What is KYC? Know your customer checks explained

KYC stands for know your customer. It is the everyday name for identifying a client, verifying that they are who they say they are, and understanding why they want to deal with you, before you act for them. The Money Laundering Regulations 2017, which apply to business carried on in the United Kingdom, do not use the phrase. They call it customer due diligence, and GOV.UK describes that as "taking steps to identify your customers and checking they are who they say they are".

Who has to carry out KYC checks?

KYC is a legal duty only for the businesses the Money Laundering Regulations list, and the list is narrower than many owners assume. Our explainer on what AML means sets out who is on it and the wider duties around this one. Some businesses outside the list run similar checks by choice: the Financial Conduct Authority says many mortgage and insurance brokers, whom the Regulations do not bind, do so.

What does the law require?

Regulation 28 sets out the measures. A firm in scope must:

• Identify the customer and verify the identity. To verify means to check against documents or information from a reliable source independent of the person. For an individual, GOV.UK lists a name, a photograph on an official document, a residential address and a date of birth.

• Understand the relationship. The firm assesses, and where appropriate obtains information on, the purpose and intended nature of the business relationship.

• For a company, establish what it is. Obtain and verify its name, its company number and its registered office, and take reasonable measures to establish who its directors are.

• Find the beneficial owner. Where someone else owns or controls the customer, the firm identifies that person and takes reasonable measures to verify who they are. Relying solely on what has been filed at the company register does not satisfy this.

• Check anyone acting for the customer. The firm identifies and verifies that person, and verifies that they are authorised to act.

• Keep watching. Ongoing monitoring of the relationship, including scrutiny of transactions, is part of the same regulation.

How far each measure goes must reflect the firm's own risk assessment and the risk in the particular case.

When do the checks have to be done?

Regulation 27 says when. The measures apply when a firm establishes a business relationship, for certain one-off transactions above a set value, when it suspects money laundering or terrorist financing, and when it doubts the documents or information it obtained before. They apply again to existing customers at appropriate times on a risk-sensitive basis, and when the firm becomes aware that a customer's circumstances have changed. A client of ten years who restructures their company is due another look.

Where the risk is higher the firm does more. GOV.UK's example is a politically exposed person, such as a member of parliament or a minister: only senior management approves the new relationship, and monitoring is stricter.

How does KYC show up in a working day?

A new client says yes on Monday. On Tuesday someone asks for a passport and a proof of address. On Friday one has arrived, photographed at an angle. The following week a director's details do not match the public register, and the person who would chase it is on leave. The work the client is paying for has not started.

The same week plays out at an estate agency with an offer just accepted, a financial advice firm taking on a client with four old pensions, an accountancy practice taking on a company and a law firm opening a property matter.

What is KYC confused with?

• AML. AML is the whole regime a firm in scope runs. KYC is the part of it that happens client by client.

• An electronic identity check. A checking service returns a result. Weighing it and deciding to act are the firm's.

• A fact-find. In an advice firm the fact-find gathers what an adviser needs in order to advise. It is a different job from proving who the client is.

• Something a provider can carry for you. Whether a firm relies on another regulated firm or applies the measures through an outsourced checking service, the Regulations leave the firm liable for any failure.

Which parts of KYC can an AI worker take on?

The parts of KYC that suit an AI worker are the gathering and the preparing. It can ask the client for the right documents, remind them until they arrive, read the details into your system, look up a company and its filed owners for a person to confirm, run the search through the checking service your firm already uses, and assemble a dated file with any mismatch set out at the top. The role is on our page for client onboarding and KYC, and where documents are chased across a longer case, on chasing clients for documents.

What stays with a person?

A person rates the risk of this client, decides whether to take them on, approves a higher-risk relationship and deals with anything that looks wrong. An AI worker that finds a mismatch reports it and stops. Which checks your firm runs come from your own policies and your supervisor's guidance, and are written into the role before it starts. This article describes the law as read on 3 October 2026; it does not advise on how to comply with it. Our article on the safety of AI in AML and KYC admin sets out the questions to ask.

For a firm that must know its customers the worker would ask, chase and prepare each file, and the decision would stay where the law puts it. If new clients are waiting on paperwork before the work they are paying for can start, talk to our agent.