What are KYC and AML, and why does every financial app want your ID?
Uploading a passport photo to open an account can feel intrusive. It is the visible end of a global rulebook designed to stop criminals from moving money through the financial system.
The short answer
KYC (know your customer) is the process of confirming who a customer is and why they want an account. AML (anti-money laundering) is the wider set of rules it belongs to, which also requires firms to monitor activity, keep records and report suspicious transactions to the authorities.
Key takeaways
- KYC is one part of AML: confirming identity, understanding the purpose of the account and keeping that information up to date.
- Global standards come from the FATF, founded in 1989; more than 200 countries and jurisdictions have committed to apply them.
- FATF standards prohibit anonymous accounts and require checks when a relationship starts and for large one-off transactions.
- In the US, the Bank Secrecy Act of 1970 and FinCEN's Customer Due Diligence rule set the core requirements.
- Firms must report some transactions automatically, such as cash over $10,000 in a day, and splitting cash deposits to avoid that report is a crime.
What do KYC and AML actually mean?
Money laundering is the process of making money from crime look legitimate, usually by passing it through ordinary bank accounts, payments and investments. AML (anti-money laundering) is the body of law and practice meant to stop that. It is usually paired with CFT, countering the financing of terrorism, so you will often see the label AML/CFT.
KYC (know your customer) is the front door of AML. Before a bank, payment app or broker lets you move money, it has to establish who you are and what the account is for. Regulators usually call this customer due diligence, or CDD.
The rules are layered. At the top, the Financial Action Task Force (FATF), set up in 1989 and based in Paris, writes international standards1. The FATF itself has 40 members, but more than 200 countries and jurisdictions have committed to implement its standards1. Its current Recommendations were adopted in 2012 and have been amended since2. Each country then turns them into national law, and supervisors check that firms follow it.
Figure · Who sets the KYC and AML rules
- L5FATF standardsglobal recommendations
- L4National lawe.g. US Bank Secrecy Act
- L3Regulators and FIUwrite rules, receive reports
- L2The firm's programmeKYC checks, monitoring, reports
- L1You, the customerID, details, answers
Why does a bank or app need to see my ID?
Because the standards say it must. FATF Recommendation 10 says financial institutions should be prohibited from keeping anonymous accounts or accounts in obviously fictitious names2. It requires due diligence when a business relationship begins, for one-off transactions above USD/EUR 15,000, for certain wire transfers, when there is a suspicion of money laundering or terrorist financing, and when the firm doubts identity information it already holds2.
The same recommendation lists four core measures. The table translates them into what you will actually experience when you open an account.
The four core due diligence measures and what they look like for a customer Source: [2]
| Measure (FATF R.10) | What the firm does | What you are asked for |
|---|---|---|
| Identify and verify the customer | Checks your identity against reliable, independent documents or data | Name, date of birth, address, an ID document, sometimes a selfie |
| Identify the beneficial owner | Finds the real people behind a company or trust | For a business: who owns and controls it |
| Understand the relationship | Learns the purpose and expected use of the account | Questions on job, source of funds, expected activity |
| Ongoing due diligence | Watches transactions and keeps records current | Occasional requests to update details or explain a payment |
What happens during identity verification?
Every firm designs its own process, but most sign-ups follow a similar path. Digital onboarding has made it faster, not lighter: the same questions get asked, just through an app.
A typical account-opening check
- 1
You give your details
Legal name, date of birth, address and, in many countries, a tax or national ID number.
- 2
You prove them
A photo of an ID document, often with a live selfie so the firm can match your face to the document.
- 3
The firm verifies
It checks the document and your details against independent sources, as FATF standards require2.
- 4
It screens and scores
Your name is checked against sanctions and politically exposed person (PEP) lists, and the account gets a risk rating. Foreign PEPs face enhanced checks2.
- 5
It keeps watching
After opening, transactions are monitored and your information is refreshed over time.
Tip
Why you might be asked again later
A request to re-confirm your address or explain a large transfer is usually ongoing due diligence, not an accusation. Answer through the firm's official app or website, never through a link in an unexpected message.
What does the US customer due diligence rule require?
In the United States, the foundation is the Currency and Foreign Transactions Reporting Act of 1970, better known as the Bank Secrecy Act (BSA)6. The Financial Crimes Enforcement Network (FinCEN), part of the Treasury, writes the rules under it.
FinCEN's Customer Due Diligence (CDD) rule became applicable on 11 May 20184. It covers banks, mutual funds, securities broker-dealers and certain futures firms3, and requires written procedures to identify and verify customers, identify and verify the beneficial owners of companies opening accounts, understand the nature and purpose of the relationship, and monitor on an ongoing basis to report suspicious transactions4.
A beneficial owner, for this purpose, is any individual who owns 25% or more of a company, plus one individual who controls it3. In February 2026, FinCEN gave firms the option of not re-verifying beneficial owners every time an existing business customer opens a new account, as long as other AML duties, including suspicious activity reporting, still apply5.
Figure · Milestones in KYC and AML rules
- 1970US Bank Secrecy Act
- 1989FATF established
- 2012Current FATF standards adopted
- 2018US CDD rule applies
- 2026FinCEN eases repeat checks
Which transactions get reported to the authorities?
Two kinds of report matter most. The first is automatic. US financial institutions must file a Currency Transaction Report (CTR) for cash transactions over $10,000 by or for one person, including several smaller cash transactions that add up to more than $10,000 in a single day7. A CTR is routine paperwork: FinCEN notes there is no general ban on handling large amounts of cash and the report is required whatever the reason for the transaction7.
The second is judgement-based. FATF Recommendation 20 says that a firm which suspects funds are linked to crime or terrorist financing should be required by law to report promptly to the country's financial intelligence unit (FIU)2. In the US this is the suspicious activity report, a duty built into the Bank Secrecy Act6. Firms also have to keep transaction records for at least five years under FATF standards2, so that investigators can follow the money later.
Risk warning
Splitting cash deposits is a crime in itself
In the US, breaking cash into smaller amounts to avoid a CTR is called structuring. Federal law makes it a crime even if the money itself is legitimate, with penalties of up to five years in prison and fines of up to $250,0007. If you need to deposit a large sum of cash, deposit it openly.
What mistakes do people make with KYC checks?
Common beginner mistakes
Using someone else's details
Opening an account in another person's name, or letting someone else use yours, defeats the purpose of KYC and usually breaks the account terms.
Treating a CTR as a red flag
Cash over the reporting threshold triggers a routine report. Trying to avoid it by splitting deposits is what creates a legal problem.
Sending ID through unofficial channels
A message asking you to send ID photos by email or chat may not come from your bank at all. Upload documents only inside the firm's official app or website.
Choosing a platform because it skips checks
A service that promises no identity checks may be operating outside the law where you live, which leaves you with little protection if something goes wrong.
Giving vague answers on purpose
Questions about your job or source of funds are part of the required checks. Unclear answers can delay or block an account.
Frequently asked questions
Is KYC the same thing as AML?
No. KYC is the identity and due diligence part. AML is the full framework around it, which also covers monitoring transactions, keeping records and reporting suspicious activity2.
What is a politically exposed person?
A PEP is someone who holds a prominent public role, such as a senior politician or government official. FATF standards require enhanced checks for foreign PEPs, including senior management approval and closer monitoring2.
Why do businesses have to name their owners?
How long can a firm keep my information?
FATF standards require transaction records to be kept for at least five years2. National data protection and retention laws decide the exact period and what happens afterwards.
Do crypto platforms have to do KYC?
Rules vary by country, and crypto services can fall under AML law where they operate. Our explainer on the FATF travel rule covers how international standards apply to crypto transfers.
The bottom line
KYC is the identity check you see; AML is the system behind it that monitors, records and reports. Both trace back to FATF standards that more than 200 jurisdictions have committed to, and in the US to the Bank Secrecy Act and FinCEN's due diligence rule. Answer checks honestly, upload documents only through official channels, and never split cash to dodge a report.
Sources
- Who we are — Financial Action Task Force (FATF) Primary source
- The FATF Recommendations: International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation — Financial Action Task Force (FATF), 2012 (as amended) Primary source
- CDD Final Rule — Financial Crimes Enforcement Network (FinCEN), U.S. Treasury, 2016 Primary source
- FinCEN Reminds Financial Institutions that the CDD Rule Becomes Effective Today — Financial Crimes Enforcement Network (FinCEN), U.S. Treasury, 2018 Primary source
- Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each New Account Opening (Order) — Financial Crimes Enforcement Network (FinCEN), U.S. Treasury, 2026 Primary source
- The Bank Secrecy Act — Financial Crimes Enforcement Network (FinCEN), U.S. Treasury Primary source
- Notice to Customers: A CTR Reference Guide — Financial Crimes Enforcement Network (FinCEN), U.S. Treasury Primary source
How we checked this page: every figure above links to the numbered source it came from. Spotted an error? Tell the desk — see our editorial policy.
Read next
Policy · ExplainerWhat is the FATF Travel Rule, and why does your crypto exchange ask who you are sending to?Banks have long had to pass on who is sending and receiving a wire transfer. Since 2019 the global anti-money-laundering standard has asked crypto firms to do the same, which is why exchanges now ask for a recipient's name.
Policy · ExplainerHow do sanctions apply to crypto? OFAC, wallet addresses and the Tornado Cash caseSanctions law does not care whether money moves through a bank or a blockchain. Here is how the US Treasury applies it to crypto, and why the Tornado Cash case became a test of its limits.
Policy · ExplainerHow do you check whether a financial or crypto firm is regulated?A licence number in a website footer proves nothing until you check it yourself. Official registers are free, public and take a few minutes. Here is which one to use and what to look for.
Fintech · ExplainerWhat is a neobank, and is your money protected in one?A neobank looks like a bank on your phone, but behind the app it may or may not be one. Who actually holds your money decides whether deposit insurance protects it, and how quickly you could get it back if something breaks.
Fintech · ExplainerWhy is sending money abroad still slow and expensive?Paying someone across town takes seconds. Paying someone across a border can take days and cost several percent of the amount. Here is where the money and the time go.