Financial systems rely on a foundation of trust and identity. To maintain this foundation, regulators globally mandate that banks and fintech platforms implement two core processes: Know Your Customer (KYC) and Anti-Money Laundering (AML).
While these terms are often grouped together, they perform distinct functional roles. KYC is the process of verifying who a customer is, while AML is the broader framework used to prevent, detect, and report the movement of illicit funds.
What is the functional role of KYC in banking?
KYC stands for “Know Your Customer.” It is the first line of defense for a financial institution. Its primary goal is to ensure that a customer is who they claim to be and that they are not involved in any known criminal activities.
In practical terms, KYC occurs during the “onboarding” phase. When you open a bank account or a crypto wallet, you are asked to provide information that fits into three main tiers:
- Customer Identification Program (CIP): 31 CFR 1020.220 requires a bank to obtain a customer’s name, date of birth for an individual, address, and an identification number before opening an account. For a U.S. person, that number is a taxpayer identification number. As of 31 July 2025, FinCEN orders allow banks supervised by the OCC, the FDIC, the NCUA, or the Federal Reserve to collect that number from a third party instead of from the customer.
- Customer Due Diligence (CDD): The bank assesses the risk profile of the customer. For most individuals, this is routine. For high-net-worth individuals or businesses in high-risk industries, the bank performs “Enhanced Due Diligence” (EDD).
- Ongoing Monitoring: Identity verification is not a one-time event. Banks periodically re-verify information and update risk profiles based on changes in a customer’s behavior or status.
How does AML differ from KYC?
If KYC is about identity, AML (Anti-Money Laundering) is about behavior. AML is a set of laws, regulations, and procedures designed to stop the practice of generating income through illegal actions.
AML frameworks cover several specialized areas:
- Transaction Monitoring: Automated systems scan every transaction for “red flags,” such as unusually large cash deposits or frequent transfers to high-risk jurisdictions.
- Sanctions Screening: U.S. persons are generally prohibited from dealing with people and companies on the OFAC Specially Designated Nationals and Blocked Persons List. The SDN List file was last updated on 21 October 2026. Assets of those persons are blocked.
- Currency Transaction Reports (CTR): In the United States, 31 CFR 1010.311 requires a financial institution other than a casino to file a report for a currency transaction of more than $10,000. That threshold was still more than $10,000 as of October 2026.
- Suspicious Activity Reports (SAR): 31 CFR 1020.320 requires a bank to file a SAR when a transaction involves or aggregates at least $5,000 and the bank suspects illegal-source funds, evasion, or no apparent lawful purpose. A bank may not disclose a SAR or information that would reveal that a SAR exists.
Why is identity verification becoming more automated?
The traditional method of “bringing your passport to a branch” is being replaced by digital-first identity verification (IDV). This shift is driven by the need for speed and the rise of neobanks and global fintech platforms.
Modern IDV systems use several layers of technology:
- Biometric Matching: Comparing a “selfie” with the photo on a government ID using AI to ensure the person is real and present (liveness detection).
- OCR (Optical Character Recognition): Automatically extracting data from IDs to cross-reference against government databases in real-time.
- Behavioral Analytics: Looking at device metadata, IP addresses, and typing patterns to detect bots or fraudulent applications.
While automation reduces friction for the user, it also creates new risks, such as the use of “deepfakes” to bypass biometric checks. Regulators are continuously updating standards to address these emerging threats.
What are the tradeoffs between privacy and compliance?
The data collected during KYC/AML is highly sensitive. The requirement to store this data creates a tension between the goal of stopping crime and the right to individual privacy.
- Data Security: Banks become primary targets for hackers because they hold the “master keys” to identity. A breach of KYC data can lead to systemic identity theft.
- Financial Exclusion: Strict KYC rules can inadvertently block legitimate users from the financial system. Individuals without a permanent address or formal identification—often the “unbanked”—find it difficult to access even basic services.
- Decentralization: In decentralized finance (DeFi), KYC is not built into the protocol. The Financial Action Task Force applies the Travel Rule to virtual asset service providers, not to wallet software by itself. As of its 26 June 2025 update, 99 jurisdictions had passed or were passing Travel Rule legislation. In June 2025 the FATF also revised Recommendation 16 so that a peer-to-peer cross-border payment above USD or EUR 1,000 carries the originator’s name, address, and date of birth. Card purchases of goods or services stay outside that full requirement.
Compliance is not just a legal requirement for banks; it is a significant operational expense. For the user, it manifests as the “friction” that ensures the global financial system remains resilient against illicit exploitation.
