In 2022, FinCen fined the USAA Federal Savings Bank $140M for failing to implement and maintain an anti-money laundering (AML) program. KYC and AML compliance are no joke, and not adhering to them could result in hefty fines and reputational losses for your company. Keep reading to learn about their respective requirements so you can be protected!
Trustpair helps you comply with AML laws by constantly checking your vendor data and making sure you’re not sending money to shady businesses. Request a demo to learn more!
KYC regulation: how does it work?
KYC requirements
Know Your Customer (KYC) is a process by which organizations do their customer identification. The goal: verify their identity to prevent fraud, money laundering terrorist financing, and other illegal activities.
The exact requirements for KYC depend on your jurisdiction, but the minimum tends to be:
- Full client name,
- Date of birth,
- Current address.
To be verified, customers need to submit proof of the above elements, for instance by providing a recognized form of ID. Identity verification is the organization’s responsibility and a part of the AML regulations (more on that later).
When do organizations have to do KYC?
KYC and AML compliance happen before and during the relationship with third parties. For the Know Your Customer process specifically, businesses have to check their authenticity before starting their contractual relationship.
The 3 main cases when an organization is required to complete the KYC process are:
- During onboarding, when a new relationship begins between the client and the organization (or a company and its suppliers in the case of KYS). That means that in theory, for the targeted organizations, no business can happen until the KYC process is completed. For example, banking platforms can’t officially open a bank account for their clients until their identity has been verified.
- When the transaction exceeds the threshold amount defined by AML policies.
- When there are suspicions of financial crime or illegal activity.
It’s good practice to do it more often, which is why you’ll find some organizations that do the KYC process every 6-12 months, as a condition to keep working together. As their responsibility (and reputation) are on the line, they want to protect themselves against changes.
Anti Money Laundering Law: a quick overview
What are AML regulations?
AML Anti Money Laundering regulations are here to protect the financial industries (and those who do business with it) from fraud and prevent money laundering.
According to a UN report, money laundering accounts for 2 to 5% of the World’s GDP — which amounts to about 2 trillion dollars! AML laws are here to prevent money laundering financial crimes, which negatively impact all of us.
To prevent this, financial institutions must develop their own AML program that meets the requirements of the location(s) they operate in. Various economic zones and countries have different regulations, such as:
- The Bank Secrecy Act in the United States.
- The Money Laundering Terrorist Financing and Transfer of Funds Regulations in the UK.
- The Anti Money Laundering and Countering the Financing of Terrorism (AML/CFT) policy in the EU.
Each country or region has its own specificities when it comes to AML compliance. Local government agencies often produce more guidelines to clarify or add to the existing AML regulations.
What are the AML requirements?
While AML regulations are specific to where businesses operate, some requirements are common:
- Customer Diligence (or KYC process),
- Enhanced Diligence EDD,
- Risk management,
- Suspicious activity reports,
- Ongoing monitoring of transactions and record keeping,
- Internal AML compliance program which includes:
- Staff training,
- Internal control,
- The appointment of an AML officer.
In other words and to simplify, regulated businesses must come up with their own AML policy that meets the requirements of their local AML regulations. They report to their designated AML regulatory entity to whom they must send any suspicion of financial crimes.
Which businesses are regulated by AML?
Who exactly falls under AML regulations varies once again depending on the jurisdiction where a business operates. But in most cases, the following organizations need to show compliance:
- Financial institutions businesses (including baking and crypto platforms),
- Insurance companies,
- Payment institutions,
- Gambling service companies,
- Credit institutions,
- Art dealers.
Virtual Assets Service Providers (VASPs) — a term used to describe companies dealing with digital assets like cryptocurrencies — can fall under AML obligations or not, depending on the country. In North America, the UK, and France, they must meet AML requirements. In some other countries, they are unrecognized by law or strictly banned.
What are the key differences between KYC and AML?
KYC and AML compliance are terms often used interchangeably as they have the same goals:
- Assessing the potential risks of a business’ operations
- Stopping any terrorist financing or illegal activities.
However, the main difference between KYC and AML is their scope. The Know Your Customer KYC process is one measure of the overall AML policy. It’s one of the common requirements that organizations must meet to be AML compliant — but it’s not the only one.
If we had an AML puzzle (it sure feels like sometimes!), the KYC would be only one piece of it.
In organizations that are both subject to KYC and AML compliance, the whole compliance process for customers would look like this:
| Process | KYC | AML | Both |
|---|---|---|---|
| Goal | Verify the client’s identity | Clients due diligence | Ongoing Monitoring |
| Actions | Asking and processing client’s ID and personal info (usually done through an automated third party)
Storing personal data following data protection laws Informing customer of next steps |
Ensuring your clients aren’t on the Politically Exposed Persons (PEP) list
Identifying the Ultimate Beneficial Owner (UBO) Checking your clients or their UBO isn’t on a sanction or watchlist or isn’t otherwise “high risk” |
Monitoring clients for changes in circumstances or personal info
Carrying out a continuous risk assessment Reviewing processes regularly |
Note that this process is for the customer side only. AML requires many other steps, such as supplier due diligence, risk assessment, internal training, and control.
KYC and AML compliance: why are they both important?
As we’ve seen, both KYC and AML work hand in hand in organizations. Here’s why they are important to follow:
Reducing legal and reputational risks
By ensuring KYC and AML compliance, you save yourself from being fined by various AML authorities. As we’ve seen earlier, those fines can get pretty big, pretty quickly (we’re talking several millions here!).
Not only would you be losing money on paying fines, but it would hurt your reputation. AML cases are reported on in the press and that’s not the kind of PR that brings in customers.
On the contrary, by not being compliant, your organization risks damaging its reputation and losing customers, suppliers, and partners.
Preventing fraud
The ultimate goal of AML and KYC isn’t only to be compliant. It’s also to prevent your business (and clients) from being involved in fraud schemes.
Nowadays, criminals come up with very elaborate schemes to get you to reveal sensitive information that will lead to financial fraud targeting:
- Your company directly,
- Your clients,
- Your suppliers.
For example, your employees could be involved in a money laundering scheme. One way that can happen is through vendor fraud when someone sends fake invoices that then get paid by your company. Without proper supplier verification, this can easily happen.
Thankfully, compliance with KYC and AML prevents that. But only if you remember one essential element: compliance isn’t an action you do once and forget.
Even after onboarding, you need to be on your guard and remain proactive about preventing fraud — both with your clients and your suppliers. That’s where our anti-fraud software comes in.
Trustpair helps you prevent supplier fraud by automating your account validation. Our solution continuously checks your suppliers’ credentials in real-time, so you always know who you’re sending payments to.
It’s also safer and quicker than manual processes. Your finance teams can spend time on higher-value tasks while being confident that your business is fully compliant and protected against fraud.
Using Trustpair is the best way to:
- Remain compliant with AML regulations,
- Protect your business from fraud.
We help you streamline and secure your account verification process and eradicate the risk of third-party fraud.
Key Takeaways:
KYC is one piece of the AML policy that organizations must adopt to remain compliant and prevent fraud. They work together to prevent the financing of illegal activities. Using Trustpair is the best way to remain compliant with AML regulations. Our anti-fraud software automatically checks your suppliers’ data, ensuring you are sending funds to the right recipients.
