KYC in Banking: Requirements, Process, Technology
KYC in banking is the set of checks a bank runs to confirm who its customers are and how risky they are, before and after opening an account. It covers identity verification, customer due diligence, sanctions and PEP checks, and ongoing monitoring. Banks that run it digitally can open accounts in minutes while still meeting the rules.
What KYC Means in Banking
In short, Know Your Customer is the starting point of every bank’s anti-money laundering program. Before a bank lets money move, it must know who the customer is, what they intend to do with the account, and whether they pose a risk. So KYC is not a single gate at signup, but a duty for the whole relationship.
Banks also carry the heaviest version of this duty, because their role is systemic. They hold deposits, move payments across borders, and give access to the wider financial system, so regulators expect more from them than from most firms. For the general definition, see KYC 101, and for how KYC sits inside the wider program, see KYC and AML differences.
Core KYC Requirements for Banks
The details vary by country, yet most rules share the same building blocks, which trace back to FATF Recommendation 10.
| Requirement | What the bank must do | Example rule |
|---|---|---|
| Customer identification | Collect and verify name, date of birth, address, and ID number | US Customer Identification Program rule |
| Customer due diligence | Understand the account’s purpose and the customer’s risk | FATF Recommendation 10 |
| Beneficial ownership | Identify the real people who own or control business customers | FinCEN Customer Due Diligence Rule, EU directives |
| Enhanced due diligence | Apply extra checks to high-risk customers, such as PEPs | FATF Recommendations 10 and 12 |
| Sanctions and PEP screening | Check customers and owners against official lists | National sanctions laws, FATF Recommendations 6 and 12 |
| Ongoing monitoring | Watch activity, then update customer information | FATF Recommendation 10 |
Is KYC mandatory? For banks, yes, in practically every country. For example, US banks follow the Customer Identification Program rule under the USA PATRIOT Act, which requires identity verification at account opening.
Regulations That Shape Bank KYC
Bank KYC rules differ by country, yet they share a common spine from the FATF standard. For example, the table shows the main frameworks banks map to.
| Region | Framework |
|---|---|
| Global | FATF Recommendations, risk-based approach |
| United States | Bank Secrecy Act, USA PATRIOT Act CIP rule, FinCEN CDD Rule |
| European Union | Anti-Money Laundering Directives |
| United Kingdom | Money Laundering Regulations, FCA |
| Australia | AML/CTF Act, AUSTRAC rules |
Still, the shared idea across all of them is proportionality. In other words, regulators expect more scrutiny where risk is higher, rather than identical treatment for every customer.
The Bank KYC Process Step by Step
When banks go digital, account opening still follows a repeatable flow, whether the customer walks into a branch or opens an account on a phone.
- Collect information. The customer provides identity details, contact data, and the purpose of the account.
- Verify identity. Then the bank checks the ID document and confirms the person matches it.
- Screen. Next, it screens the customer and any owners on sanctions, PEP, and watchlist sources.
- Assess risk. It rates the customer, then applies enhanced due diligence where needed.
- Monitor. After opening, it watches activity and refreshes information when things change.
Business customers add a step, because the bank must verify the company and identify its beneficial owners before screening them. The same document, face, and screening checks then apply to each controlling owner.
Digital KYC for Banks: eKYC, Biometrics, Liveness
Until recently, branch visits anchored identity checks. Today most new accounts open online, so digital tools must replace what a teller once did in person.
| Branch step | Digital replacement |
|---|---|
| Teller inspects the ID card | Camera capture, then OCR and document checks |
| Teller compares the face with the photo | Automated face match between a selfie and the ID |
| Teller sees a real person in front of them | Liveness detection against photos, replays, and injected video |
| Teller checks a printed list | Real-time sanctions and PEP screening via API |
| Manual file review | Risk scoring, then routing exceptions to analysts |
Liveness is the step remote onboarding cannot skip, because a stolen ID photo and a printed face are cheap to get. Specifically, Verihubs liveness detection confirms a real, present customer before the face match runs, and a 1:N face search flags one applicant opening many accounts, a common mule pattern. Then sanctions and PEP screening covers the list stage, with monitoring for later changes. Indonesian banks can also match a customer’s NIK, full name, and birth date to government records through Verihubs ID Verification.
KYC Across Bank Products
A bank runs one KYC framework. Even so, each product line weights it differently.
| Product line | Main KYC focus | Typical extra checks |
|---|---|---|
| Retail and digital accounts | Fast, remote identity proofing at scale | Liveness, deepfake checks, duplicate-face detection |
| SME and business banking | The company and its beneficial owners | Registry checks, owner verification, business purpose |
| Private and wealth banking | Source of wealth and PEP exposure | Enhanced due diligence, senior approval |
| Lending | Identity plus ability to repay | Income checks and fraud signals on applications |
| Correspondent banking | The respondent bank’s own controls | Questionnaires, ownership, and regulatory standing |
In practice, the retail line handles the most volume, so it gains most from automation. Meanwhile, private banking and correspondent banking depend more on analyst judgment.
How Often Banks Refresh KYC
Ongoing due diligence means customer files must stay current. So most banks set review cycles by risk, and they also add event-driven reviews whenever something changes.
| Risk level | Common review cycle | Typical triggers for an early review |
|---|---|---|
| High | Every year | New screening hit, unusual activity, ownership change |
| Medium | Every two to three years | Change of address, product upgrade, large new flows |
| Low | Every three to five years | Expired ID, returned mail, dormant account reactivation |
Beyond fixed cycles, some banks now also move toward perpetual KYC, where data changes and screening results trigger reviews continuously instead of waiting for the calendar.
Balancing Compliance and Customer Experience
Of course, every extra step at signup costs some applicants. Even so, banks can keep controls strong while cutting friction.
- Prefill from the ID. Reading the document with OCR saves typing and also reduces errors.
- Use passive liveness. That is because a single selfie capture is faster for the customer than a series of gestures.
- Tier the checks. Then ask for more only when the risk score calls for it.
- Explain why. In practice, short, plain-language reasons for each request reduce abandonment.
In short, the goal is to spend customer effort where risk actually sits, rather than spreading it evenly across everyone.
What to Look for in Bank KYC Technology
KYC tools vary widely, so banks should test what drives real outcomes. Speed matters, but so do fraud resistance and auditability.
For example, look for broad document coverage, a face match paired with liveness and deepfake defense, and screening that links to a verified identity instead of a typed-in name. Also, bulk search helps a bank re-check its existing base, and clear audit trails satisfy examiners. A smooth KYC workflow and good onboarding software then wrap these controls into one journey, and biometric verification keeps that journey fast.
Common Bank KYC Failures and Fines
In practice, enforcement cases against banks tend to repeat the same mistakes, and regulators have issued large fines where these gaps let laundering through.
- Weak identity checks. Accounts opened with borrowed or fake identities, often for mule networks.
- Missing beneficial owners. Business accounts with no clear picture of who controls them.
- Static risk ratings. Customers rated once at onboarding, then never updated.
- Screening gaps. Owners and counterparties never screened, or screened only once.
- Unreviewed alerts. Finally, monitoring that raises alerts nobody has time to clear.
Also, each failure is cheaper to prevent than to fix later, when a regulator demands a full remediation of every customer file. So the strongest programs treat KYC as a living process, with monitoring and periodic refresh, rather than a one-time box at signup.
Frequently Asked Questions
What is KYC in banking?
KYC in banking is the process banks use to verify customer identity, understand the purpose and risk of each relationship, screen against sanctions and PEP lists, and monitor activity over time.
What are the 5 stages of KYC?
The usual five stages are collecting customer information, verifying identity, checking official watchlists, assessing risk and applying enhanced checks where needed, and ongoing monitoring after the account opens.
Is KYC mandatory for all bank accounts?
Yes, in almost every country. Banks must identify and verify customers before opening accounts, although checks can be lighter for low-risk products where local rules allow.
Is KYC mandatory in the USA?
Yes. US banks must run a Customer Identification Program under the USA PATRIOT Act and follow FinCEN’s customer due diligence requirements, including identifying beneficial owners of business customers.
How often do banks update KYC?
Typically, banks revisit their high-risk files annually, medium-risk ones every two to three years, and low-risk ones every three to five years, plus an early review whenever a trigger event occurs.
What is digital KYC or eKYC in banking?
Digital KYC, or eKYC, runs the same checks remotely through a phone or web flow, using document capture, a selfie, liveness, and automated screening. As such, it cuts onboarding time without lowering standards.
Bank KYC Works When It Runs Continuously, Not Just at Signup
In the end, KYC in banking is less about a single check and more about a reliable, repeating one. A customer verified today can become high risk tomorrow, so the real strength of a program is how well it keeps that picture current. When document, face, liveness, and screening run together at onboarding, and monitoring keeps watch after, a bank meets both its fraud and compliance duties. The question is not whether a bank does KYC, but whether it does it consistently for every customer, every day.
Modernizing KYC across retail and business onboarding? Contact Verihubs to build an eKYC stack with OCR, face match, liveness, and screening.
