KYC stands for know your customer and denotes the whole body of due diligence duties when taking on and maintaining a business relationship. At its core sit three questions: who is the contracting party, who stands behind them economically, and does the background of the relationship form a coherent picture. KYC is therefore not a form but a process.
The three components
The first component is identifying the contracting party through probative documents. The second is determining the beneficial natural person, which in nested structures is where the actual work lies. The third is understanding the business relationship: where the assets come from, what purpose the relationship serves, whether the expected transactions fit the stated background. Without the third part the first two are worth little, because plausibility cannot be assessed.
The risk-based approach
Not every relationship requires the same depth of review. The regimes follow a risk-based approach: the higher the risk of a relationship, the more extensive the enquiries. Risk-increasing factors typically include complex or opaque structures, links to high-risk jurisdictions, unusual transaction patterns, or the involvement of politically exposed persons. The approach requires that the risk rating itself be reasoned traceably — a blanket low rating without justification is exposed under review.
Onboarding is only the start
The most common misconception is that KYC ends with onboarding. In fact ongoing diligence begins there. Details go stale, ownership changes, identity documents expire, and a person’s status as politically exposed can change with an election or appointment. Periodic reviews are therefore provided for, with a rhythm set by the risk rating. In practice the burden lies not in onboarding but in those recurring controls.
Why evidence counts rather than intent
Toward a supervisor, an auditor or a bank, what counts is not that an enquiry was made but that it can be evidenced. A conscientiously conducted but undocumented review stands worse than an average one with complete evidence. A process that produces the evidence as a by-product — audit trail, versioned documents, recorded reasoning — is therefore more effective than any effort to assemble evidence after the fact.
The practical bottleneck
In family offices and trustee practices, KYC rarely fails for lack of diligence. It fails on dispersion: the onboarding file on a drive, screening results in a mailbox, the deadline list in a spreadsheet, the correspondence with the responsible employee. There is an answer to every individual question, but the connection must be re-established by hand at every review. That connection is exactly what a structured system supplies.
Boundary to legal assessment
KYC tools structure the process, hold evidence and make due controls visible. The judgement whether to enter, continue or end a relationship, whether a report must be filed, and what measures elevated risk requires, remains the task of the responsible person. A system provides decision support, not legal advice — and that boundary should be expressly recorded in your own organisation.