What Is KYC Verification? Meaning, Process and Requirements
What is KYC verification? How the KYC process works, from ID checks to ongoing monitoring, and what FATF and Southeast Asian regulators require.
Know Your Customer (KYC) verification is the set of checks a regulated business runs to confirm that a customer is who they claim to be and to understand the risk that customer poses. It means collecting identity data, verifying it against reliable, independent sources and keeping it up to date. The standards of the Financial Action Task Force (FATF) set the baseline, and each country sets its own detailed rules.
This article describes the institution’s obligation, not how a customer completes KYC in a particular app. Examples focus on the Philippines, Malaysia and Singapore; Indonesia, Vietnam and Thailand appear in the tables. Rules are national, and no single country’s approach should be read as the regional norm.
What does KYC mean?
KYC stands for Know Your Customer. It is the obligation to identify customers and understand the risk they pose, and it is one part of an anti-money laundering (AML) framework. FATF’s term for the measures involved is customer due diligence (CDD). “KYC verification” is often used for the identification and verification part and, in common usage, for the whole check; this article uses it for the whole check.
FATF standards call for identifying and verifying customers using reliable, independent source documents, data or information, and countries turn this into national anti-money laundering and combating the financing of terrorism (AML/CFT) rules. Those national rules, not the FATF standard itself, bind an institution.
The four core elements of KYC (FATF Recommendation 10)
FATF Recommendation 10 sets four CDD measures:
- Identify the customer and verify the customer’s identity using reliable, independent source documents, data or information.
- Identify the beneficial owner, the natural person who ultimately owns or controls the customer, and take reasonable measures to verify that person’s identity.
- Understand, and as appropriate obtain information on, the purpose and intended nature of the business relationship.
- Conduct ongoing due diligence and scrutiny of transactions throughout the relationship, including the source of funds where necessary.
FATF standards call for these measures when a business relationship is established, for certain occasional transactions, when money laundering or terrorist financing is suspected and when earlier identification data are in doubt. Some guides describe KYC as three components; FATF’s standard sets out four measures.
How the KYC verification process works
The steps below follow the four FATF measures and add screening, risk assessment and the decision. Order and detail vary by institution and country.
- Collect identity data. The institution collects the customer’s identity data. The items rules name differ by country, as the data table below shows.
- Verify identity. The data is checked against reliable, independent documents, data or information, in person or remotely. In Singapore, for example, the Monetary Authority of Singapore (MAS) treats Myinfo as a reliable and independent source, and in the Philippines the Bangko Sentral ng Pilipinas (BSP) treats the Philippine Identification System (PhilSys) in the same way. FATF standards call for verification before or during the establishment of the relationship; countries may allow it to be completed as soon as reasonably practicable afterward where risks are effectively managed and it is essential not to interrupt normal business.
- Identify the beneficial owner. Where relevant, the institution identifies the natural person behind the customer and takes reasonable measures to verify that person’s identity. FATF standards also cover beneficial ownership of legal persons (Recommendation 24).
- Understand the purpose. The institution establishes why the customer wants the relationship and what it is intended to be. Malaysia’s and Indonesia’s rules name purpose among the information to obtain.
- Screen. Sanctions screening and politically exposed person (PEP) screening are typically part of CDD under national rules; FATF standards cover PEPs in Recommendation 12.
- Assess risk. The assessment sets how deep the checks go: simplified, standard or enhanced due diligence, covered in the next section.
- Decide. The institution onboards, escalates or declines. If CDD cannot be completed, FATF standards say the institution should not open the account or start the relationship, or should end an existing one, and should consider filing a suspicious transaction report (STR).
- Monitor and update. Ongoing due diligence includes scrutiny of transactions and keeping data up to date through reviews, particularly for higher-risk customers. FATF standards also call for CDD on existing customers on the basis of materiality and risk.
Risk-based KYC: simplified, standard and enhanced due diligence
FATF standards call for the extent of CDD to follow a risk-based approach, so the depth of checks varies with the customer’s risk. The examples in FATF’s interpretive note are guidance, not mandatory elements.
| Tier | When it applies | Typical measures (FATF examples) | National examples |
|---|---|---|---|
| Simplified | Risk is lower and has been adequately analyzed; not where there is suspicion or a specific higher-risk scenario | Examples include verifying identity after the relationship starts, updating data less often and reducing monitoring | The policy document of Bank Negara Malaysia (BNM) allows simplified CDD where risks are assessed as low, except where there are higher risks or suspicion; Regulation No. 8 of 2023 of Indonesia’s Otoritas Jasa Keuangan (OJK) allows it after adequate risk analysis |
| Standard | Neither lower- nor higher-risk factors point to a different depth | The four CDD measures described above | BNM’s policy document names the data to obtain for standard CDD on individuals (see the data table) |
| Enhanced | Risk is higher | Examples include more information on the customer and the relationship, information on source of funds or wealth and on the reasons for transactions, senior-management approval, enhanced monitoring and more frequent data updates | OJK defines enhanced due diligence (EDD) as more in-depth CDD for high-risk customers, including PEPs |
Non-face-to-face relationships appear in FATF’s examples as a potentially higher-risk factor only where appropriate risk-mitigation measures have not been implemented. Remote KYC is therefore not automatically high risk.
What documents and data are needed for KYC?
The specific items come from national rules and the institution’s risk assessment. The table shows the data named for individual customers; the rules group information differently, so the lists are not like-for-like. For example, MAS Notice 626 sets out the purpose of the relationship in a separate paragraph, while the Malaysian and Indonesian lists include it, so the number of items does not show how much a country asks for. Thailand’s rule content is not described here.
| Country (rule) | Information the rule lists for identifying individual customers |
|---|---|
| Singapore (MAS Notice 626, for banks) | Full name including aliases; unique identification number; residential address; date of birth; nationality |
| Malaysia (BNM policy document) | Full name; National Registration Identity Card (NRIC), passport or other official document number; residential and mailing address; date of birth; nationality; occupation type; employer or nature of business; contact number; purpose of the transaction |
| Indonesia (OJK Regulation No. 8 of 2023) | Full name including alias; ID document number; address; place and date of birth; nationality; occupation; workplace address and phone; gender; marital status; mother’s maiden name; plus the beneficial owner, source of funds, income or net worth and the purpose of the relationship |
| Vietnam (AML law) | Full name; date of birth; nationality; occupation or position; phone number; ID, citizen ID, personal identification or passport number (for foreign residents, with the date and place of issue); residence |
| Philippines (BSP rules) | Name and/or the PhilSys number, among the minimum information; no full list is given here |
For companies, the process also covers beneficial owners; verifying businesses is the subject of Know Your Business (KYB).
KYC requirements in Southeast Asia: country snapshot
The table names the main instrument in each country. It describes which rules exist, not what each of them requires.
| Country | Regulator / FIU (where named here) | Main rule (current version) | Scope and limits |
|---|---|---|---|
| Philippines | Bangko Sentral ng Pilipinas (BSP); Anti-Money Laundering Council (AMLC), the financial intelligence unit | the Anti-Money Laundering Act of 2001 (Republic Act No. 9160), as amended, most recently by Republic Act No. 11521 (2021); BSP customer due diligence rules, as amended by Circular No. 1170 (2023) | BSP rules apply to BSP-supervised institutions; no full data list is given here |
| Malaysia | Bank Negara Malaysia (BNM) | BNM’s policy document on anti-money laundering, countering the financing of terrorism and proliferation, and targeted financial sanctions for financial institutions (BNM/RH/PD 030-14), in force since 6 February 2024 and replacing the version that took effect on 1 January 2020 | Applies to the financial institutions in its scope; the data items are for individual customers under standard CDD |
| Singapore | MAS; Suspicious Transaction Reporting Office (STRO), the financial intelligence unit | MAS Notice 626 for banks (last revised 30 June 2025), with parallel notices for other financial institutions | Notice 626 applies to banks; other notice numbers are not described here |
| Indonesia | Otoritas Jasa Keuangan (OJK); PPATK (Pusat Pelaporan dan Analisis Transaksi Keuangan), the financial intelligence unit | OJK Regulation No. 8 of 2023 on anti-money laundering and countering terrorism and proliferation financing in the financial services sector | Unofficial English translation of the title |
| Vietnam | State Bank of Vietnam (SBV) | Law on Anti-Money Laundering No. 14/2022/QH15, amended with effect from 1 December 2026 | Unofficial English title; the content of the amendment has not been reviewed |
| Thailand | Anti-Money Laundering Office (AMLO) | Anti-Money Laundering Act B.E. 2542 (1999), as amended; Ministerial Regulation on Customer Due Diligence B.E. 2563 (2020) | Instrument names only; content and in-force dates are not described here |
Checked on 30 October 2026. Rules change, so confirm the current version with each regulator. The FATF standards are cited as amended in June 2026; the outcomes of the FATF plenary of 26 to 30 October 2026 had not been published when this page was checked. The Vietnamese law is described from an English translation held by a legal database. Titles for Indonesia, Vietnam and Thailand are unofficial English renderings.
Philippines. PhilSys is established under the Philippine Identification System Act (Republic Act No. 11055). BSP’s rules, as amended by Circular No. 1170 (2023), accept an individual’s PhilSys records as official and sufficient proof of identity.
Malaysia. BNM’s policy document requires institutions to verify identity before or during the relationship.
Singapore. MAS Notice 626 requires banks to verify identity using reliable, independent source data, documents or information.
This article is for informational purposes only and does not constitute legal or regulatory advice.
In-person KYC and eKYC
Electronic KYC (eKYC) carries out the same checks through online or mobile channels, and the CDD standard does not change with the channel. In Singapore, MAS Notice 626 requires banks’ non-face-to-face CDD to be at least as robust as face-to-face CDD. Remote checks typically use document verification, biometric matching and liveness detection, which Malaysia’s e-KYC policy document lists as measures institutions may use. FATF’s 2020 Guidance on Digital ID helps regulated entities decide whether a digital ID is appropriate for CDD.
Common KYC mistakes and risks
- Treating KYC as a one-off. FATF standards call for CDD data to be kept up to date through reviews, particularly for higher-risk customers.
- Applying the same checks to every customer. The risk-based approach calls for simplified measures where risk is lower and enhanced measures where it is higher.
- Overlooking beneficial owners. Identifying the beneficial owner is one of the four FATF measures, not an optional extra.
- Treating remote customers as high risk by default, or cutting off whole groups. FATF has stated that its standards do not envisage de-risking, which means cutting off entire classes of customers, but call for a risk-based approach.
- Treating a verified identity as proof of legitimate use. In a case Singapore reported to the FATF, 147 people handed their national digital identity to criminal syndicates, which used it to open 276 accounts at eight banks remotely.
- Overlooking attacks on remote checks. In 2022 the European Union Agency for Cybersecurity (ENISA) identified photo, video-replay, 3D-mask and deepfake attacks as major face presentation attacks against remote identity proofing, and noted that video injection, which bypasses the camera, is not a presentation attack. MAS guidance notes that internet applications can carry greater risks, including the ease of making multiple fictitious applications.
KYC verification is not a single check at sign-up. It is risk-based customer due diligence: the four FATF measures applied in proportion to the customer’s risk, kept current through the relationship and shaped by each country’s rules.
The data collected and the instruments differ by country, so what applies in one market cannot be assumed in another. Teams looking at how software fits these steps can read more about KYC verification software.
Several of the rules described here are recent or amended with effect from a later date, so current versions should be confirmed with each regulator before they are relied on.
FAQ
