinCEN's 2016 Customer Due Diligence (CDD) Rule added the requirement to identify and verify beneficial owners of legal entity customers.
A Customer Identification Program (CIP) is the firm's documented procedures for verifying the identity of each person who opens an account. The CIP must specify the identifying information collected from each customer (at minimum: name, date of birth, address, and identification number), the procedures for verifying that information using documentary methods (examining government-issued identification documents), non-documentary methods (checking information against independent databases, obtaining references, or contacting the customer), or a combination of both, and the procedures for retaining records of the information collected and the verification methods used.
For entity accounts, KYC extends beyond verifying the entity's identity to identifying the natural persons who ultimately own or control the entity — the beneficial owners. Under FinCEN's CDD Rule, firms must identify and verify the identity of each individual who owns 25% or more of a legal entity customer, as well as one individual who has significant responsibility for managing the entity (such as a CEO, CFO, or managing partner). This requirement recognizes that entity structures can be used to obscure the identities of the actual persons behind financial transactions.
Sanctions screening checks every client — at account opening and on an ongoing basis — against lists maintained by the Office of Foreign Assets Control (OFAC), the United Nations, the European Union, and other sanctioning authorities. A match on a sanctions list prohibits the firm from conducting business with the individual or entity. Politically Exposed Person (PEP) screening identifies individuals who hold or have recently held prominent public positions — not to prohibit the relationship, but to flag it for enhanced due diligence because PEPs present elevated corruption and money laundering risks.
Why This Matters in Wealth & Asset Operations
KYC failures carry consequences that extend far beyond regulatory fines. A firm that opens an account for a sanctioned individual faces potential criminal liability, asset freezes, and reputational damage that can threaten the firm's viability. A firm that fails to identify a client engaged in money laundering may face accessory liability, forfeiture of related assets, and loss of banking relationships as correspondent banks distance themselves from institutions with weak AML controls. These are not theoretical risks — enforcement actions against investment advisors and broker-dealers for KYC failures are a regular occurrence, with penalties ranging from thousands to hundreds of millions of dollars.
For operations professionals, KYC is a daily operational responsibility. Every new account must pass through the verification process before activation. Every name change, address change, or ownership change on an existing account may trigger re-verification. Every wire transfer to or from a high-risk jurisdiction may require enhanced screening. The operational team must be able to execute these procedures efficiently without creating unnecessary delays, while maintaining the rigor required by the regulatory framework.
The wealth management context adds particular KYC complexity. High-net-worth clients frequently use complex structures — trusts, family limited partnerships, holding companies, private foundations — that require deeper analysis to identify the ultimate beneficial owners. International clients add cross-border dimensions including multiple nationalities, offshore entities, and tax residency considerations. Large initial funding amounts and significant ongoing transaction volumes require the firm to understand and document the sources of wealth and the expected transaction patterns, so that anomalous activity can be distinguished from normal behavior.
Core Concept
Customer Identification Program (CIP) — The firm's documented procedures for collecting identifying information from each account holder, verifying that information through documentary and/or non-documentary methods, and retaining records of the information collected and verification methods used. The CIP is the operational implementation of the regulatory identity verification mandate.
Beneficial Ownership Identification — The process of identifying the natural persons who ultimately own or control a legal entity customer — specifically, individuals owning 25% or more of the entity and the individual with significant management responsibility. This requirement ensures that entity structures cannot be used to hide the true parties behind financial relationships.
Risk-Based Due Diligence — The principle that the depth and intensity of KYC procedures should be proportionate to the risk presented by each client relationship. Standard due diligence applies to most clients; enhanced due diligence (EDD) applies to higher-risk relationships identified through risk factors such as PEP status, high-risk jurisdictions, complex ownership structures, unusual transaction patterns, or large initial funding amounts.
Identity Verification Methods
Documentary Verification
Documentary verification involves examining identification documents to confirm the client's identity. For individuals, acceptable documents typically include an unexpired government-issued photo identification (driver's license, passport, national ID card), which verifies the individual's name, date of birth, and photograph. The firm must establish procedures for evaluating the authenticity of presented documents — checking for security features, confirming the document has not expired, and ensuring the photograph reasonably matches the individual presenting it. For accounts opened remotely, documentary verification may involve the client submitting high-resolution images or scans of identification documents, with the firm applying additional verification procedures to compensate for the inability to examine the physical document.
Non-Documentary Verification
Non-documentary verification uses independent data sources to corroborate the identifying information provided by the client. Common methods include checking the client's information against consumer reporting agency databases, verifying the client's address through a credit bureau check or by confirming receipt of a mailed verification notice, confirming the client's identity through references from other financial institutions, and using electronic identity verification services that compare the client's provided information against multiple independent databases. Non-documentary methods are particularly important for remote account openings, for clients who cannot provide standard documentary identification, and as a supplementary verification layer when documentary verification alone may be insufficient.
Entity Verification
Verifying the identity of legal entity customers requires confirming both that the entity exists and that the persons acting on its behalf are authorized to do so. Entity existence is verified through formation documents (articles of incorporation, partnership agreements), certificates of good standing from the jurisdiction of formation, and independent database checks (state corporation commission databases, business registries). Authorization is verified through corporate resolutions, partnership authorizations, trust certificates, or similar documents that designate the individuals empowered to act on behalf of the entity.
Real-World Example
A wealth management firm specializing in cross-border clients receives an application to open accounts for a family group: the patriarch (a citizen of both the U.S. and a country in the Middle East), his spouse (a citizen of a European country), their three adult children (each with dual citizenship), a family holding company incorporated in Delaware, and a trust established in the Cayman Islands for the benefit of the grandchildren.
The KYC process illustrates the layered complexity of verification for high-net-worth international families. For each individual, the CIP requires verification of all nationalities and residences. The patriarch's dual citizenship triggers screening against two countries' sanctions and PEP databases. His status as a former board member of a state-owned enterprise in his country of origin identifies him as a PEP, triggering enhanced due diligence requirements: the firm must understand the source of wealth (documenting how the family accumulated its assets), the source of funds (confirming where the initial account funding is coming from and tracing it to legitimate origins), and the expected account activity (establishing a baseline for transaction monitoring).
The Delaware holding company requires identification and verification of all beneficial owners — in this case, the patriarch (controlling interest) and two of the adult children (minority interests). The Cayman Islands trust adds another layer: as a trust established in a jurisdiction frequently associated with offshore structures, it triggers additional scrutiny. The firm must identify the settlor, the trustees, the beneficiaries, and any protectors or advisors with control over the trust. Because the beneficiaries are minors (the grandchildren), the firm must verify the identity and authority of the trustee acting on their behalf.
The complete KYC file for this family group includes 22 identity documents (passports, driver's licenses, and national ID cards for 5 individuals across multiple nationalities), 14 entity documents (formation documents, certificates of good standing, trust agreements, corporate resolutions), 6 sanctions screening reports (initial screening of all individuals and both entities), 3 PEP screening reports (for the patriarch and two children who serve on the board of the family company), a source-of-wealth analysis with supporting documentation, and an enhanced due diligence memo approved by the compliance officer. The total file comprises 87 pages. Processing the complete KYC for this family group takes 12 business days — a timeline the firm manages by running individual and entity verifications in parallel and using a dedicated KYC analyst to coordinate the various screening and documentation streams.
Common Mistakes
Mistake 1: Treating KYC as a one-time event rather than an ongoing obligation
KYC does not end at account opening. Regulations require periodic review and refresh of client information — typically every 1–3 years depending on the client's risk classification. Changes in the client's circumstances (new nationality, change of address to a high-risk jurisdiction, assumption of a public office) may trigger re-evaluation of the risk classification and require updated due diligence. Firms that treat KYC as a one-time gate miss these ongoing obligations.
Mistake 2: Applying the same level of due diligence to all clients regardless of risk
A risk-based approach means allocating KYC resources proportionate to the risk presented by each client. Applying standard due diligence to a high-risk client (such as a PEP with complex offshore structures) fails to meet regulatory expectations. Applying enhanced due diligence to every client wastes resources and creates unnecessary delays for straightforward relationships. The key is a well-calibrated risk assessment that accurately classifies clients and directs appropriate due diligence to each risk tier.
Mistake 3: Not screening against current sanctions lists
Sanctions lists are updated frequently — sometimes multiple times per week. Screening a client at account opening and never rescreening creates the risk that a client added to a sanctions list after account opening continues to transact through the firm. Ongoing screening — running the firm's entire client base against updated sanctions lists on a regular schedule — is essential for maintaining sanctions compliance.
Mistake 4: Accepting entity documentation at face value without verifying beneficial ownership
Entity structures can be used to obscure the identities of the natural persons who ultimately control or benefit from an account. Accepting an entity's formation documents without looking through the structure to identify the beneficial owners violates both FinCEN's CDD Rule and the spirit of KYC. The firm must identify, verify, and document the individuals behind every entity account.
Mistake 5: Inadequate documentation of negative screening results
When a client clears sanctions and PEP screening — no matches found — the firm must document that the screening was performed, what databases were checked, the date of the screening, and the negative result. If a regulator later asks whether a specific client was screened, the firm must be able to produce evidence that the screening occurred and what it found. "No news is good news" is not an acceptable documentation standard for KYC screening.
Practical Exercises
Exercise 1: CIP Procedures Design
Draft the Customer Identification Program procedures for a registered investment advisor that serves both domestic and international individual clients. Include: the identifying information to be collected, the acceptable documentary identification sources (distinguishing between in-person and remote account openings), the non-documentary verification methods to be used, the procedures for handling discrepancies between documentary and non-documentary verification, and the record retention requirements.
Exercise 2: Beneficial Ownership Identification
A client presents the following entity structure: a Delaware LLC owned 40% by Individual A, 30% by a Bermuda trust (with Individual B as the sole trustee and Individual C as the sole beneficiary), and 30% by a Canadian corporation (owned equally by Individuals D and E). Identify all individuals who must be verified as beneficial owners under FinCEN's CDD Rule, explain your reasoning for each, and describe what documentation you would require to verify each individual's ownership interest.
Exercise 3: Risk-Based Due Diligence Assessment
Design a client risk classification matrix for KYC purposes. Define the risk factors (e.g., PEP status, jurisdiction, entity complexity, transaction volume, source of wealth), the risk levels (low, medium, high), and the specific due diligence requirements for each level. Include the criteria for escalating a client from a lower to a higher risk level and the approval requirements for accepting high-risk clients.
Exercise 4: KYC Refresh Procedures
Design the periodic KYC refresh procedures for a wealth management firm. Include: the refresh frequency for each risk tier (low, medium, high), the specific elements to be reviewed and updated during each refresh cycle, the triggers for event-driven refresh (outside the scheduled cycle), the procedures for handling a client who does not cooperate with the refresh process, and the documentation and approval requirements for each completed refresh.
Key Terms
Know Your Customer (KYC) — The comprehensive process of identifying, verifying, and understanding a client to assess the money laundering, terrorist financing, and sanctions risks associated with the client relationship, forming the foundation of AML compliance.
Customer Identification Program (CIP) — The documented procedures for collecting and verifying the identity of each account holder, including the identifying information required, the verification methods used, and the record retention standards.
Beneficial Ownership — The natural persons who ultimately own or control a legal entity customer, including individuals with 25% or more ownership and the individual with significant management responsibility.
Sanctions Screening — The process of checking client names and identifying information against lists maintained by OFAC, the UN, the EU, and other sanctioning authorities to identify prohibited parties.
Politically Exposed Person (PEP) — An individual who holds or has recently held a prominent public position, identified for enhanced due diligence because of the elevated corruption and money laundering risks associated with political influence.
Enhanced Due Diligence (EDD) — Additional verification and monitoring procedures applied to higher-risk client relationships, including deeper investigation of source of wealth, source of funds, and expected transaction patterns.
Documentary Verification — Identity verification through examination of government-issued identification documents, checking for authenticity, validity, and consistency with other provided information.
Non-Documentary Verification — Identity verification through independent data sources such as credit bureaus, consumer databases, and electronic verification services, used to supplement or substitute for documentary methods.
KYC Refresh — The periodic review and update of client identification and due diligence information, ensuring the firm's understanding of the client remains current and the risk classification remains appropriate.
Knowledge Check
Question 1
What three fundamental questions does KYC seek to answer?
A. How much will the client invest? What returns does the client expect? How long will the client stay?
B. Who is the client (identity verification)? What is the nature of the client's expected activities? What risks does the client relationship present?
C. What account type does the client need? What fee rate applies? What reporting frequency is preferred?
D. Is the client profitable? Is the client likely to refer others? Is the client's portfolio complex?
Question 2
Why is beneficial ownership identification required for entity accounts?
A. It reduces the paperwork required for entity accounts
B. Entity structures can obscure the identities of the natural persons who ultimately own or control the account — beneficial ownership identification ensures the firm knows the real parties behind every entity relationship
C. Beneficial ownership is only required for entities with more than 100 investors
D. It allows the firm to send marketing materials to all entity owners
Question 3
What distinguishes a PEP from a sanctions target?
A. PEPs are automatically prohibited from opening accounts; sanctions targets require enhanced due diligence
B. A sanctions match prohibits the firm from conducting business with the individual; PEP identification flags the relationship for enhanced due diligence because of elevated corruption risk, but does not prohibit the relationship
C. PEPs are only found in developing countries; sanctions targets can be from any country
D. There is no practical distinction between the two categories
Question 4
Why is ongoing sanctions screening — not just screening at account opening — essential?
A. Ongoing screening is only required for international clients
B. Sanctions lists are updated frequently, sometimes multiple times per week — a client who was not sanctioned at account opening may be added to a sanctions list subsequently, and the firm must detect this change to maintain compliance
C. Ongoing screening reduces the firm's technology costs
D. Regulators only check for ongoing screening during the first year after account opening
Question 5
Why must negative screening results be documented?
A. Negative results indicate the client is low risk and no further action is needed
B. If a regulator asks whether a specific client was screened, the firm must produce evidence that the screening occurred, what databases were checked, and when — without documentation of negative results, the firm cannot prove compliance
C. Negative results are only documented for entity accounts
D. Documentation of negative results is optional under current regulations
Lesson Summary
- KYC answers three fundamental questions — who is the client, what activities are expected, and what risks does the relationship present — and the answers determine whether to accept the client, what level of due diligence to apply, and how to monitor the relationship.
- Customer Identification Programs specify the procedures for collecting, verifying (through documentary and non-documentary methods), and retaining identity information for each account holder.
- Beneficial ownership identification looks through entity structures to identify the natural persons who ultimately own or control entity accounts, preventing the use of complex structures to obscure the parties behind financial relationships.
- Sanctions screening and PEP checks are distinct but complementary: sanctions matches prohibit business relationships, while PEP identification triggers enhanced due diligence without prohibiting the relationship.
- Risk-based due diligence calibrates the depth and intensity of KYC procedures to the risk presented by each client, ensuring proportionate resource allocation and appropriate scrutiny for higher-risk relationships.
- KYC is an ongoing obligation — requiring periodic refresh, event-driven re-evaluation, and continuous sanctions screening — not a one-time gate at account opening.
Looking Ahead
This lesson examined the identity verification and risk assessment procedures at the core of KYC. The next lesson broadens the compliance perspective to examine the full range of regulatory checks that must be completed before an account can be approved — including suitability assessment, jurisdictional compliance, regulatory registration requirements, and the compliance approval workflows that ensure all applicable rules have been satisfied. Lesson 18.4 will show how KYC verification integrates with the broader compliance framework to create a comprehensive regulatory gate in the account opening process.
Study Support
Templates & Tools
Use CIP procedure templates, beneficial ownership identification worksheets, sanctions screening checklists, risk classification matrices, and KYC refresh scheduling tools to practice designing identity verification programs.
Glossary Support
Review key terms such as KYC, CIP, beneficial ownership, sanctions screening, PEP, enhanced due diligence, documentary verification, non-documentary verification, and KYC refresh.
Case Examples
Study case analyses of KYC failures that resulted in regulatory enforcement actions, beneficial ownership identification challenges with complex entity structures, and PEP due diligence programs at wealth management firms.
Practical Application
By the end of this lesson, students should be able to design CIP procedures for individual and entity account openings, identify beneficial owners in complex entity structures, evaluate the adequacy of sanctions screening and PEP checking programs, design risk-based due diligence frameworks that appropriately calibrate verification intensity to client risk, and implement KYC refresh procedures for ongoing compliance.
Next Lesson
Lesson 18.4: Compliance and Regulatory Checks
Continue to the next lesson to examine the full compliance review framework — suitability assessment, jurisdictional compliance, regulatory registration, and approval workflows — that integrates with KYC to create the regulatory gate for account opening.