Table of Contents
KYC is one control. AML is the whole programme that control sits inside. Know Your Customer covers identifying a customer, verifying who they are, finding the beneficial owners and rating the risk. Anti-money laundering covers all of that plus transaction monitoring, sanctions screening, suspicious activity reporting, governance, training and independent audit.
So the two terms are not alternatives. You do not pick one. A firm with excellent customer files and no transaction monitoring is not AML compliant. A firm with strong monitoring and thin customer files fails its first inspection, because the monitoring has nothing reliable to compare behaviour against.
Most of the confusion comes from product marketing. Software gets sold as a “KYC platform” or an “AML solution” and the labels blur. Regulators do not use the words that way. What follows is the full programme, element by element, so the line between the two is obvious.
What KYC actually covers
The Financial Action Task Force sets the international baseline through its 40 Recommendations. Recommendation 10 deals with customer due diligence and lists four things a firm has to do. Those four items are the practical definition of KYC.
- Identify the customer and verify that identity using reliable, independent source data.
- Identify the beneficial owner and take reasonable measures to verify who that is.
- Understand the purpose and intended nature of the business relationship.
- Conduct ongoing due diligence on the relationship and keep the information current.
Everything sold under the KYC banner maps back to one of those four. Nothing else does.
Identification and verification
For a natural person you collect the legal name, date of birth, residential address and nationality, then verify them. Verification means a document or a data source outside the customer’s own word. A passport, a national identity card, a government register extract. For a company you collect the registered name, company number, registered address and legal form, and you verify against the corporate registry in the country of incorporation. The certificate of incorporation is the usual starting document.
Beneficial ownership
You work up the ownership chain until you reach the natural persons who own or control the entity. Across the EU and the UK the usual trigger for disclosure is ownership of more than 25 percent of shares or voting rights, with a control test applied where no one crosses that line. Sanctions rules apply a separate and stricter ownership test, which is why the 50 percent rule in sanctions screening catches entities that a 25 percent KYC test would have cleared.
Customer risk rating
Every customer gets a rating. The inputs are the customer type, the products they use, the countries involved and the delivery channel. The output drives how much diligence you apply and how often you review the file. This is the single most load-bearing piece of KYC, because it sets the intensity of everything downstream.
What sits in an AML programme but outside KYC
Four blocks of work fall outside the customer file entirely. A firm that only does KYC has none of them.
Transaction monitoring
Rules and models watch activity after onboarding and raise alerts when behaviour departs from the expected profile. Structuring patterns, rapid movement through an account, payments to unexpected countries. An analyst reviews each alert and records a disposition. In the United States, cash transactions above 10,000 dollars trigger a separate currency transaction report regardless of whether anything looks odd.
Sanctions and watchlist screening
Screening sits across both worlds, which is part of why people muddle the terms. You screen at onboarding, which feels like KYC. You then rescreen the book whenever a list changes, which is a standing AML control with nothing to do with the customer file. The OFAC Specially Designated Nationals list is the best known source, and our guide to denied party screening and the OFAC SDN list covers how it is structured. Sanctions screening is also a legal obligation in its own right. It does not sit under the risk-based approach in the way customer diligence does.
Suspicious activity reporting
When suspicion crystallises, someone files a report with the national financial intelligence unit. In the United States that is FinCEN. In the United Kingdom it is the National Crime Agency. FATF Recommendation 20 requires countries to put this duty on regulated firms. The filing decision belongs to a named officer, and tipping the customer off is a criminal offence in most jurisdictions.
Governance, training and independent testing
A written business-wide risk assessment, approved at board level. A named compliance officer. Staff training with evidence of who took it and what version they took. An independent review of the programme by someone who does not run it. None of this touches a customer record. All of it is examined at inspection. Practical guidance on the training piece is in our note on building effective compliance training.
The programme mapped, element by element
| Programme element | KYC or wider AML | Usual owner | Evidence it produces |
|---|---|---|---|
| Customer identification and verification | KYC | Onboarding team | Identity documents, verification result, date and checker |
| Beneficial ownership | KYC | Onboarding team | Ownership chart, registry extracts, percentage working |
| Customer risk rating | KYC, method set by compliance | First line, methodology by second line | Scored rating and written rationale |
| Sanctions and watchlist screening | Both | Screening function or automated system | Screening log, match decisions, discounting notes |
| Transaction monitoring | Wider AML | Financial crime operations | Alerts, dispositions, rule tuning records |
| Suspicious activity reporting | Wider AML | Named reporting officer | Filed reports and the internal escalation trail |
| Business-wide risk assessment | Wider AML | Compliance, approved by the board | Written assessment with a dated refresh |
| Training | Wider AML | Compliance with HR | Attendance, assessment scores, content version |
| Independent testing | Wider AML | Internal audit or external reviewer | Audit report, findings, remediation log |
Who owns which part
Most regulated firms run a three lines model. The first line is the business: sales, onboarding, relationship management. They collect the KYC and they own the customer. The second line is compliance. It writes the policy, sets the risk methodology and challenges the first line. The third line is internal audit, testing whether the first two actually did what the policy says.
KYC is mostly a first line job with second line rules. The rest of the AML programme is mostly second line, with one important exception: the suspicious activity report. That decision sits with a single named individual. In the United Kingdom this is the Money Laundering Reporting Officer. In the United States the equivalent role is usually called the BSA officer. Regulators will ask who holds that role by name and how they are supported.
How KYC data feeds the rest of the programme
This is the connection most articles skip, and it is where real programmes break. KYC is not a filing exercise. Its output is an input to three other controls.
- The expected activity profile you capture at onboarding becomes the baseline that transaction monitoring compares against. A vague profile produces meaningless alerts.
- The customer risk rating sets the monitoring thresholds and the review cycle. Rate a customer wrong and the wrong rules run against them for years.
- The beneficial ownership chart determines who gets screened. If you only screened the account holder, you never screened the person who actually controls the money.
That third point is where trade and payments firms get caught. You can run a clean customer file and still deal with a restricted party, because the restriction attaches to an owner, a director or a shipping counterparty rather than the named account. A free denied party screening check against the whole set of parties in a transaction closes that gap.
Telling a KYC failure from an AML failure
The distinction matters when something goes wrong, because the remediation is completely different. Use a simple test. Ask whether the problem would have been visible in the customer file on the day of onboarding.
Missing passport copy, unverified address, no ownership chart, stale review date. Those are KYC failures. The fix is file remediation, and it usually means contacting a population of customers and refreshing records. It is slow and it annoys customers, but it is bounded.
Alerts closed without a reason, monitoring rules never tuned, no training records, a report that should have been filed and was not. Those are wider AML failures. The fix is a programme change, often with a lookback exercise across historic activity. Lookbacks cost far more than file remediation. Supervisors treat them as a more serious finding, because they suggest the control environment itself was not working.
The trade compliance overlap
Exporters and freight businesses often sit outside AML supervision but face a parallel duty. There is no reporting officer and no transaction monitoring system, yet the screening obligation is real and the penalties are civil and criminal. The trade version of customer diligence is restricted party screening across buyers, consignees, freight forwarders, banks and end users.
The same structural logic applies. Screening at onboarding is not enough on its own. Lists change, ownership changes, and a party that cleared in March can appear in October. Our guidance on sanctions screening in customer onboarding sets out where the checks belong in the workflow, and Globalior’s free screening tool runs the check against consolidated government lists without a subscription.
What an examiner asks for
A KYC file review and an AML programme review are separate exercises with separate document requests. Knowing which one you are in tells you what to prepare.
For a file review the examiner pulls a customer sample and asks for identity evidence, the ownership structure, the risk rating with its rationale, the screening result and the date of the last review. For a programme review they ask for the business-wide risk assessment, the policy with its version history, monitoring rule documentation, alert statistics, training records, the reporting officer’s annual report and the last independent audit.
Both reviews turn on whether decisions were recorded at the time. A screening hit that was correctly discounted but never documented looks identical to a hit that was ignored. Our notes on what an audit trail is and on resolving false positives in screening cover the standard of evidence expected.
Key takeaways
- KYC is a set of customer-level controls. AML is the programme containing those controls plus monitoring, reporting, governance, training and audit.
- FATF Recommendation 10 defines the four components of customer due diligence: identify the customer, identify the beneficial owner, understand the relationship, and monitor it over time.
- Sanctions screening belongs to both. It runs at onboarding as part of the customer file and continuously as a standing control.
- KYC output drives the rest of the programme. The risk rating sets monitoring thresholds and review cycles, and a wrong rating misdirects years of monitoring.
- The EU and UK typically use a 25 percent beneficial ownership disclosure threshold, while sanctions ownership tests are stricter and catch entities that a KYC test clears.
- A KYC failure is fixed through file remediation. A wider AML failure usually triggers a lookback, which costs more and is treated more seriously.
- Businesses outside AML supervision, including exporters and forwarders, still carry restricted party screening duties with civil and criminal exposure.
Frequently asked questions
Is KYC part of AML or the other way round?
KYC sits inside AML. Anti-money laundering is the umbrella obligation placed on regulated firms by national law, and Know Your Customer is the customer-facing control that feeds it. You cannot have a compliant AML programme without KYC. You can have thorough KYC and still be nowhere near AML compliant, because monitoring, reporting and governance are missing.
What is the difference between KYC and CDD?
In practice they describe the same work. Customer due diligence is the term used in law and in FATF Recommendation 10. Know Your Customer is the industry phrase for the same activity. CDD also comes in graded forms: simplified for demonstrably low-risk relationships, standard as the default, and enhanced for higher-risk customers such as politically exposed persons.
Does a non-financial business need AML or just KYC?
It depends on whether your sector is designated in national law. Many jurisdictions bring in lawyers, accountants, estate agents, casinos, trust and company service providers, high-value goods dealers and virtual asset firms. If you are designated, the full programme applies, not only the customer checks. If you are not designated, sanctions and export control screening duties can still apply to you.
How long do KYC and AML records have to be kept?
Five years after the relationship ends or after the transaction is the common baseline across FATF-aligned jurisdictions, and several set longer periods for particular record types. Check the rule that applies where you are regulated. Keep the decision evidence, not only the documents, because the reasoning behind a risk rating or a discounted screening hit is what examiners actually test.
Who is responsible for AML compliance in a company?
The board owns it, and a named officer runs it day to day. The title varies by country, commonly Money Laundering Reporting Officer or BSA officer. That person decides whether a suspicious activity report is filed. Business teams still own the customer relationship and the accuracy of the KYC file, so responsibility is shared rather than delegated away.
Does sanctions screening count as KYC or AML?
Both, and it also stands on its own. Sanctions law applies to every person in a jurisdiction, regulated or not, which makes it broader than either label. Within a regulated firm the onboarding screen forms part of the customer file, while rescreening the portfolio after list changes is a standing AML control with its own logs and its own owner.
Can KYC be automated?
Identity verification, registry lookups and list screening automate well. Beneficial ownership analysis on complex structures and the final risk rating usually still need a person, because the judgement is about intent and plausibility rather than data matching. Automation shifts the work rather than removing it, so budget for alert review capacity when you switch a manual process on.
If you are mapping your own controls and want a second opinion on where the gaps sit, get in touch with the Globalior team. You can also start with the free denied party screening tool and see what your current counterparty list returns.