Know Your Customer and Customer Identification

1. Why Know Your Customer and Customer Identification Matter

Know Your Customer (KYC) is the foundation of every anti-financial crime (AFC) program. If an institution does not know who its customers are, where their money comes from, and what activity to expect from them, it cannot detect money laundering, terrorist financing, sanctions evasion, fraud or corruption. Every downstream control (transaction monitoring, sanctions screening, suspicious activity reporting, and risk-based resource allocation) depends on accurate, current customer information.

From a regulatory perspective, KYC failures are the single most common root cause of enforcement actions. Regulators have imposed multi-billion-dollar penalties on institutions that onboarded shell companies without identifying beneficial owners, failed to verify identities, or ignored red flags at account opening. From a reputational perspective, being named as the bank that serviced a sanctioned oligarch, a drug cartel or a corrupt politically exposed person (PEP) can cost far more than the fine itself.

For the CAMS exam, KYC and Customer Identification sit squarely inside the domain AFC Program Governance and Risk Management. You will be expected to understand not just definitions but how KYC fits into the risk-based approach, how it interacts with the three lines of defense, and how to apply it in realistic scenarios.

2. What Is Know Your Customer?

KYC is the overall process by which a financial institution establishes and maintains an understanding of its customers so that it can assess and manage the financial crime risk each relationship presents. It is a lifecycle concept, beginning before the account is opened and continuing until the relationship ends.

The terminology matters on the exam, so keep these distinctions clear:

Customer Identification Program (CIP) - The specific procedures used to collect identifying information and verify that the customer is who they claim to be. In the United States, CIP is a formal requirement under Section 326 of the USA PATRIOT Act and the implementing rules (31 CFR 1020.220 for banks). Internationally, the equivalent concept is embedded in FATF Recommendation 10 on Customer Due Diligence.

Customer Due Diligence (CDD) - The broader process of understanding the nature and purpose of the relationship, identifying beneficial owners, assessing risk, and establishing an expected activity profile. CIP is a component of CDD.

Enhanced Due Diligence (EDD) - Additional, deeper measures applied to higher-risk customers such as PEPs, correspondent banking relationships, private banking clients, customers from high-risk jurisdictions, cash-intensive businesses, and complex ownership structures.

Simplified Due Diligence (SDD) - Reduced measures permitted for demonstrably low-risk customers (for example, a publicly listed company on a regulated exchange or a government entity), but never a complete exemption from identification.

Know Your Customer's Customer (KYCC) - The concept, particularly in correspondent banking and payment intermediary relationships, of understanding the respondent's own customer base and controls, without necessarily performing due diligence on each underlying party.

Know Your Employee (KYE) - Screening and monitoring of staff, recognizing that insiders can facilitate financial crime. Often tested alongside KYC.

3. The Legal and Standard-Setting Framework

FATF Recommendation 10 requires that financial institutions be prohibited from keeping anonymous accounts or accounts in obviously fictitious names, and that they undertake CDD when: (a) establishing business relations; (b) carrying out occasional transactions above the applicable threshold (USD/EUR 15,000) or wire transfers covered by Recommendation 16; (c) there is a suspicion of money laundering or terrorist financing; or (d) there are doubts about the veracity or adequacy of previously obtained data.

FATF Recommendation 10 sets out four core CDD measures:
(1) Identify the customer and verify identity using reliable, independent source documents, data or information.
(2) Identify the beneficial owner and take reasonable measures to verify that identity, including understanding the ownership and control structure of legal persons and arrangements.
(3) Understand and, as appropriate, obtain information on the purpose and intended nature of the business relationship.
(4) Conduct ongoing due diligence, scrutinizing transactions to ensure consistency with the institution's knowledge of the customer, their business and risk profile, including source of funds where necessary.

Recommendation 12 covers PEPs, Recommendation 13 covers correspondent banking, Recommendation 17 addresses reliance on third parties, and Recommendations 24 and 25 address transparency of beneficial ownership of legal persons and arrangements.

The Basel Committee published Customer Due Diligence for Banks (2001) and later Sound Management of Risks Related to Money Laundering and Financing of Terrorism, which emphasize customer acceptance policies, customer identification, ongoing monitoring and risk management as the essential elements of KYC.

The Wolfsberg Group issues industry guidance on private banking, correspondent banking (including the Correspondent Banking Due Diligence Questionnaire, CBDDQ) and beneficial ownership.

United States: The CIP rule requires a written program that, at minimum, collects name, date of birth (for individuals), address, and an identification number (such as a taxpayer identification number, passport number, or other government-issued number) before opening an account. The FinCEN CDD Rule (effective 2018) added the fifth pillar of AML programs, requiring identification and verification of beneficial owners of legal entity customers (25 percent ownership threshold plus one control person) and ongoing monitoring with updates to customer information on a risk basis. The Corporate Transparency Act subsequently created a FinCEN beneficial ownership registry.

European Union: The Anti-Money Laundering Directives (4AMLD, 5AMLD, 6AMLD and the forthcoming AML Regulation) require CDD, beneficial ownership registers, EDD for high-risk third countries, and set the beneficial ownership threshold at more than 25 percent.

4. How KYC and Customer Identification Work in Practice

Step 1: Customer Acceptance Policy
The institution first defines who it will and will not do business with. A sound customer acceptance policy describes prohibited customer types (for example, shell banks, anonymous accounts, customers on sanctions lists), high-risk categories requiring senior management approval, and the documentation standards for each customer segment. The policy should be risk-based rather than so restrictive that it excludes legitimate customers and drives financial exclusion.

Step 2: Identification
Collecting identifying information. For natural persons this typically includes full legal name, date of birth, residential address, nationality, and a government-issued identification number. For legal entities it includes legal name, registration number, registered address, principal place of business, legal form, names of directors and officers, and the identity of beneficial owners.

Step 3: Verification
Confirming that the information is genuine using reliable, independent sources. Methods are commonly grouped as:
- Documentary verification: unexpired government-issued photo identification (passport, national ID card, driver's license); for entities, certificates of incorporation, articles of association, partnership agreements, trust deeds, government-issued business licenses.
- Non-documentary verification: comparing information against credit bureaus, public databases, utility records, independent electronic identity verification services, contacting the customer, or checking references from other financial institutions.
- Biometric and digital identity: increasingly used for non-face-to-face onboarding, consistent with FATF guidance on digital identity.

Verification must be completed within a reasonable time after account opening; if it cannot be completed, the institution must have procedures to close the account, restrict activity and consider filing a suspicious activity report.

Step 4: Beneficial Ownership
A beneficial owner is the natural person who ultimately owns or controls the customer or on whose behalf a transaction is conducted. Identification must look through layers of corporate ownership, nominees, trusts and foundations until natural persons are identified. Where no individual meets the ownership threshold, the senior managing official is treated as the control person. Red flags include bearer shares, nominee directors with no apparent role, unnecessarily complex multi-jurisdictional structures, and reluctance to disclose ownership.

Step 5: Understanding the Purpose and Nature of the Relationship
The institution should understand why the customer wants the account, the anticipated volume and type of transactions, geographic footprint, counterparties, and source of wealth and source of funds where risk warrants. This establishes the expected activity profile against which actual activity is later compared.

Step 6: Screening
Screening the customer, beneficial owners, directors and connected parties against sanctions lists (OFAC, UN, EU, HM Treasury and local lists), PEP databases and adverse media. Screening is performed at onboarding and periodically thereafter, and whenever lists are updated.

Step 7: Customer Risk Rating
Combining customer type, products and services used, geography, delivery channel and transaction behavior into an overall risk rating (typically low, medium, high). The rating drives the depth of due diligence, approval level, review frequency and monitoring intensity. Common high-risk indicators include: PEPs and their family members and close associates; cash-intensive businesses; money services businesses; casinos; arms dealers; precious metals and stones dealers; shell companies; customers in or dealing with high-risk or sanctioned jurisdictions; non-resident customers; and non-face-to-face relationships.

Step 8: Enhanced Due Diligence for Higher-Risk Customers
EDD measures include obtaining additional identification and background information, establishing source of wealth and source of funds, obtaining senior management approval to open or continue the relationship, conducting enhanced ongoing monitoring, and performing more frequent periodic reviews. For foreign PEPs, FATF requires senior management approval, source of wealth and funds, and enhanced monitoring in all cases. For correspondent banking, EDD includes understanding the respondent's business, reputation and supervision, assessing its AML controls, documenting responsibilities, and ensuring it does not permit payable-through accounts or nested relationships without adequate controls.

Step 9: Ongoing Monitoring and Periodic Review
KYC is not a one-time event. Customer information must be kept current through periodic reviews (commonly annually for high risk, every two to three years for medium risk, and every three to five years or trigger-based for low risk) and through event-driven reviews triggered by, for example, a change in ownership, a sanctions or PEP hit, an unusual transaction alert, adverse media, or a request for a new high-risk product.

Step 10: Record Keeping
FATF requires that all CDD records and transaction records be retained for at least five years after the end of the business relationship or the date of the occasional transaction, and be available promptly to competent authorities.

5. Special Topics Frequently Tested

Reliance on Third Parties and Introduced Business: An institution may rely on another regulated institution or intermediary to perform elements of CDD, but ultimate responsibility remains with the relying institution. It must obtain the CDD information immediately and be satisfied that copies of documentation are available on request without delay.

Non-Face-to-Face Customers: Higher inherent impersonation and fraud risk. Mitigants include certified documents, additional documents, independent contact with the customer, requiring the first payment from an account in the customer's name at another regulated institution, and digital identity verification.

Shell Banks: Banks with no physical presence in any jurisdiction and not affiliated with a regulated financial group. Institutions must not establish or maintain correspondent relationships with shell banks and must satisfy themselves that respondents do not permit their accounts to be used by shell banks.

Payable-Through Accounts and Nested Correspondent Accounts: These allow a respondent's customers to transact directly through the correspondent's account, meaning the correspondent effectively has unidentified customers. EDD is required.

Trusts, Foundations and Legal Arrangements: Identify the settlor, trustee, protector, beneficiaries or class of beneficiaries, and any other natural person exercising effective control.

Politically Exposed Persons: Domestic, foreign and international organization PEPs, plus family members and close associates. The PEP status does not automatically mean refusal; it requires a risk-based EDD response. The general view is that once a PEP, always a PEP for a reasonable period; de-classification should be a risk-based decision, not automatic after leaving office.

Private Banking: High-net-worth clients, discretion, complex structures and offshore vehicles elevate risk. Relationship managers may face conflicts of interest between revenue and compliance, so independent compliance oversight and senior management approval are essential.

Sanctions versus KYC: Sanctions screening is a component of the KYC and onboarding process but is a distinct, largely rules-based obligation. A true sanctions match generally requires blocking or rejection rather than a risk-based decision.

6. KYC within AFC Program Governance

Because this topic sits in the governance domain, understand how KYC connects to the wider program:

- The enterprise-wide risk assessment identifies inherent customer, product, geography and channel risks; KYC policies are a primary control that reduces residual risk.
- The three lines of defense model: the first line (business and onboarding teams) collects and verifies information and owns the customer relationship; the second line (compliance) sets policy, provides advice, performs quality assurance and oversight; the third line (internal audit) independently tests the effectiveness of KYC controls.
- Board and senior management must approve the KYC policy, receive management information on KYC backlogs, overdue reviews and high-risk customer populations, and approve high-risk relationships where required.
- Training must ensure front-line staff understand identification requirements, red flags and escalation routes.
- Independent testing should sample customer files to confirm completeness of CIP data, accuracy of risk ratings, and timeliness of periodic reviews.
- Data quality and technology: fragmented customer data across legacy systems is a key governance weakness; a single customer view supports both monitoring and regulatory reporting.

7. Common Red Flags at Onboarding

- Customer is reluctant to provide identification or beneficial ownership information, or provides documents that appear altered or inconsistent.
- Customer wants to open an account in a name different from the one on identification documents, or asks about reporting thresholds.
- Stated purpose of the account does not make commercial sense for the customer's profile.
- Business address is a mail drop, registered agent or residential address inconsistent with the stated business.
- Ownership structure involves multiple layers across secrecy jurisdictions with no clear business rationale.
- Customer is a PEP or closely associated with one and has not disclosed it.
- Customer is introduced by an intermediary who resists allowing direct contact.
- Initial deposit is inconsistent with the customer's stated income or source of wealth.

8. Exam Tips: Answering Questions on Know Your Customer and Customer Identification

Tip 1: Know the hierarchy of terms. CIP is a subset of CDD; CDD is the standard process; EDD is additional work for higher risk; SDD is reduced work for lower risk. If a question asks what is required at a minimum for every customer, the answer involves identification and verification, not source of wealth or senior management approval (which belong to EDD).

Tip 2: Remember the four FATF CDD measures. Identify and verify the customer; identify and take reasonable measures to verify the beneficial owner; understand the purpose and intended nature of the relationship; conduct ongoing due diligence. Many questions describe a scenario and ask which measure was missing.

Tip 3: Beneficial ownership means natural persons. If an answer choice stops at a holding company, nominee or trustee, it is usually wrong. Look through to the individual who ultimately owns or controls. Remember the 25 percent threshold plus a control person for the US CDD Rule and more than 25 percent in the EU.

Tip 4: Know the FATF triggers for CDD. Establishing a relationship; occasional transactions above USD/EUR 15,000; wire transfers under Recommendation 16; suspicion of ML or TF regardless of amount; doubts about previously obtained information. A question asking when CDD must be performed even for a small occasional transaction is pointing at the suspicion trigger.

Tip 5: The risk-based approach is the default answer philosophy. When a scenario asks what the institution should do with a higher-risk customer, the best answer usually involves applying enhanced due diligence proportionate to the risk, escalating for senior management approval, and increasing monitoring, rather than automatically closing the account or automatically accepting it. Conversely, mandatory prohibitions (anonymous accounts, shell banks, sanctioned parties) are not risk-based decisions.

Tip 6: Watch for absolute words. Answer options containing always, never, all, or only are frequently incorrect because KYC is risk-based. Exceptions are genuine absolute rules: no anonymous accounts, no shell bank correspondent relationships, and senior management approval for foreign PEPs.

Tip 7: Reliance does not transfer responsibility. If a question involves introduced business or reliance on a third party, the ultimate responsibility for CDD stays with the institution relying on the third party. Any answer suggesting responsibility has been outsourced is wrong.

Tip 8: Verification must be completed, and failure has consequences. If a scenario describes an account opened but verification could not be completed, the correct response involves not opening or closing the account, restricting transactions, and considering whether a suspicious activity report is warranted.

Tip 9: Ongoing is the keyword for the lifecycle. Questions that describe a customer whose activity has changed dramatically since onboarding are testing ongoing due diligence and trigger-based review. The correct answer involves updating the customer profile and risk rating and reviewing the activity, not simply relying on the original onboarding file.

Tip 10: Distinguish source of funds from source of wealth. Source of funds is the origin of the specific money used in a transaction or deposit; source of wealth is how the customer acquired their total net worth. EDD for PEPs and private banking clients typically requires both.

Tip 11: Place KYC in the governance context. When a question is framed around the compliance officer, the board, or audit, think about which line of defense is responsible. The first line collects data and owns the relationship; compliance sets policy and oversees; audit tests independently; the board approves policy and receives reporting.

Tip 12: Read for the best answer, not just a correct one. CAMS questions often present several plausible actions. Choose the one that is most complete, most consistent with FATF standards and the risk-based approach, and most appropriate to the role described. If one option addresses identification, risk assessment and escalation together, it generally beats an option addressing only one element.

Tip 13: Memorize key numbers. USD/EUR 15,000 occasional transaction threshold; 25 percent beneficial ownership threshold; five-year minimum record retention after the end of the relationship; the US CIP minimum data elements of name, date of birth, address and identification number.

Tip 14: Do not confuse KYC with transaction monitoring. KYC establishes who the customer is and what to expect; transaction monitoring compares actual behavior to that expectation. A question about a mismatch between expected and actual activity is bridging both topics, and the correct answer usually involves revisiting KYC information as part of the investigation.

9. Quick Revision Summary

- KYC is the lifecycle process of identifying, verifying, understanding, risk-rating and monitoring customers.
- CIP is the identification and verification component; CDD is the standard; EDD applies to higher risk; SDD to lower risk.
- FATF Recommendation 10 sets the four core CDD measures and the triggers for CDD.
- Beneficial owners are always natural persons; look through structures to find them.
- No anonymous accounts and no shell bank relationships are absolute prohibitions.
- PEPs, correspondent banking, private banking, non-face-to-face and high-risk jurisdictions call for EDD.
- Ultimate responsibility for CDD cannot be outsourced.
- Records must be kept at least five years after the relationship ends.
- KYC sits within governance: board-approved policy, three lines of defense, training, independent testing and management reporting.

Mastering these principles, and practicing how to apply them to scenario-based questions, will prepare you to handle any Know Your Customer or Customer Identification question on the CAMS exam with confidence.