How to establish a 'know your customer' (kyc) process

Establishing a 'Know Your Customer' (KYC) process is about more than just checking an ID; it is your first line of defence against fraud and money laundering. To do this correctly, you must implement a system that identifies your client, verifies their identity with reliable documents, and assesses the risk they pose to your business before you accept their custom.

What is KYC?

KYC is the process of confirming that your clients are who they say they are. In the UK, if you are providing certain services (like accountancy, legal advice, or financial consulting), you have a legal obligation under the Money Laundering Regulations to ensure your business isn't being used to hide the proceeds of crime. Even if you aren't in a strictly regulated sector, having a basic KYC process is excellent practice to prevent identity fraud.

Step 1: Identify and verify the client

The core of KYC is the "ID and V" (Identification and Verification). For every new client, you should request two types of documentation:

• Proof of Identity: A valid government-issued document that includes a photograph, such as a UK passport or a photocard driving licence.
• Proof of Address: A document dated within the last three months, such as a utility bill, council tax statement, or a bank statement.

For business clients (entities rather than individuals), you must verify the business's existence via Companies House and identify the "Ultimate Beneficial Owners" (UBOs)—any individuals who own or control more than 25% of the company.

Step 2: Risk-based screening

Once you know who they are, you need to assess the risk of working with them. This involves checking if the client appears on two specific lists:

• Sanctions Lists: Ensure the individual or business is not subject to UK government sanctions.
• Politically Exposed Persons (PEPs): Check if the client holds a prominent public position (or is a close family member of someone who does). Working with PEPs isn't illegal, but it requires "Enhanced Due Diligence" because they are considered higher risk for potential bribery or corruption.

Step 3: Understand the "Nature of Business"

You should ask the client what the purpose of your relationship is. For example, why are they seeking your services now? Where is the money for their transactions coming from? If a client’s story doesn’t align with their known income or business activity, this is a red flag that requires further investigation.

Step 4: Secure record keeping

Under UK law and GDPR, how you store this information is critical. You must keep records of your KYC checks for five years after your relationship with the client ends. Because this data is highly sensitive, you should:

• Store documents in an encrypted digital environment or a locked physical filing system.
• Ensure only staff members who "need to know" can access these files.
• Maintain a "KYC Register" that logs when the check was done and when it needs to be refreshed.

Top Tip: Don't do this manually if you can avoid it. There are many UK-based "Electronic Identity Verification" (eIDV) apps that can scan a client's passport via their smartphone and run AML/Sanction checks instantly. This is often more secure and provides a better "onboarding" experience for your client.

Ongoing Monitoring

KYC is not a "one and done" task. If a client's circumstances change—for example, they move house, change their business structure, or start making unusually large transactions—you must update your records and re-verify their identity. Set a reminder to review your active client files at least once a year.