In short: KYC verifies the identity of a person or company; AML is the wider system that ties this verification data to ongoing monitoring and reporting duties. KYC supplies the data foundation on which AML controls and risk ratings are built in the first place. Treating the two as separate overlooks exactly the gap where money laundering and sanctions breaches arise.
In brief:
Continuous monitoring is essential for AML, since suspicious patterns can appear years after an account is opened.
Incomplete KYC documentation raises the risk of operational problems, while weak monitoring leads to liability or regulatory consequences.
The European AML regulation tightens identification duties and creates a central supervisory structure for cross-border business.
Automated tools reduce errors and manual work, but do not replace expert judgement in complex cases.
Regular updating and documentation of all KYC and AML measures are indispensable to remain transparent for any audit.
What is Anti-Money Laundering (AML)?
AML covers the full set of measures by which companies and financial institutions seek to prevent money laundering, terrorist financing and corruption. It is not a single check but an ongoing programme of governance, controls and reporting channels.
The core of an AML programme consists of several building blocks. These include an internal governance structure with clear responsibilities, systematic transaction monitoring that flags unusual payment patterns, and the duty to report suspicious activity to the competent authorities through so-called Suspicious Activity Reports (SARs). On top of that comes screening against sanctions lists and lists of politically exposed persons, PEPs for short.
According to LSEG, KYC is only a specialised part of the broader AML framework: KYC focuses on identity and beneficial ownership, while AML additionally covers monitoring, sanctions screening and the reporting of suspicious activity.
The time dimension matters. AML does not end at account opening. A client who looks unremarkable today may show a very different transaction pattern a year later, for example through new business partners in high-risk countries or a sudden rise in transfer volumes. For this reason modern AML programmes require ongoing monitoring rather than one-off checks.
What is Know Your Customer (KYC)?
KYC refers to the process by which companies establish and verify the identity of natural and legal persons before and during their business dealings. For companies this also includes identifying the beneficial owners behind the structure.
KYC distinguishes between Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD). CDD is the standard check: name, date of birth, address, ID document, and for companies the commercial register extract and the ownership structure. EDD applies where the risk is higher, for example with politically exposed persons, clients from high-risk jurisdictions, or unusually complex corporate structures. Under the FATF recommendations, due diligence must as a rule take place before the business relationship begins. Delayed verification is permitted on narrow conditions, provided no transactions have yet occurred.
In practice KYC today relies heavily on digital processes, so-called eKYC: automated document checking, video identification and database matching speed up onboarding considerably, but they do not replace expert judgement in complex cases, and client-communication tools such as review-management software further improve usability.
Key differences between KYC and AML: a compact comparison
KYC and AML are often used interchangeably, but they describe different scopes. KYC is a subset; AML is the overarching system with its own reporting duties.
- Scope: KYC checks identity and ownership structure; AML additionally covers monitoring, sanctions screening and reporting.
- Timing: KYC takes place mainly at onboarding and on defined triggers; AML runs continuously throughout the client relationship.
- Objective: KYC answers the question „Who is this client?“; AML answers „Is this client behaving suspiciously?“.
- Consequences: An incomplete KYC file leads to rework; missing AML reporting can trigger regulatory fines.
For operational compliance this means: a company can keep a clean KYC file and still have an AML problem, for example if transaction patterns are not monitored. Conversely, the best monitoring is of little use if the underlying identity data is wrong or outdated. The two systems only work together.
How KYC and AML interact across the client lifecycle
The link is clearest along the client relationship. At onboarding the Customer Identification Program (CIP) comes first: establish identity, check documents, assign an initial risk rating. This rating determines how closely the client is monitored later.
After onboarding the monitoring phase begins. Transactions are compared against expected patterns, and watchlists and sanctions lists are rerun at regular intervals, since a person can be placed on a sanctions list later without any change in their account activity.
When something stands out, for example a transaction that does not fit the known business model, internal case handling follows: a compliance team reviews the matter, requests further documents if needed, and decides whether a report to the competent authority is required. This SAR filing is where KYC data and AML monitoring actually meet: without the original identity check, a suspicious transaction could not be tied to a person at all.
AML/KYC process: practical steps, tools and roles
A working compliance programme allocates tasks clearly: the compliance officer owns policies, escalation and reporting; the front office carries out the initial check at client contact; and the IT or data team keeps screening systems and databases up to date.
A typical case runs like this:
- The client submits identity documents and, for companies, evidence of the ownership structure.
- A screening tool matches the data against sanctions and PEP lists.
- The system assigns the client a risk category, for example low, medium or high.
- Where the risk is elevated, enhanced due diligence with additional documents applies.
- After approval, ongoing monitoring begins and automatically compares transactions with the expected client profile.
- Alerts land in a case-management system for manual review.
The tools used typically cover three functions: list screening, continuous transaction monitoring and case management. According to Thomson Reuters, using RegTech solutions reduces manual effort and the number of false hits, but at the same time raises the demands on data quality and the traceability of decisions.
Pro tip: document every risk decision as if you had to explain it to an auditor a year later, because at some point that is exactly what will happen.
A few metrics help steer a programme: the false-positive rate at screening, the average lead time until a client is cleared, and the number of escalated cases per month. These figures show whether a programme runs efficiently or whether resources are being wasted on avoidable rework.
Regulatory framework and standards: FATF, EU and national rules
The international basis for KYC and AML is set by the Financial Action Task Force, FATF for short. Its recommendations are the globally recognised standard and require, among other things, Customer Due Diligence, a risk-based approach, and reporting duties for suspicious activity. Most national statutes follow this framework but implement it with their own thresholds and procedures.
At EU level, the new EU regulation on the AML/CFT framework tightens the requirements on so-called obliged entities, i.e. companies with reporting and due-diligence duties, and creates a supranational supervisory structure. For companies active within the EU this means stricter requirements for identifying beneficial owners and for cross-border reporting.
An important point for companies with international operations: national implementations differ, sometimes considerably, for example in the thresholds for enhanced due diligence or in the definition of politically exposed persons. Companies active across several jurisdictions, for example with ties to Switzerland and the EU at the same time, should take the stricter rule as the benchmark and, in case of doubt, have it checked legally which national provision actually applies.
Challenges and best practices for companies
The most common problems in practice are rarely regulatory, but operational. Poor data quality causes screening systems to miss hits or, conversely, to flood users with false ones. High false-positive rates tie up staff who are actually needed for real risk cases. And the balancing act between the duty to monitor and data protection, for example under the GDPR or the revised Swiss FADP, calls for careful weighing.
A few clear principles have proven their worth:
- Follow a consistently risk-based approach rather than applying uniform depth to all clients.
- Document every decision and its reasoning without gaps.
- Train staff regularly on new typologies and sanctions regimes.
- Have the programme tested periodically by independent audits.
Automation helps where it takes over repetitive matching, for example in the first round of list screening. It does not replace expert judgement in borderline cases, and every automated decision has to remain traceable afterwards; otherwise it becomes a risk at the next audit rather than a relief.
Practical checklist: when and how to perform KYC
KYC is not a one-off tick-box at onboarding. Certain events trigger a renewed check, regardless of how long the business relationship has existed.
- At onboarding: full identity check and initial risk rating before the business relationship begins.
- For transactions above defined thresholds: additional check on the source of funds.
- On negative media reporting about the client: immediate reassessment of the risk profile.
- On changes to the legal form or ownership structure: full update of the KYC file.
- At regular intervals, depending on the risk category: high-risk clients more often, standard clients less often.
Minimum documentation consists of a valid proof of identity, for companies the current commercial register extract, and a traceable justification for the assigned risk category. These documents should be filed so that a supervisory authority can follow them at any time without having to ask questions.
Law-firm perspective: cross-border and sanctions aspects
Cross-border mandates sharpen the risks noticeably. A politically exposed person in one country may not appear as such in another register, and sanctions lists change more often than many companies reflect in their monitoring cycle. Mandates with ties to Eastern Europe in particular show how quickly an unremarkable business partner can become a compliance risk through a new round of sanctions.
In such cases we support companies with sanctions checks, documentation of beneficial owners, and legally sound contract drafting in several languages. Advice in several languages makes it possible to assess cross-border matters more precisely, for example where original documents come from Ukraine or Russia. How sanctions risks play out concretely for company formations with ties to Ukraine or Russia often only emerges in the detailed review of contractual partners.
Personal view: why companies should take KYC and AML seriously
In our experience many companies underestimate how quickly a sanctions situation can change and how expensive a missed PEP link can become. Those who only take sanctions and KYC checks seriously once an authority starts asking questions usually pay significantly more, in fines and in reputation, than a timely check would ever have cost.
— Bitblade
Support with KYC and AML matters
When a sanctions check, a contract with international elements, or a company formation with foreign ties is on the agenda, it pays to look at our services before an authority starts asking the questions instead of an adviser. We review contracts and business relationships in several languages, which can be particularly helpful for sanctions compliance and mandates with ties to Ukraine or Russia.
An initial conversation starts with an initial consultation and assessment from CHF 150 per hour, from which we derive a concrete offer for contract review, sanctions due diligence or company formation depending on the case. You can find an overview of our international legal services on our service page.
This article contains general information and does not replace advice from a qualified financial adviser. Consult a qualified finance professional regarding your personal situation before acting on the basis of this content.
FAQ
What are KYC and AML?
KYC refers to verifying the identity of clients; AML refers to the broader system for preventing money laundering and terrorist financing. According to LSEG, KYC is a specialised subset of AML focused on identity and beneficial ownership, while AML additionally covers monitoring and reporting.
Which rules apply to KYC and AML?
Internationally, most states follow the FATF recommendations, which require Customer Due Diligence and a risk-based approach. In the EU, the new AML/CFT regulation tightens the duties further and creates a supranational supervisory structure.
When does KYC have to be performed?
KYC is carried out before a business relationship begins and renewed on certain events, for example large transactions, negative media reporting, or a change in the ownership structure. High-risk clients are typically rechecked more often than standard clients.
What does AML mean?
AML refers to the whole system of governance, transaction monitoring, sanctions screening and reporting duties by which companies seek to prevent money laundering and related offences. Unlike a one-off check, AML runs continuously throughout the duration of a client relationship.