Know your customer in brief

Every financial institution must thoroughly screen its customers

They must screen them in advance and carefully monitor them afterwards. Through client due diligence the client is identified (are you who you say you are?) and screened (can you pose a risk?). Once onboarded, the client and all his financial transactions are permanently monitored. This is the Know Your Customer (KYC) principle often also referred to as CDD (Customer Due Diligence).

Mandatory for all financial institutions

KYC is a basic principle within the financial services industry. In the Netherlands, this is laid down in the Financial Supervision Act (Wft) and is elaborated in the Money Laundering and Terrorist Financing (Prevention) Act (Wwft). All financial institutions - not only banks and payment institutions but also, for example, insurers and investment advisors - must report suspicious situations and customer transactions to the regulators. This prevents money laundering, fraud, tax evasion or the financing of criminal or even terrorist activities through the financial institution. An adequate KYC policy contributes to reliability and security in trade, economy and payments. Good screening and monitoring is also important for the financial institutions themselves in order to avoid integrity risks and reputational damage.

How does this affect you as a customer?

A financial service provider asks for your background, intentions and motives. The depth of the screening differs between private individuals and companies and depends on the risk category you fall into: a simple screening and monitoring for low-risk clients and more rigorous screening for clients with a higher risk profile. Depending on the outcome of the screening you will be accepted as a customer or not. After successful acceptance, monitoring starts.

Usually you won't notice anything, unless something suspicious or unusual comes out of the monitoring. The service provider will then contact you to verify an action from your account. If you cannot explain it properly, your risk profile can be adjusted or, in extreme cases, the customer relationship can be terminated.

Example money mules

Think, for example, of a young, low-risk retail client who, who is tempted to transfer unusual sums of money outside his risk profile, to other accounts. If the subsequent client investigation indicate that he or she acted as a money mule then this usually means that he or she is immediately rejected as a client.

Example signal lists

Another example which is relevant for both the retail and business customers involves screening of persons and entity representatives e.g. Ultimate Beneficial Owners (UBO’s) and pseudo UBO’s against public signal list provided by the supervisory authorities and or proprietary internal alert lists. If screening results in a hit then the transactions performed by that person or entity will be flagged for further detailed thorough investigation. If substantiated the transactions will be blocked and authorities will be notified and appropriate corrective actions will be taken.

Investigations by a financial institution feels like an invasion of your privacy and a lack of trust. Especially when you have a longer customer relation with your bank or payment service provider. However, it is a necessary evil which is driven by regulatory compliance. But always check the privacy statement of your payment service provider to check how they handle your personal data and which GDPR safeguards are built in to prevent abuse.

 

Behind the scenes when screening new clients

During identification, a customer's identity is verified for authenticity. According to the law, this must be done using valid and authentic documents, data or information from a reliable and independent source, such as a passport or driver's license. Does the information contained in those documents match the information provided by the customer? Are those documents not forged or stolen? Is any represented data (e.g. photo) in those documents correct?

Nowadays, identification can also be done remotely using innovative digital technologies. For example, a bank can often accept you as a customer within one day or even in a couple of minutes and you can settle your first banking transactions immediately. This poses extra digital challenges for identity- and integrity proofing processes namely, keeping the balance between user-friendly verifications and security.

Example opening a bank account using innovative technologies

If you want to open a bank account, for example, you can scan your identity card, after which the identity is verified using a (live) video connection for a so-called attestation de vita, proof that the customer is alive and is the rightful owner of the ID document.

If the Bank is unable to carry out one of the components of the customer due diligence, or the investigation does not lead to the required result, no relationship can be entered into with the customer.

Example screening companies

Screening of companies require verification of more data points relatively to retail customers. When screening companies, in addition to the identification of directors and UBO’s, data about the company and its activities are also checked: extract from the Chamber of Commerce, ownership and control structure, legal structure, industry benchmark, earnings model, financial figures, competitive position, etc. The screening results in a risk profile and acceptance or rejection of the client.

Schematic representation screening

 

Behind-the-scenes monitoring of existing customers

After the customer has been accepted, the financial institution then monitors its transactions and activities for suspicious or unusual situations. These situations may include amounts, times, locations and devices used. Do the transactions fit the customer's risk profile and do the activities not deviate too much from what is customary for this customer? In that case, data from before, during and after the transaction is taken into account. Nowadays, financial institutions increasingly combine information obtained internally with data from public sources.
A well-known example is that a bank finds that a customer carries out transactions from the Netherlands and from a faraway country very shortly after each other. The bank then calls this customer for verification.

Schematic representation monitoring

Developments

Because of the large amounts of data needed for good monitoring, institutions use a lot of computer power. This is necessary to efficiently and effectively search large amounts of unstructured data for unusual or suspicious patterns and to be able to make predictions. This is done with artificial intelligence (AI), for example, focusing on big data analytics and behaviour analytics.
Financial institutions realize that customer impact from screening and monitoring must be kept at a minimum. They do not want customers to become irritated by this and drop out. That is why they are constantly working on solutions that comply with legislation and regulations and are user-friendly at the same time. New techniques help in this respect: video identification, biometrics, scanning identity documents, etc.

The legislation underlying Know Your Customer

The Nederlandsche Bank (DNB) supervises compliance with the Wwft. Among other things, it checks whether the policies and procedures for KYC and Customer Due Diligence of the financial institution comply with the Wwft. DNB also checks whether the institution complies with its own policies and procedures. The Wwft is based on the European Anti-Money Laundering Directive (AMLD). In the amended AMDL-4 directive it is allowed to use eIDs that comply with eIDAS for ID verifications.

The Sanctions Act is linked to the Wwft. It deals with sanctions against certain states, territories or persons, such as the freezing of assets.