Introduction
Financial institutions need to know who their customers are, understand where their money comes from, and identify activity that may involve financial crime. These responsibilities are usually discussed under two terms: Know Your Customer (KYC) and Anti-Money Laundering (AML).
Although the terms are often used together, they do not mean the same thing. KYC refers to the process of identifying and verifying customers and understanding their risk. AML covers the wider set of policies, controls, monitoring processes, and reporting activities used to prevent and detect money laundering.
The confusion begins when organizations try to separate what the law requires from what compliance teams consider good practice. Some controls are mandatory for specific regulated institutions. Others may be recommended by regulators, expected under a risk-based approach, or adopted voluntarily to improve security and operational efficiency.
For example, a financial institution may be required to verify customer identity and monitor transactions, but it may not be required to conduct every possible screening check on every customer. The exact obligations depend on the institution, its jurisdiction, the products it offers, and the risks it faces.
The Financial Action Task Force (FATF) provides international AML and counter-terrorist financing standards, while national regulators turn these standards into local laws and supervisory requirements. The FATF also makes clear that its recommendations are implemented through national legal systems, meaning requirements can differ between countries. FATF Recommendations.
Understanding this difference helps financial technology companies build compliance processes that meet legal obligations without adding unnecessary steps for every customer.
What Is the Difference Between KYC and AML?
KYC: Knowing and Verifying the Customer
KYC is the process of establishing who a customer is and whether the information provided can be trusted. Depending on the product and jurisdiction, this may involve collecting a customer's name, date of birth, address, identification details, and other relevant information.
For business customers, KYC can be more complex. A financial institution may need to understand the legal entity, its ownership structure, the people who control it, and the purpose of the business relationship.
Identity verification is only one part of the process. A financial institution may also need to understand the customer's expected account activity and assess whether the relationship presents a higher risk of money laundering or other financial crime.
AML: Managing the Wider Financial Crime Risk
AML includes customer due diligence, transaction monitoring, suspicious activity reporting, recordkeeping, internal controls, staff training, and other measures required by the applicable regulatory framework.
KYC helps an institution understand who it is dealing with. AML uses that information, along with transaction and other relevant data, to identify and manage potential financial crime risks.
A customer who passes identity verification is not automatically free from risk. A genuine customer could still use an account for suspicious transactions, and a customer's risk profile may change over time.
What Regulators Actually Require
There is no single worldwide KYC checklist that applies to every financial institution. Requirements depend on local law and the type of regulated activity.
However, several core obligations appear in many AML frameworks.
Customer Identification and Verification
Regulated institutions generally need procedures to identify customers and verify their identities in accordance with the applicable rules. The required information, acceptable evidence, timing, and exceptions depend on the jurisdiction and product.
For example, in the United States, customer identification program requirements apply to covered financial institutions under the Bank Secrecy Act framework. Other countries have their own identity verification and customer due diligence requirements.
A business should therefore map each product and customer type to the relevant legal requirements instead of assuming that one verification process will satisfy every obligation.
Customer Due Diligence and Risk Assessment
Customer due diligence (CDD) goes beyond collecting identity documents. It includes understanding the nature and purpose of a customer relationship and developing an appropriate risk profile.
FinCEN's Customer Due Diligence Rule sets out four core requirements for covered financial institutions: identifying and verifying customers, identifying and verifying beneficial owners of covered legal-entity customers, understanding the nature and purpose of customer relationships to develop risk profiles, and conducting ongoing monitoring with risk-based updating of customer information and reporting of suspicious transactions. FinCEN CDD Rule.
The precise requirements and exceptions should be checked against current rules and official guidance. For example, FinCEN announced an order in February 2026 providing certain relief from identifying and verifying beneficial owners at every new account opening. This illustrates why compliance processes must be reviewed when regulations change.
Suspicious Activity Reporting and Recordkeeping
Where the law requires it, institutions must report qualifying suspicious activity to the appropriate authority and retain relevant records for the required period.
The reporting threshold, deadlines, confidentiality rules, and recordkeeping requirements differ across jurisdictions and types of institution.
A monitoring alert alone is not necessarily a reportable event. Staff need procedures for reviewing alerts, documenting decisions, escalating cases, and submitting reports when required.
What Is Required, and What Is Best Practice?
The difference between a legal obligation and a recommended control is important because implementing every available screening method for every customer can increase costs, delay onboarding, and create large volumes of alerts.
A practical way to separate the two is to classify controls into three categories.
1. Legal or regulatory requirement: A control explicitly required by applicable law or regulation, such as customer identification, required due diligence, or reporting qualifying suspicious activity.
2. Risk-based regulatory expectation: A control or process needed to manage the institution's particular risks and demonstrate that its compliance program is effective. The exact steps may vary according to customer type, products, geography, and transaction activity.
3. Additional best practice: A control adopted to improve risk detection, customer experience, security, or operational performance beyond the minimum requirements that apply to the institution.
The categories are not always completely separate. A control that is not universally required for every customer may become necessary in a particular case because the risk assessment, local rules, or supervisory expectations call for it.
Examples of Controls That May Be Risk-Based or Optional
Some institutions choose to screen every customer against additional adverse-media sources, use biometric liveness checks, conduct more frequent rescreening, or collect extra documents from particular customer groups.
These controls may be valuable, and some may be required for specific products, risks, or jurisdictions. But they should not automatically be described as universal AML requirements.
FinCEN's CDD FAQs explain that the U.S. CDD Rule does not categorically require a particular media search or screening process for every customer. Institutions should assess the information needed to understand customer relationships and manage the relevant risks. FinCEN CDD Rule FAQs.
This is a useful example of why compliance teams should verify legal requirements before turning every industry practice into a mandatory onboarding step.
Risk-Based KYC: Why Every Customer Does Not Need the Same Checks
A risk-based approach means the level of due diligence should reflect the risks associated with the customer, product, service, geography, and activity.
A low-risk customer using a straightforward product may need a different level of scrutiny from a complex business operating across several jurisdictions. A customer with a complicated ownership structure or unexplained transactions may require enhanced due diligence.
Standard Due Diligence
Standard due diligence generally establishes the customer's identity, purpose of the relationship, and relevant risk profile. The precise checks depend on applicable law and the institution's policies.
Enhanced Due Diligence
Enhanced due diligence (EDD) involves additional scrutiny where a customer or relationship presents higher risk. Depending on the circumstances, this may include obtaining more information about the source of funds or wealth, understanding ownership and control in greater detail, or increasing monitoring.
EDD should be based on relevant risk factors and legal requirements. It should not be applied indiscriminately without a clear reason.
Ongoing Due Diligence
KYC is not necessarily complete when an account is opened. Customer information and activity may change, and ongoing due diligence helps institutions identify changes that require review.
For example, a business account that originally handled routine domestic payments may begin receiving large international transfers that do not match its stated business purpose. This change may justify a review of the customer's risk profile and the activity involved.
How Transaction Monitoring Fits Into AML
Transaction monitoring examines account activity to identify patterns that may require further investigation. Depending on the institution's business and risk profile, monitoring can involve rules, statistical methods, machine learning, or combinations of these approaches.
A monitoring system may flag activity such as transactions inconsistent with a customer's expected behavior, unusual payment patterns, or activity that appears connected to known risks.
However, an alert does not prove money laundering. Legitimate transactions can look unusual, while suspicious activity may not trigger a simple rule.
Why Too Many Alerts Create Problems
If a monitoring system produces too many false positives, investigators may spend time reviewing cases that have little value. Important alerts can become harder to identify among the volume.
Institutions should assess whether their monitoring rules and models are producing useful results, document how alerts are reviewed, and adjust controls when evidence supports doing so.
The objective is not to generate the largest possible number of alerts. It is to identify relevant risk while meeting legal obligations and maintaining a reliable investigation process.
Building Compliance Technology Without Overcomplicating It
For fintech businesses, compliance needs to be part of the product architecture rather than an additional step added after launch.
When developing AML software, teams should first identify the laws and regulatory requirements that apply to each product and market. They can then map those requirements to customer onboarding, identity verification, risk scoring, transaction monitoring, case management, reporting, and record retention.
This process helps prevent two common problems: missing a required control and building expensive features that do not meaningfully address the institution's risks.
A well-designed system should also maintain an audit trail. It should record relevant checks, the information used, changes to risk profiles, alert decisions, escalations, and required reporting actions. Access to sensitive customer information should be controlled, and retention should follow applicable legal requirements.
Integrating Third-Party Verification Providers
Many fintech platforms rely on external services for identity document verification, biometric checks, sanctions screening, or business-data verification.
These integrations can speed up onboarding, but outsourcing a task does not automatically transfer the institution's legal responsibility. The business should understand what the provider checks, which jurisdictions and data sources it covers, how errors are handled, and what evidence is retained.
The platform should also have a fallback process for service outages, inconclusive results, and cases that need manual review.
Why Software Architecture Matters for Compliance
The broader challenge in app development for fintech technology is connecting compliance controls to the product without making the customer journey unnecessarily difficult.
A modular architecture can help separate identity verification, customer risk assessment, sanctions screening, transaction monitoring, and case management. Each component can have its own configuration, audit trail, and update process while sharing relevant information securely.
This is especially useful when a fintech company operates in more than one country. Different markets may have different rules, documentation requirements, reporting obligations, and retention periods. The platform should support jurisdiction-specific workflows instead of applying one global process without considering local law.
Compliance teams should be able to update policies and thresholds through controlled configuration where appropriate, while changes to core logic should follow testing, approval, and release procedures.
The Scale of Money Laundering and the Limits of Estimates
The scale of money laundering is difficult to measure because the activity is concealed by design. There is no definitive annual global figure.
The FATF explains that estimates have varied widely. It cites a UN Office on Drugs and Crime estimate that criminal proceeds amounted to 3.6% of global GDP in 2009, with 2.7%—about US$1.6 trillion—being laundered. The FATF also warns that such estimates should be treated cautiously because precise global statistics are unavailable. FATF: Frequently Asked Questions.
This figure should not be presented as a current annual measurement. Its value is in showing the potential scale of the problem and the difficulty of measuring illegal financial flows accurately.
For compliance teams, the practical takeaway is to focus on risk-based controls, reliable data, effective monitoring, and evidence that the program works, rather than relying on a single headline estimate.
Common KYC and AML Mistakes
One common mistake is treating identity verification as the whole compliance process. Verifying a customer's identity does not replace the need for risk assessment and, where applicable, ongoing monitoring.
Another mistake is assuming that every customer must undergo the most extensive checks available. Excessive checks can increase onboarding friction without improving risk management if they are not connected to the institution's actual obligations and risk profile.
A third mistake is treating vendor approval or software installation as proof of compliance. Technology can support a compliance program, but it cannot by itself guarantee that policies are appropriate, staff follow procedures, alerts are reviewed correctly, or reports are filed when required.
Finally, organizations sometimes overlook regulatory change. Requirements can change, and a process that was compliant at one time may need revision. Compliance teams should use current official sources and qualified legal advice when interpreting obligations.
Conclusion
KYC and AML are connected, but they serve different purposes. KYC establishes and verifies customer identity while helping an institution understand the relationship and its risks. AML includes the wider controls used to prevent, detect, investigate, and report potential financial crime.
Regulators generally require covered institutions to maintain controls appropriate to their legal obligations, including customer identification, due diligence, monitoring, and reporting where applicable. The precise requirements depend on the jurisdiction, product, institution, and risk involved.
Best practice adds controls that improve detection, explainability, security, and customer experience. These controls can be valuable, but they should be introduced for a clear reason and not incorrectly presented as universal legal requirements.
The most effective compliance approach begins with the rules that actually apply, maps them to customer and transaction risks, and uses technology to implement those controls consistently. A clear distinction between mandatory requirements and additional safeguards helps fintech businesses build compliance systems that are effective, auditable, and easier to maintain.
External Resources
- FATF Recommendations — international standards for AML and counter-terrorist financing.
- FinCEN Customer Due Diligence Rule — U.S. CDD requirements for covered financial institutions.
- FinCEN CDD Rule FAQs — explanations of beneficial ownership and risk-based due diligence.
- FATF Frequently Asked Questions — background on the limits of global money-laundering estimates.