KYC Checklist: 12 Checks to Onboard Customers Right

A KYC checklist lists every step a regulated firm must complete to know its customer: collecting and verifying identity, confirming address, identifying owners for businesses, screening, rating risk, and keeping records. Use the twelve checks below to test your process before an audit does. Because consistency is where most programs fail, the checklist matters as much as the checks.

How to Use This KYC Checklist

KYC rules differ by country and sector, so treat this as a base. First, map each check to the exact rule in your market. Then mark where your process covers it, where it relies on manual work, and where it has no control at all.

In fact, the checklist follows the logic of FATF Recommendation 10, which most national rules build on. So copy the lists into your own runbook, and for the concepts behind them, see the KYC workflow and how KYC sits beside the wider anti-money-laundering effort in KYC and AML differences.

Individual Customer Checklist

First, start with the person. Specifically, these five checks confirm a real individual owns the identity they claim.

1. Collect core identity data. Full name, date of birth, nationality, address, and ID number.
2. Verify the ID document. Read it with OCR, validate the MRZ, and confirm it is genuine and valid.
3. Confirm the person. Match a live selfie with the ID photo, after a liveness step that rejects prints and replays.
4. Confirm the address. Use an accepted document or data source, as local rules require.
5. Record the purpose. Note what the customer intends to use the account for and the expected activity.

In practice, remote onboarding depends on check three. A stolen ID passes a document check, but it fails when the live face does not match. That is why Verihubs liveness detection, paired with a face match and a deepfake filter, belongs on every individual checklist.

Business Customer (KYB) Checklist

Then, for company customers, add four checks on the business and its controllers. A registration alone is not enough, because the risk often sits with the owners.

1. Verify the company. Confirm registration, status, address, and licenses with official sources.
2. Identify beneficial owners. Trace ownership up to real people, through any holding companies.
3. Verify each controlling owner. Run the individual checks above on every beneficial owner.
4. Verify directors and signatories. Confirm who can act for the company and legally bind it.

Shell companies and nominee structures hide here, so do not stop at the company name. A 1:N face search also helps, because it can flag one owner who appears behind several unrelated companies.

Screening and Risk Rating Checklist

Finally, screen the customer and record a risk decision. So these last three checks complete the twelve and turn evidence into a defensible outcome.

1. Screen everyone. Run the customer, owners, and directors through sanctions, PEP, and watchlist data, with a documented match threshold.
2. Rate the risk and set the due diligence level. Score customer, product, channel, and geography, then apply simplified, standard, or enhanced checks.
3. Keep records and set reviews. Store documents, results, and decisions, then set triggers and dates for review.

Watchlist screening covers the list checks, flagging matches with a similarity score and risk level, plus an internal blacklist and bulk search. Its monitoring can then alert your team when a screened profile later gains new data or a new sanction. Meanwhile, transaction monitoring and adverse media are complementary layers many teams add from other systems.

The Full KYC Checklist in One Table

Also, each check should leave evidence an auditor can see. So the table pairs every step with the record to keep.

#	Check	Evidence to keep
1	Collect core identity data	Application data and its timestamp
2	Verify the ID document	Document image and check results
3	Confirm the person with face and liveness	Match score and liveness result
4	Confirm the address	Accepted document or data check
5	Record the purpose	Stated purpose and expected activity
6	Verify the company	Registry extract and licenses
7	Identify beneficial owners	Ownership chart
8	Verify each controlling owner	Owner identity checks
9	Verify directors and signatories	Identity checks and mandates
10	Screen everyone	Search logs and match decisions
11	Rate risk and set due diligence	Score, rating, EDD findings, override approvals
12	Keep records and set reviews	Retention schedule and review triggers

Risk-Based Tiers: What Changes by Risk Level

A checklist is not one-size-fits-all, so the depth should scale with risk. Low-risk customers clear the core checks, while high-risk customers get more.

Tier	What changes
Low risk	Core checks, standard screening, periodic refresh
Medium risk	Added document or source checks, closer monitoring
High risk	Enhanced due diligence, source of funds, senior sign-off

Add-On Checklist for Remote Onboarding

When the customer never visits a branch, add these checks on top of the twelve. That is because each one blocks an attack that only exists online.

• Liveness on every selfie. For instance, reject printed photos, screens, masks, and replayed video.
• Deepfake and injection checks. Also detect AI-generated faces and camera feeds that bypass the real camera.
• Document recapture checks. Flag photos of screens or photocopies instead of the original ID.
• Duplicate-face search. This way, you catch one person opening several accounts under different names.
• Device and session signals. In particular, note emulators, rooted phones, and many accounts on one device.

For that reason, these controls matter most for app-only lenders, wallets, and exchanges, where every account opens remotely.

KYC Checklist by Industry

The twelve checks apply everywhere. Still, each industry stresses different ones.

Industry	Checks to stress
Banks	Beneficial owners, enhanced due diligence, periodic review
E-wallets and payments	Remote liveness, duplicate accounts, transaction limits by tier
Crypto platforms	Strong identity proofing, sanctions screening, source of funds for large deposits
Lenders	Identity match, income evidence, synthetic identity signals
Insurers	Policyholder and beneficiary checks, source of funds for large premiums

Periodic Review Checklist

Then, at each scheduled review, run this shorter list instead of repeating full onboarding.

1. First, confirm the ID on file is still valid, and request a new one if it has expired.
2. Next, re-screen the customer and every owner against current lists.
3. Then compare actual activity with the purpose recorded at onboarding.
4. Update ownership for business customers.
5. After that, recalculate the risk score and adjust the due diligence level.
6. Finally, record the review date, the outcome, and the next review date.

Record-Keeping, Refresh, and Ongoing Screening

KYC does not end at approval, so the last part of the checklist is ongoing. For instance, under FATF Recommendation 11, firms should keep customer due diligence records for at least five years after the relationship ends, although national rules can set longer periods. Also keep the reasons behind decisions, such as why an alert was cleared, since auditors look for those first.

Then refresh the customer profile on a cadence set by risk, and re-screen as lists change. A customer can clear onboarding and later appear on a sanctions list, so periodic and event-driven re-screening keeps the picture current. For example, bulk search makes it practical to re-check a large base in one run.

Gaps Auditors Find Most Often

Firms rarely fail because they skipped a whole step. More often, a step exists on paper but leaks in practice.

• Owners not verified. Business files list owners, yet nobody checked who they are.
• Screening only once. Customers screened at onboarding, then never again.
• Weak evidence of liveness. A face match with no proof a live person was present.
• Undocumented decisions. Alerts cleared without notes, so the reasoning is lost.
• Stale files. Expired IDs and outdated addresses, especially for long-standing customers.
• Risk ratings that never move. No trigger updates them after onboarding, which perpetual KYC fixes.

So each gap maps back to a checklist item. When identity verification, screening, and record-keeping run the same way every time, most of these findings disappear.

Frequently Asked Questions

What should a KYC checklist include?

It should cover identity collection, document verification, a face match with liveness, address confirmation, account purpose, business and owner checks, sanctions and PEP screening, risk rating, and record-keeping with review dates.

What are the basic KYC documents?

The basics are one valid government-issued photo ID and proof of address where local rules require it. Business customers also provide registration documents and details of their owners and directors.

What are the 5 major elements of a KYC profile?

A KYC profile usually holds verified identity data, address, the purpose and expected use of the account, screening results, and a risk rating. For businesses, it also includes ownership and control details.

How does a KYB checklist differ from a KYC checklist?

A KYC checklist verifies an individual, while a KYB checklist verifies a business and identifies its beneficial owners. KYB reuses the individual checks on each controlling owner, then adds company, director, and signatory checks.

What extra KYC checks apply to remote onboarding?

Remote onboarding usually adds liveness detection, deepfake and camera-injection checks, document recapture detection, duplicate-face searches, and device risk signals.

How long should KYC records be kept?

FATF Recommendation 11 calls for at least five years after the business relationship ends. National rules can set longer periods, so check the requirement in each market you serve.

A KYC Checklist Proves Nothing Without Evidence Behind Each Step

Still, ticking a box is not the same as doing the check. Instead, auditors look for proof: the document image, the match score, the search log, and the reason behind each decision. So use the checklist twice, first to confirm every step exists in your process, then to confirm each step leaves evidence you can show. Firms that pass both tests rarely fear an audit.

Want each checklist line backed by a real control? Connect with Verihubs to back every checklist line with document capture, face match, liveness, and screening.