KYC Fundamentals and Regulatory Framework
Domain 1 tests whether you understand KYC as a risk-management discipline rather than a document-collection exercise. The exam expects you to know what KYC is for, which international standards shape it, how the risk-based approach changes what you do, and where local law overrides international guidance. Expect questions that contrast identification with verification, or that ask what a firm must do before it accepts a customer rather than after.
The building blocks of a KYC programme
KYC sits inside an AML/CFT framework and typically includes customer identification and verification, customer due diligence, beneficial ownership identification, ongoing monitoring, and recordkeeping and reporting. The FATF Recommendations are the global standard: Recommendation 10 covers CDD, 11 recordkeeping, 12 PEPs, 13 correspondent banking, 14 money/value transfer services, 15 new technologies, 20 STR reporting, and 24-25 beneficial ownership transparency. FATF is not self-executing; countries implement it through national law, and supervisors issue local rules. The Basel Committee guidance applies KYC to banks, and the Wolfsberg Group publishes private-sector principles.
The risk-based approach
Risk-based means effort is proportionate to risk. Firms assign a customer risk rating using factors such as country, product, channel, occupation or business activity, and expected transaction profile. Low risk may permit simplified measures; high risk requires enhanced measures. Simplified due diligence does not mean no due diligence, and risk rating is not a one-off decision - it must respond to new information. The four pillars of governance commonly cited are a designated compliance officer, written policies, training, and independent testing.
Worked example
A bank onboards a small local charity that collects donations and makes grants to community projects. The officer is tempted to apply simplified measures because the balance will be low. Correct reasoning: the customer is a legal person with a public-benefit purpose, but the channel is branch-based and the activity is domestic, so risk is likely standard rather than high. However, charities are recognised as vulnerable to misuse, so the officer must identify the charity's beneficial owners and controllers, understand its purpose and expected funding, and verify the source of donations. Simplified CDD is defensible only if a documented risk assessment supports it and local rules permit it.
Traps that cost marks
Confusing identification with verification; treating CDD as a one-time onboarding step; assuming FATF Recommendations are directly enforceable; and applying simplified measures without recording the risk rationale.