What KYC covers
EU law lists four measures (Directive (EU) 2015/849, Article 13), and UK law has the same four (regulation 28).
- Identify the customer, and verify the identity from a reliable, independent source.
- Identify the beneficial owner, where there is one, and take reasonable measures to verify that person's identity.
- Establish the purpose and intended nature of the relationship.
- Monitor the relationship and its transactions, and keep the information up to date.
When KYC applies
- EU and UK: when a business relationship is established.
- EU: an occasional transaction of EUR 15,000 or more, or a transfer of funds above EUR 1,000 (Article 11).
- UK: an occasional transaction of £12,000 or more, or a transfer of funds above £800, both figures since 30 June 2026 (regulation 27).
- Whenever money laundering or terrorist financing is suspected, whatever the amount.
- When there are doubts about identification data obtained earlier.
From 10 July 2027, the EU's AML Regulation lowers the occasional transaction threshold to EUR 10,000, and sets EUR 1,000 for crypto-asset service providers (Article 19). Under the directive, records are kept for five years after the relationship ends (Article 40).
Who carries out KYC
The duty sits with the regulated firm: a bank, an e-money or payment institution, a crypto-asset service provider. A company launching under a partner's licence follows the partner's KYC policy, and a firm that relies on a third party's checks stays responsible for them (Article 25).
The extent of each measure follows risk. Products often tier it: light checks and low limits first, and more as the customer's activity grows.
KYC, CDD or KYB?
- Customer due diligence
- The legal term for the same duty. KYC is what the industry calls it.
- KYB
- Know your business: the same duty applied to a company, then to the people who own and control it.
- AML
- The whole programme: risk assessment, KYC, monitoring, reporting and training. KYC is one part.
Where KYC shows up in a platform
Modules that do the work
- KYC / AMLIdentity checks, screening and ongoing monitoring, with the verification provider you choose.
- Compliance reportingTransaction monitoring, the Travel Rule and regulatory reports, ready for your regulator.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
Platforms that need it
Guides that go deeper
- How to launch a neobank without a banking licenceYour own e-money licence, an EMI's agent, a partner bank or a bank licence: how each route works, who holds the money, and what safeguarding and deposit protection cover.
- FCA cryptoasset registration: what UK crypto firms needWhat FCA registration under the Money Laundering Regulations asks of a UK crypto business, how crypto promotions are controlled, and what changes on 25 October 2027.
Where it is written
The laws and standards this page's facts come from.
- Directive (EU) 2015/849, the Anti-Money Laundering Directive, consolidated (EUR-Lex)
- Money Laundering Regulations 2017 (legislation.gov.uk)
- Regulation (EU) 2024/1624, the AML Regulation (EUR-Lex)
General information, not legal advice: what applies to you depends on your services and your market.