People mention AML and KYC together so often that many treat them as the same thing. They are not. KYC (Know Your Customer) is the set of checks that confirms who a customer is. AML (anti-money laundering) is the wider framework that detects, prevents, and reports money laundering. This guide explains how the two relate, compares them side by side, adds the related terms KYB and KYT, and walks through a real enforcement case. Banks, fintechs, and money services businesses (MSBs) can use it to see where each control fits.
What Is AML and KYC in Banking?
In banking, KYC starts when a customer opens an account, and the bank repeats it later. The bank collects a customer’s name, address, date of birth, and official ID, then checks those details against trusted sources. For business customers, the bank also asks for incorporation documents and beneficial ownership details.
AML covers much more ground. It includes the policies, controls, and technology that stop criminals from disguising illegal funds as legitimate income. Transaction monitoring, sanctions screening, suspicious activity reporting, staff training, and independent testing all sit under it, as the guide to AML compliance in banking explains in more detail.
You will often see the term AML/CFT. CFT stands for countering the financing of terrorism. Many regulators use the combined term because the same controls that catch money laundering also help catch terrorist financing.
The relationship comes down to one line: KYC is one part of AML, and no bank can meet its AML duties without KYC controls.
AML/KYC Definition and Key Differences
| Term | Definition | Focus |
| AML (Anti-Money Laundering) | The laws, policies, and procedures that detect, prevent, and report money laundering and related crimes | The whole customer lifecycle |
| KYC (Know Your Customer) | The process that verifies a customer’s identity and builds a risk profile | Onboarding and updates |
| CIP (Customer Identification Program) | The U.S. form of KYC identity collection and verification, required under the USA PATRIOT Act | Account opening |
| CDD (Customer Due Diligence) | The assessment of customer risk, including beneficial owners, and the monitoring that follows | Risk-based and ongoing |
| EDD (Enhanced Due Diligence) | Deeper scrutiny of high-risk customers, such as politically exposed persons (PEPs), including their source of funds | High-risk customers |
| KYB (Know Your Business) | KYC for companies: verifying the business and the people behind it | Business onboarding |
| KYT (Know Your Transaction) | Real-time review of each transaction against what you know about the customer | Every payment |
| KYC | AML | |
| Purpose | Confirm that customers are who they say they are | Prevent, detect, and report financial crime |
| Scope | Identity verification and initial risk assessment | Monitoring, screening, reporting, controls, training, and audits |
| Timing | At onboarding, then updated over time | Continuous, throughout the relationship |
| U.S. basis | Customer Identification Program (USA PATRIOT Act) | Bank Secrecy Act (BSA) and the Anti-Money Laundering Act of 2020 |
| Typical checks | ID documents, proof of address, biometric or document verification | Transaction monitoring, sanctions and PEP screening, SAR filing |
| Relationship | A component of AML | The umbrella framework |
Don’t set the two against each other. Countries apply the Financial Action Task Force (FATF) standards through national law, and most firms fold both into one risk-based program.
KYC vs KYB vs KYT: Three Terms, Three Jobs
Searches often pair KYC with two related terms. Each answers a different question.
| Term | Question it answers | Who it covers | When it runs |
| KYC | Who is this person? | Individual customers | At onboarding, then on updates |
| KYB | Who owns and controls this company? | Business customers and their owners | At onboarding, then on updates |
| KYT | Does this payment make sense for this customer? | Every transaction | In real time |
KYB applies KYC thinking to companies. The firm verifies that the business exists, then identifies the people behind it. In the U.S., the beneficial ownership rules (covered below) drive much of that work.
KYT watches the money, not the person. A KYT check compares each payment with the customer’s profile, past activity, and destination. KYT is not a separate legal requirement. It describes real-time transaction monitoring, which is a core AML control.
Put simply, KYC and KYB tell you who the customer is. KYT tells you what the customer does. AML ties all three together, adds reporting, and holds the firm accountable.
The FinCEN 2016 CDD Rule and the 25% Threshold
FinCEN’s 2016 Customer Due Diligence (CDD) Rule shaped how U.S. banks handle KYC for businesses. It requires covered institutions to identify and verify the beneficial owners of legal entity customers. Two tests apply:
- Ownership: each individual who owns 25% or more of the entity’s equity.
- Control: one individual with significant managerial control, such as a CEO or managing member.
The rule also added ongoing customer due diligence to the AML program. Institutions must understand the nature and purpose of each relationship, build a customer risk profile, and update customer information on a risk basis. That last point matters for the next section.
Perpetual KYC (pKYC): An Alternative to Fixed Refresh Cycles
Many firms still refresh KYC on a calendar. High-risk customers get a review every year, and low-risk customers every few years. That approach leaves gaps. A customer’s situation can change the day after a review.
Perpetual KYC (pKYC) takes the opposite approach. The firm keeps customer records current and triggers a review when something changes. Typical triggers include:
- A new address or ownership structure
- A sanctions or adverse media hit
- A sharp change in transaction behavior
- A move into a higher-risk country or product
pKYC fits the CDD Rule’s risk-based language well. It also reduces busywork, because low-risk customers who show no change need no review. Firms still need a documented policy that explains the triggers and the fallback schedule.
The AML/KYC Process: How the Checks Work Together
The two sets of checks run in stages. First, the firm collects and verifies identity. Next, it assigns a risk rating, and that rating sets the depth of due diligence. After onboarding, the firm monitors activity and reports anything suspicious.
| Stage | What happens | KYC or AML? |
| 1. Onboarding | The firm collects and verifies identity details and documents | KYC (KYB for companies) |
| 2. Risk rating | The firm classifies the customer as low, standard, or high risk | KYC / CDD |
| 3. Enhanced review | The firm examines source of funds and the purpose of the relationship for high-risk customers | EDD |
| 4. Ongoing monitoring | The firm screens transactions for unusual patterns and rechecks sanctions lists | AML (KYT) |
| 5. Reporting | The firm files a suspicious activity report (SAR) with the authorities | AML |
| 6. Update | The firm re-verifies customer information on a schedule or when a trigger fires | KYC (pKYC) |
Example: A new customer registers to send money abroad. The firm checks her name, address, and date of birth against a photo ID and a utility bill, then rates her low risk. Months later, her account suddenly sends much larger amounts to several new recipients in a high-risk corridor. The monitoring system raises an alert, an analyst reviews it, and the firm requests enhanced due diligence. If her explanation does not hold up, the firm files a SAR. KYC opened the relationship, and AML caught the change.
Money transfer firms usually run the onboarding steps electronically, which is covered in KYC compliance for money services businesses.
AML Verification: Beyond Checking an ID
Identity verification confirms that a person is real. AML verification goes further and checks the customer against risk data. It usually includes:
- Sanctions and watchlist screening, including the U.S. OFAC lists
- Politically exposed person (PEP) screening
- Adverse media screening
- Beneficial ownership identification for business customers
- Source-of-funds checks for higher-risk profiles
OFAC administers U.S. sanctions separately from the BSA, but U.S. banks and MSBs screen against its lists as part of the same compliance program. These checks are not one-time events. Lists change often, so firms rescreen customers on an ongoing basis.
AML KYC Compliance by Region
Requirements differ by country, but most rest on the FATF Recommendations.
| Region | Main framework |
| United States | The Bank Secrecy Act, the CIP rule, the CDD Rule, and the Anti-Money Laundering Act of 2020, enforced by FinCEN |
| United Kingdom | The Money Laundering Regulations 2017, with supervision by bodies that include the FCA and HMRC |
| European Union | A new AML package adopted in 2024, with a unified rulebook due to apply from 2027 |
Many jurisdictions cover more than banks. Payment providers, money transfer businesses, insurers, e-money institutions, and gambling operators often fall under the rules too. Rules vary, so confirm local requirements with a qualified adviser.
Case Study: TD Bank and the Cost of Stale Monitoring
A well-documented enforcement action shows what is at stake. In October 2024, TD Bank N.A. and its parent, TD Bank US Holding Company, pleaded guilty to charges that included conspiring to fail to maintain an AML program that complied with the Bank Secrecy Act. According to the U.S. Department of Justice, TD Bank became the largest bank in U.S. history to plead guilty to BSA program failures, and the first U.S. bank in history to plead guilty to conspiracy to commit money laundering.
Court documents describe a transaction monitoring program that stayed effectively static from 2014 through 2022. During that period, the bank added no new monitoring scenarios. Three money laundering networks then moved more than $670 million through TD Bank accounts between 2019 and 2023.
TD Bank agreed to pay the Justice Department about $1.89 billion in forfeiture and criminal fines. Counting the coordinated resolutions with the Federal Reserve, the OCC, and FinCEN, press reports put the total across agencies at more than $3 billion.
The lesson: A bank can run KYC at onboarding and still let laundering through if its monitoring goes stale. In KYT terms, the bank watched people at the door but stopped watching the money. Treat KYC and AML as living controls that you test and update, not one-time checklists.
KYC and AML Compliance Best Practices
- Assess risk first. Let your customers, products, channels, and countries shape the program.
- Build a clear CIP. Document your identification steps and define your risk categories.
- Scale due diligence to risk. Apply simpler checks to low-risk customers and reserve EDD for high-risk ones.
- Verify beneficial owners. Apply the 25% ownership test and the control test to every business customer.
- Consider event-driven updates. Pair a fallback schedule with pKYC triggers.
- Review monitoring rules regularly. Update typologies and thresholds as new risks and products appear.
- Train your staff. Teach every employee their role in spotting and reporting suspicious activity.
- Test independently. Find gaps through audits before regulators find them.
- Automate. Manual checks are slow and error-prone, so most firms automate KYC and monitoring, often through remittance software.
How KYC and AML Work Together in Remit Anywhere
The hardest part of running KYC and AML is keeping them connected. When onboarding sits in one tool and monitoring in another, the second tool knows nothing about what the first one learned.
Remit Anywhere avoids that split. The data a customer provides at onboarding goes straight into the monitoring that follows:
- Risk scores carry forward. The customer’s onboarding risk score travels with them into transaction monitoring, so a higher-risk customer faces tighter scrutiny from the first transfer.
- Profiles set the baseline. Stated purpose, sender details, and expected activity give monitoring a baseline. A transfer that breaks the pattern stands out.
- Alerts flow back. When monitoring flags something, the case links to the customer’s KYC record, so analysts review identity documents and activity in one place.
- Agents work in the same system. Agent-assisted onboarding feeds the same records as online and mobile onboarding, so every channel follows the same rules.
Frequently Asked Questions
1. What is the difference between KYC and AML?
KYC verifies a customer’s identity and assesses risk, mainly at onboarding. AML is the broader framework of laws and controls that prevents, detects, and reports money laundering across the whole customer lifecycle.
2. What is AML and KYC in banking?
In banking, KYC verifies who an account holder is, and AML is the set of obligations that governs how banks monitor and report money laundering. Regulated banks in most countries must do both.
3. Is KYC part of AML?
Yes. KYC is one component of an AML program, alongside transaction monitoring, sanctions screening, reporting, and training.
4. What does AML KYC compliance involve?
It involves written policies, a risk assessment, customer identification and due diligence, ongoing monitoring, suspicious activity reporting, staff training, and independent testing.
5. What is the difference between KYC, KYB, and KYT?
KYC verifies individual customers. KYB verifies businesses and the people who own and control them. KYT reviews each transaction in real time against what the firm knows about the customer. AML is the umbrella that includes all three.
6. What is AML verification?
AML verification screens customers against sanctions lists, PEP lists, and adverse media, and checks transactions for suspicious patterns. Firms do it in addition to identity verification.
7. What documents do I need for KYC?
Firms usually ask for a government-issued photo ID and proof of address. For businesses, they also ask for registration documents and beneficial ownership details. Exact requirements vary by country and risk level.
8. What is the 25% beneficial ownership threshold?
Under FinCEN’s 2016 CDD Rule, U.S. banks must identify and verify each individual who owns 25% or more of a legal entity customer. They must also identify one individual with significant control over the entity.
9. What is perpetual KYC (pKYC)?
Perpetual KYC keeps customer records current and triggers a review when something changes, such as a new address, a sanctions hit, or a shift in behavior. It replaces or supplements fixed refresh dates.
10. How often should KYC be updated?
Risk sets the frequency. Firms review higher-risk customers more often and lower-risk customers less often, and many add event-driven triggers on top of a fixed schedule.
11. Who must follow KYC and AML rules?
Banks, payment providers, money transfer businesses, insurers, e-money institutions, and gambling operators generally must, although rules differ by jurisdiction.
12. What happens if a firm ignores KYC and AML rules?
Regulators can impose fines, restrict operations, revoke licenses, and pursue criminal charges against responsible individuals. Reputational damage often follows.
Want to see onboarding data and transaction alerts working in one workflow?
Book a demo and we’ll walk you through it.