KYC
KYC, or Know Your Customer, is the regulatory requirement for financial institutions to verify a customer's identity and assess money-laundering and terrorist-financing risk before starting a relationship, and to keep checking throughout it. In the UK, it sits under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, as amended. Most regulated markets run an equivalent framework.
KYC sits inside the broader anti-money-laundering framework, alongside sanctions screening and transaction monitoring, rather than standing on its own. It is not a one-time gate passed at account opening and then forgotten: firms must re-verify customers as circumstances change and risk triggers fire. It is also not the same as KYB, which verifies a company and its beneficial owners rather than an individual, even though both run on the same underlying obligation.
What does the KYC process involve?
The KYC process runs as a sequence of checks rather than one step, and each stage feeds the next.
It starts with identity verification: confirming the customer is who they claim to be, usually through a document check and a biometric match. Customer due diligence follows, assessing the risk the relationship carries based on the customer's profile, product, and geography. Sanctions, PEP, and adverse-media screening run alongside this, checking the customer's name against watchlists and flagging anything that needs a closer look. Where risk is elevated, enhanced due diligence adds source-of-funds evidence and a more detailed case file before a decision is made. None of this ends at onboarding: periodic and event-driven review re-runs relevant checks as a customer's risk profile or circumstances change, which is what makes KYC an ongoing obligation rather than a single gate.
How does KYC relate to KYB?
KYC verifies an individual. KYB, Know Your Business, verifies a company and the people who own and control it, then runs KYC on each of them. Our full comparison of the two checks covers where they share infrastructure and how to automate both.
What happens when KYC checks fail?
A failed KYC check rarely means an automatic decline. It means the case moves to a closer look rather than completing on its own.
A document that will not verify, or a name that returns a possible sanctions or PEP match, routes to enhanced due diligence: the firm gathers further evidence, such as source-of-funds documentation, and a human makes the risk-rating call. A confirmed sanctions match stops the relationship outright, since that is a hard regulatory line rather than a judgment. A genuine suspicion of money laundering, separate from a routine screening hit, can trigger a suspicious activity report to the relevant authority. Throughout this, the customer experience matters as much as the compliance outcome: a case stuck in review with no communication reads the same as a decline to the person waiting on it, so firms that automate the surrounding chasing and updates convert more of the genuine customers hiding inside a false-positive queue.
How AI agents automate KYC
The commercially useful split in KYC automation is not by difficulty, it is by accountability: an AI agent takes on the work around a decision, and a named human keeps the decision itself.
An agent can collect documents in conversation, retry a failed capture, call an identity verification provider, run sanctions and adverse-media screening, clear the unambiguous non-matches, and draft the rationale for everything else. It can chase a customer for a missing document and resume the case the moment they reply, and it can detect a periodic-review trigger and re-request an expiring document without a person starting the workflow. What it does not do is decide a genuine sanctions match, risk-rate a customer, or sign off a case, because those are the calls that carry regulatory accountability. Gradient Labs runs this split through more than 20 pre-built financial-services guardrails and a full audit trail of every action the agent takes, so a clean case reaches onboarding untouched while a flagged one reaches compliance with the file already assembled. Our guide to which KYC stages automate and which still need a person sets out that split stage by stage.
Frequently asked questions
Is KYC a one-time check or an ongoing obligation?
Ongoing. The initial check happens before a relationship starts, but firms must keep re-verifying as circumstances change, a risk trigger fires, or a periodic review comes due. Treating KYC as a box ticked once at onboarding and never revisited is a common source of avoidable regulatory risk.
What is enhanced due diligence in KYC?
Enhanced due diligence is the deeper review applied to higher-risk customers, such as those flagged by a PEP match, an unusual source of funds, or a high-risk jurisdiction. It typically means gathering further evidence, building a more detailed case file, and having a human make the final risk-rating call rather than clearing the case automatically.
Who is legally required to run KYC checks?
In the UK, firms captured by the Money Laundering Regulations, including banks, lenders, payment firms, and other regulated financial services businesses, must run KYC checks on their customers. Requirements and thresholds vary by product and jurisdiction, so the exact obligation depends on the type of institution and the market it operates in.
What's the difference between KYC and AML?
AML, anti-money laundering, is the wider set of obligations a regulated firm carries, covering everything from customer checks to transaction monitoring and suspicious activity reporting. KYC is one part of that framework: the customer-facing verification and risk-assessment step. Every KYC check serves an AML purpose, but AML covers considerably more than KYC alone.