Know Your Customer: Implementing compliance with KYC checks

Basics of the “Know Your Customer” (KYC) principle

“Know Your Customer”, or KYC for short, is a procedure for identifying business partners and customers that is designed to prevent criminal activities such as money laundering and terrorist financing. This makes the KYC check a central part of due diligence obligations, especially for financial service providers. They must carry out a comprehensive risk assessment of their business contacts in order to avoid financial losses, legal consequences and reputational damage. This article provides an overview of the importance, implementation and optimization of KYC processes.

Definition: What does “Know Your Customer” mean?

KYC (“Know Your Customer”) describes the process by which companies – especially those in the financial sector – verify the identity of their customers. The aim is to detect money laundering, terrorist financing or fraud at an early stage. The idea: if you know the identity of your customer, you can avoid risks and protect yourself legally. The three main tasks of the KYC check therefore consist of

• Verifying customer identity
• A multi-layered risk assessment
• Continuous monitoring of transactions

Please note: The term “Know Your Customer” generally refers to both natural and legal persons who act as contractual partners. When it comes specifically to the verification of legal entities or companies, it is sometimes also referred to as the Know Your Business principle (KYB).

Importance for companies: Why is the KYC procedure important?

Risk management and compliance

An effective KYC program is the first line of defense against financial and legal risks. It helps to identify money laundering activities and prevent transactions with sanctioned persons. Companies that do not comply with legal requirements risk severe fines and can be excluded from international trade.

Trust and business partnerships

A transparent KYC process conveys security – both internally and externally. Business partners and customers trust that a company chooses its partners carefully. This is essential, especially in an international context: a functioning KYC system creates the basis for stable, long-term relationships, whether with banks, suppliers or service providers.

Legal basis of the KYC audit

Various national, EU-wide and international laws, regulations and directives form the legal framework for Know Your Customer audits. The following are particularly important for German companies to know

• the German Money Laundering Act (GwG)
• the German Banking Act (KWG)
• the EU Money Laundering Directives
• the recommendations of the Financial Action Task Force (FATF)

Who has to carry out KYC checks?

Know Your Customer activities are particularly important for companies in the financial sector. In principle, the KYC audit is therefore useful for all companies involved in financial services. In Germany, some types of companies are even legally obliged to carry out Know Your Customer checks. So-called “obligated parties” according to the Money Laundering Act are:

• Credit, financial services, payment and e-money institutions
• Insurance companies and insurance brokers (in special cases)
• Capital management companies
• Freelance legal, business and tax consultants
• Real estate agents
• Gambling providers (organizing and brokering)
• Goods traders
• Service providers for companies and trusts

Please note: Simplified KYC procedures are permitted for some obliged entities on this list.

The KYC process: How does the KYC check work?

The KYC process ranges from the onboarding of new customers and business partners to the continuous monitoring of the business relationship – including the documentation of KYC measures taken. An overview of the most important points:

Phase 1: Customer identification (CIP)

For new customers or new business contacts, an internal Customer Identification Program (CIP) must first be completed. The aim is to record basic customer data and then verify it. Companies must ensure that their business partner is a real person or organization.

Phase 2: Due Diligence (CDD)

In the second phase, a comprehensive risk assessment is carried out as part of customer due diligence (CDD). The following steps must be implemented for both natural persons and legal entities or companies:

• if applicable: Identification of beneficial owners* and analysis of ownership and control structures
• Identification, review and documentation of the purpose and nature of the planned business relationship
• Review of the customer, potential representatives and their beneficial owners for PEP status
• Sanctions list check of all relevant natural persons, including documentation of the check results

*Beneficial owner: a natural person who has significant influence over a legal entity or a company, a foundation or similar (e.g. through the ownership of many capital shares or voting rights)

Attention: Depending on the risk assessment of the customer or business partner, simplifications or intensifications of the due diligence obligations may apply (see §14 / §15 GwG).

Phase 3: Extended Due Diligence (EDD)

In certain cases, the due diligence checks must be extended; an increased duty of care applies. According to Section 15 of the Money Laundering Act (GwG), this includes the following situations, among others:

• the business contact (or a family member or close associate) is considered a Politically Exposed Person
• conspicuous transactions (e.g. where large sums of cash are involved, the origin of the funds is concealed, contradictory information is provided)
• transactions with a country classified as a high-risk country, with countries where systematic corruption is prevalent or with a letterbox company

Companies must then obtain additional information (e.g. on the origin and planned use of the assets or other business relationships) and take further security measures (e.g. verify business activities through annual reports).

Phase 4: Continuous monitoring & documentation

Even after the initial recording, identification and verification of business contacts, there are long-term tasks as part of the KYB / KYC check. These include, among other things

• Monitoring the business relationship, in particular transactions
• Ongoing maintenance of customer data and, if necessary, checks when important information is updated
• For legal entities / companies: ongoing checks of commercial register entries, beneficial owners and company structures, etc.
• Documentation of the information collected in the KYB / KYC process, risk assessments carried out and subsequent measures and checks in accordance
• with the provisions described in Section 8 GwG (GDPR-compliant, audit-proof, in accordance with applicable deadlines)
• Documentation of the auditors and any changes to the data collected
• Proof of the appropriateness of the procedures

Technological change: eKYC and digital identity verification

eKYC (“electronic Know Your Customer”) digitizes the traditional identification process. Instead of paper forms, companies use digital processes for identity verification. For example, AI analyses or biometric verification technologies such as facial recognition are used for this purpose.

The digitalized KYC process offers advantages for …

1. Companies:
   1. Time and cost savings in implementation
   2. Scalable processes
   3. Higher verification accuracy
   4. Automatic process documentation
   5. Improved compliance and reduced risks
2. Customers:
   1. 24/7 availability of new customer intake
   2. Faster verification procedures
   3. Paperless, environmentally friendly processes

Please note: eKYC processes are subject to special legal requirements that need to be checked and implemented in more detail.

Conclusion: KYC audit as the key to compliance and business security

Those who set up the KYC process correctly – digitally, scalably and legally compliant – not only create security, but also trust among customers and business partners. It is therefore important to establish best practices within the company:

• Regularly update customer data: Customer information changes. Those who do not update regularly risk outdated risk assessments.
• Training and sensitizing the team: KYC auditing is teamwork. The system only works if everyone involved is sensitized. Internal training and awareness campaigns are therefore a must.
• Use the right software: Digital tools support testing processes. They can be integrated into ERP systems and carry out automatic sanctions list checks, for example