What is KYC?

KYC (Know Your Customer) means “know your customer” and is a term used in AML/compliance practice to describe the process of understanding the customer, confirming their identity, and assessing the risk associated with the relationship. KYC is not limited to checking an identity document. It also includes collecting the information needed to understand who the customer is, what the purpose and nature of the relationship are, and whether the information held remains up to date throughout the relationship.

The Polish AML Act does not define KYC as a separate procedure. The elements commonly associated with KYC arise primarily from the provisions concerning customer due diligence measures, including, among other things, customer identification, verification of the customer’s identity, assessment of business relationships, and their ongoing monitoring. KYC is therefore a process of understanding and assessing the customer, not a one-off check of their data during onboarding.

What does KYC involve?

The purpose of KYC is to collect and analyse information that allows an obliged institution to understand who it is entering into a relationship with and what AML/CFT risks may be associated with that relationship. In simplified terms, the process can be presented as:

understanding the customer → collecting data → verification → understanding the purpose of the relationship → risk assessment → decision → monitoring and updating.

In practice, KYC may include, among other things:

• collecting the required customer data;
• identifying the customer;
• verifying the customer’s identity;
• understanding the purpose and intended nature of the relationship;
• collecting information necessary for risk assessment;
• using appropriate screening mechanisms as part of the broader AML process;
• documenting the actions performed and the assessment made;
• updating information throughout the relationship.

The scope of the activities performed should not be identical in every case. In the AML framework, customer due diligence measures are applied taking into account the identified risk. Relevant factors may include, among other things, the type of customer, the nature of the relationship, the products or services offered, geography, the way in which services are used, or transactional activity. This does not mean that every customer should provide exactly the same set of documents or additional information. Identity confirmation is one element of KYC, not the entire process. The information collected should lead to an assessment of the customer and the relationship, rather than merely to the completion of a form.

What is the difference between customer identification and identity verification?

Identification and verification are directly related, but they refer to two different activities.

Customer identification consists of establishing the required information about a person. In the case of a natural person, depending on the circumstances and statutory requirements, this may include, among other things, first name and surname, citizenship, PESEL number or the relevant substitute data, identity document details, or information concerning business activity. At this stage, the institution therefore determines who the customer is and what data identify them.

Identity verification, on the other hand, consists of confirming the previously established data on the basis of a document, data, or information obtained from a reliable and independent source. Put simply:

identification = establishing the data
verification = confirming that data

If a customer provides their first name, surname, and PESEL number, this forms part of identification. The relevant data are then confirmed using a reliable and independent source – this is verification. Verification does not always have to involve physically presenting a document at a branch. Depending on the solution adopted and the applicable requirements, appropriate remote or electronic methods may be used.

When is KYC applied and updated?

KYC is particularly important before starting a relationship with a customer, but it is not limited to the onboarding stage. Customer due diligence measures are applied, among other things, when:

• establishing a business relationship;
• carrying out certain occasional transactions;
• there is a suspicion of money laundering or terrorist financing;
• there are doubts as to the veracity or completeness of previously obtained customer identification data.

The process does not, however, end once the relationship has begun. Ongoing monitoring of the relationship also includes ensuring that the documents, data, and information held remain up to date. Relevant factors may include, among other things:

• a change in the customer’s data;
• a change in the nature or purpose of the relationship;
• a change in the way products or services are used;
• a new or unusual activity profile;
• a change in the level of risk;
• the emergence of new information relevant from an AML/CFT perspective.

There is no single universal rule under which every customer must undergo the full KYC process again exactly every 6 or 12 months. The manner and frequency of updates should take into account the risk and changes occurring within the relationship. A customer with a stable profile may require a different approach than a customer whose business activity, use of services, or risk profile has changed significantly.

KYC is not a snapshot of the customer taken on the day of onboarding. Knowledge of the customer should remain up to date throughout the entire relationship.

KYC vs KYB and AML – what is the difference?

KYC, KYB, and AML are related, but they do not mean the same thing.

Term	Main meaning
AML	the entire system for counteracting money laundering and terrorist financing
KYC	understanding, identification, verification, and assessment of the customer
KYB	the process of understanding and verifying a business customer, including its structure and representation

AML is the broadest concept. It covers the entire system of activities related to identifying and mitigating money laundering and terrorist financing risks, including customer due diligence measures, risk assessment, screening, monitoring, alert analysis, escalation, and other obligations arising from applicable regulations.

KYC is one element of this system and focuses on understanding and assessing the customer.

KYB (Know Your Business), on the other hand, is a term used in practice primarily in relation to customers that are companies and other organisations. The process may include, among other things, analysis of the entity’s data, its representation, ownership and control structure, and beneficial owners.

The distinction between KYC and KYB is primarily industry-based and operational. The Polish AML Act does not establish two separate statutory procedures called KYC and KYB. Instead, it defines customer due diligence measures and the scope of information to be established depending on the type of customer.

Put simply:

AML is the entire system → KYC is understanding and assessing the customer → KYB is the practical extension of this process for a business customer.

KYC is part of AML, not a synonym for it.