KYC and AML: What Due Diligence Asks

Know-your-customer and anti-money-laundering rules exist to stop banks and other regulated firms being used to move the proceeds of crime. They are often described as paperwork, and the description is wrong. The rules require a firm to establish who its customer is, to understand the business it is doing, to identify the people who ultimately own or control it, and to keep watching the relationship for as long as it lasts.

What KYC asks for at the start

The first step is identity. For a person, that means reliable documents and enough information to be confident the documents belong to the person in front of the firm. For a company, it means the corporate documents, the registered details, the directors and, importantly, the ownership structure. A firm is not expected to accept a certificate of incorporation as the whole answer, because a company can be owned by another company, which is owned by a trust, which is owned by no one who appears in any register. The question of who ultimately benefits is the one the rules are built around.

Alongside identity sits purpose. What is the customer's business, and what relationship is being proposed? A firm that cannot answer this is not merely missing a form; it has no basis on which to judge whether later activity is normal or odd. That judgement is the practical value of the whole exercise.

Beneficial ownership, and why the layers matter

Beneficial ownership means the natural person who ultimately owns or controls the customer, even when the shares are held by another entity. Many countries now keep a register of beneficial owners, though who may consult it and on what terms varies widely. Where a register is open, it is a fast route to the answer. Where it is not, the firm has to obtain the information from the customer, and to test it against what it can see. The section on due diligence covers the same exercise from a commercial angle, and the glossary defines the terms.

Risk assessment, which decides how much work is enough

Not every customer needs the same level of checking. The rules expect a firm to assess risk, using factors such as the customer's country, the sector, the ownership structure, the products involved and the channel through which the relationship is established. A lower-risk customer may need standard checks. A higher-risk one needs enhanced due diligence, which goes further into the source of funds, the source of wealth and the reason for the transaction. Politically exposed persons, complex ownership chains, high-risk jurisdictions and unusual transaction patterns all push a relationship into the enhanced category.

The risk assessment is not a single decision made at onboarding. It is a judgement that is revisited as the relationship develops, because a customer who was unremarkable at the start can become a concern later.

Source of funds and source of wealth

The two phrases are related and often confused. Source of funds is where the money for a particular transaction came from: the sale of a property, the proceeds of a business, an inheritance. Source of wealth is how the person accumulated their overall wealth over time. Source of funds answers a question about one payment; source of wealth answers a question about a life. Both are asked in higher-risk cases, and both require evidence rather than an explanation. A customer who cannot show how a large sum was earned is a problem for the firm even when there is no evidence of crime, because the firm cannot demonstrate that it asked the right question.

Monitoring, which never stops

Onboarding is a moment. A relationship is a duration. The rules expect a firm to monitor what a customer does: to watch transactions for patterns that do not fit the customer's stated business, to keep sanctions screening current as lists change, and to refresh identity and ownership information when a relationship is reviewed. Monitoring is where most failures occur, because it is continuous and unglamorous. An alert that is closed without being examined, a list that is not updated, a review that is not done: each is a gap that only becomes visible when something goes wrong.

Reporting suspicion

When a firm suspects that money is connected to crime, the rules usually require it to file a report with a national financial intelligence unit. The timing, the form and the consequences differ by country, and one rule is common: the firm must not tell the customer that a report has been made. That prohibition, usually called tipping off, is why suspicious activity reports are handled by a small number of people within a firm, and why a customer relationship may change without explanation.

Where KYC ends and commercial due diligence begins

KYC and AML are obligations, imposed by law on regulated firms, and their purpose is the public one of keeping crime out of the financial system. Commercial due diligence is a choice, made by a company that wants to understand a counterparty before a deal. They overlap, and a firm often runs them together, but they are not the same. A bank must ask who its customer is; a buyer chooses to ask who it is dealing with. The guide to what corporate due diligence covers sets out the commercial version, and the guide to compliance monitoring covers what happens when a firm's own programme is tested from outside.

Where to read the international standards

The Wolfsberg Group, an association of global banks, publishes principles and guidance on anti-money-laundering and financial crime compliance that are widely used as a practical reference alongside the national rules. The address is wolfsberg-principles.com.

Source of funds checks rarely stop at the customer's own accounts. Where a client is a nonprofit, a community lender or a public agency, the money behind it often arrives from grants, tax credits or subsidized loan programs, and each channel carries its own documentation. A firm that maps those flows before onboarding spends less time chasing records later. The mechanics of how such money is raised, staged and disbursed across a neighborhood are set out in the review of community development finance, which traces the investors and the stages involved. Reading it alongside an AML file helps an analyst judge whether a funding story holds together.

Ongoing monitoring assumes the customer is already trading. A firm that opens an account for a newly incorporated company often finds no trading history to review, only a plan. The same discipline that applies to an established counterparty can be applied earlier, when an owner is still testing a business idea and before any account is opened. Identity, ownership and source of funds are then checked against real customers and real numbers rather than projections. The file that results is thinner, but it is built on evidence, and it gives the monitoring stage a baseline to measure change against.

The checks do not stop at the customer file. A firm that sells goods or services online also has to understand how the money reaches it and how the goods leave, because both stages carry their own risk. A payment provider authorises and captures funds, a fulfilment operation picks and ships, and a returns process stands ready to reverse the transaction. Each step produces records that an investigator can test against the customer profile. A short account of how an online sale is completed sets out those four operations in sequence and the points at which monitoring data is generated.

The same discipline applies when a firm reviews the records it receives. A bill, like a bank statement, is a primary document, and reading it line by line is the only way to test what it claims. The Diligence Review has published a guide to reading a hospital bill that sets out how an itemised statement lists each charge with a procedure code, a date of service and an amount. The method transfers: identify the parties, trace each entry to its source, and note what the document does not explain.

Court records form a distinct layer of the file. A KYC or AML review that stops at the corporate registry leaves the litigation history of a counterparty, its owners, or its officers unexamined, and that history often carries the detail a registry omits: claims, judgments, and the sequence of filings that shows how a dispute developed. For cases heard in Maine, the state's trial and appellate courts maintain dockets that record each step in a proceeding, and the page on Maine court dockets explains what a docket contains and how those records can be accessed. Reading them against the ownership file is a routine part of ongoing monitoring.

KYC and AML checks do not stop at the corporate perimeter. A firm that verifies identity, ownership and source of funds for a client may also need to read the rules that govern where that client operates. Jurisdiction-specific regimes matter: incentives, clearance routes and approval timelines can shape how a project is financed and who controls it. The Diligence Review has published a page on industrial approvals in Odisha, covering the Industrial Policy Resolution 2022 and the GO SWIFT single-window portal. Such material supports the file rather than replacing the underlying checks.

Ongoing monitoring also extends to how a counterparty describes its own operations. A manufacturer that claims a plating line, for instance, can be asked whether the process is electrolytic or chemical, and whether the coating is applied from an aqueous bath. The answer matters because electroless nickel plating deposits nickel without an external current, a detail that separates a genuine production capability from a vague statement in a pitch document. Discrepancies between what a company says it does and what its records show are the kind of finding that KYC and AML procedures exist to surface.