CKYCA cheat sheet

KYC is a three-legged process: customer identification (CIP), customer due diligence (CDD), and ongoing monitoring; removing any leg breaks the control.

FATF Recommendations are the global baseline; national law (e.g., EU AMLDs, US BSA/Patriot Act, MAS 626) implements them, and the stricter standard governs where rules conflict.

Risk-based approach (FATF Rec. 1): controls must be proportionate to assessed ML/TF risk; identical treatment of all customers is itself a deficiency.

FATF Recommendations 10 (CDD), 11 (recordkeeping), 12 (PEPs), 13 (correspondent banking), 15 (new technologies), 16 (wire transfers), 20 (STR reporting), 24/25 (beneficial ownership) are the most frequently tested.

The three core crimes framework: money laundering (concealing proceeds), terrorist financing (funding terror regardless of source legitimacy), and sanctions evasion (dealing with designated persons) trigger different controls.

KYC obligations attach at onboarding and are triggered again by trigger events: ownership change, unusual activity, sanctions hit, or periodic review lapse.

Supervisory bodies differ by jurisdiction (FinCEN, FCA, MAS, HKMA); the reporting entity, not the supervisor, owns the KYC decision and its documentation.

Failure modes: no customer risk rating, unverified identity, missing beneficial owner, and stale files - each is a common enforcement finding.

CDD four elements: identify the customer, verify identity using reliable independent sources, identify beneficial owners, and understand purpose and intended nature of the relationship.

CIP minimum data (US): name, date of birth (individuals), address, and identification number; verification must occur within a reasonable time after account opening.

Verification vs identification: identification collects data; verification corroborates it via documents (passport), non-documentary methods (database, credit bureau), or both.

Documentary verification checks: authenticity (holograms, fonts), security features, and data consistency; non-documentary checks include independent database match and negative media.

Reliance on third parties is permitted only if the third party is regulated, keeps records, and the relying institution retains ultimate responsibility; outsourcing never transfers accountability.

Simplified due diligence (SDD) applies only to low-risk, defined categories (e.g., listed public companies, certain government entities) and still requires identification.

Risk factors for CDD: customer type, geography, product/channel, and delivery channel; cash-intensive or non-face-to-face onboarding raises risk.

Customer risk rating should be documented at onboarding, reviewed periodically, and drive the level of EDD and monitoring thresholds.

Beneficial owner: the natural person who ultimately owns or controls the customer or the legal arrangement; thresholds vary (commonly 25% ownership or voting rights, 10% in some jurisdictions).

Two tests apply: ownership (percentage threshold) and control (other means such as shareholder agreements, nominee arrangements, or senior managing official).

If no natural person meets the ownership threshold, identify the senior managing official and document the reasons no beneficial owner was found.

Layered structures require tracing through each intermediate entity until a natural person is reached; shell companies with no operations are a red flag.

Nominee and trust arrangements: identify the settlor, trustee, protector, beneficiaries, and any person exercising ultimate effective control.

Corporate customers require: certificate of incorporation, ownership chart, register of members, and verification of each beneficial owner's identity.

Discrepancy between declared ownership and registry/public data is a trigger for EDD and possible STR.

Record the ownership calculation and the source used (registry, self-declaration, independent search) to evidence the conclusion.

EDD triggers: PEPs, high-risk jurisdictions (FATF grey/black list), complex ownership, cash-intensive business, correspondent banking, and unusual activity.

EDD measures go beyond CDD: source of wealth, source of funds, senior management approval, enhanced ongoing monitoring, and more frequent review.

PEP definition: foreign or domestic politically exposed person, plus family members and close associates; risk continues for at least 12-18 months after leaving office (jurisdiction-specific).

Source of wealth explains how total net worth was accumulated; source of funds explains the origin of the specific money in the transaction - they are not interchangeable.

FATF grey list (jurisdictions under increased monitoring) and black list (high-risk, call for counter-measures) drive geographic risk scoring and EDD.

Correspondent banking EDD: assess the respondent's AML controls, ownership, and reputation; prohibited for shell banks.

Senior management sign-off must be documented with name, date, and rationale before the high-risk relationship is established or continued.

Periodic review frequency should shorten with risk level (e.g., annual for high risk, triennial for low risk) and is a control tested by examiners.

Ongoing monitoring has three layers: transaction monitoring (rules/scenarios), customer profile review, and periodic KYC refresh.

Monitoring rules should be calibrated to the institution's risk profile; thresholds set too high create false negatives, too low create alert fatigue.

Alert triage: investigate, escalate to case, close with documented rationale, or file STR; every disposition must be recorded.

Structuring red flag: multiple cash deposits just below the reporting threshold (e.g., USD 10,000) with no business rationale.

Other red flags: rapid movement of funds, round-dollar transactions, transactions inconsistent with the customer's profile, and unusual counterparties or geographies.

Tipping-off prohibitions mean staff must not tell the customer an STR has been filed; confidentiality applies to the report and its existence.

Backtesting and tuning of monitoring scenarios should be periodic; model changes need documented validation.

Sanctions screening is distinct from transaction monitoring: sanctions hits require blocking/reporting to the relevant authority, not just an STR.

Record retention: typically 5 years after the relationship ends or after the transaction (FATF Rec. 11); some jurisdictions require longer.

STR/SAR filing: report suspicious activity promptly (often within 30 days of detection, with extensions in some regimes); file with the national FIU.

Reports include STRs/SARs, currency transaction reports (e.g., US CTR above USD 10,000), and cross-border/wire transfer reports where required.

Governance elements: board-approved AML policy, designated AML compliance officer, independent audit/testing, and staff training with attendance records.

Three lines of defense: business units (first), compliance/AML (second), internal audit (third); each has distinct monitoring duties.

The AML compliance officer must have sufficient authority, resources, and direct access to the board; the role's independence is a supervisory expectation.

Training should be role-specific and refreshed at least annually; completion records are evidence of the control.

Audit findings and regulatory examinations require documented remediation plans with owners and deadlines.