What is KYC (Know Your Customer)?

How it works

KYC is the onboarding-stage component of the broader AML framework. Every regulated financial institution — bank, EMI, broker, fund, crypto exchange — must run KYC on every customer before opening an account or accepting funds. The standard sequence:

1. Customer identification — collect identity documents.
2. Identity verification — confirm the documents are authentic and match the person.
3. Beneficial ownership identification — for entities, identify natural persons controlling 25%+ or with substantial control.
4. Risk assessment — assign a risk rating (low / medium / high) based on jurisdiction, business activity, transaction patterns expected.
5. Sanctions and PEP screening — automated check against OFAC, UN, EU, UK and national sanctions lists; PEP (Politically Exposed Persons) lists.
6. Tax residency self-certification — for CRS and FATCA compliance.
7. Source of funds documentation — for higher-risk profiles or large account openings.

Standard documents

For individuals:

• Government photo ID — passport (preferred for international), national ID card, driver's licence.
• Proof of address — utility bill, bank statement, lease agreement, government letter (typically less than 3 months old).
• Tax-residency self-certification — declaration of countries of tax residence + TINs.
• Source of funds proof — bank statements, employment contract, business sale documents, inheritance documentation, depending on amount and risk profile.

For entities:

• Certificate of incorporation / formation.
• Articles of association / operating agreement.
• Recent filing (annual report, certificate of good standing).
• Register of directors and members.
• Beneficial owner identification for each natural person owning 25%+ or with substantial control.
• EIN / tax registration.
• Proof of business address (lease, utility bill).

Why KYC fails

Common rejection patterns:

• Address mismatch — proof-of-address doesn't match the address declared in the application.
• Document quality — blurry scans, partial photos, expired documents.
• Sanctions / PEP false positives — common name matches a sanctioned individual; requires manual review.
• Unclear source of funds — large opening balance from "personal savings" without documentation.
• Beneficial-owner ambiguity — multi-layered ownership where the institution can't trace the ultimate natural-person owner.
• Inconsistent corporate documents — registered address differs across forms; director list outdated; etc.

EDD (Enhanced Due Diligence)

For higher-risk profiles (PEPs, residents of high-risk jurisdictions, complex ownership structures, large transactions), institutions apply Enhanced Due Diligence:

• Senior management approval for the relationship.
• Source of wealth documentation (broader than source of funds).
• Ongoing monitoring at higher frequency.
• Periodic KYC refresh every 1-2 years instead of standard 3-5.

Examples

• French founder opens Mercury for his Wyoming LLC. Submits passport + French utility bill + LLC certificate + EIN + operating agreement + W-8BEN. Mercury approves in 3 business days. Clean file = clean onboarding.
• Russian-origin entrepreneur applies for the same. Identical document set, but sanctions screening triggers manual review. EDD requested: source of wealth documentation, business plan, expected counter-parties. After 2-3 weeks of additional documentation, application approved or denied based on full risk assessment.

Common mistakes

• Underestimating proof-of-address requirements. A French founder using his old Brazilian address triggers mismatch with passport / corporate filings.
• Skipping source-of-funds documentation. "Personal savings" without bank statements rarely passes for substantial opening balances.
• Trying to onboard before forming the entity properly. A US LLC without an EIN or operating agreement won't pass EMI KYC.
• Treating KYC as one-time. Regulated institutions periodically refresh KYC (typically every 1-3 years for standard customers, more often for EDD profiles). Address changes, ownership changes, business-model changes all trigger re-verification.