Know your customer (KYC): what it means and what UK firms must do

• Know your customer is the legal duty to identify customers, assess their risk and keep evidence of both, set out in the UK by the Money Laundering Regulations 2017
• Since 30 June 2026, customer due diligence thresholds are in sterling and enhanced due diligence applies to transactions that are unusually complex or unusually large
• The KYC process follows five steps, from verifying the customer to keeping records for five years under regulation 40
• KYC breaks down at the documents: unclear acceptance rules, edited evidence and incomplete customer files
• Software reads and validates ID data in seconds, while your team makes the decisions

What is know your customer?

Know your customer (KYC) is the process of verifying a customer's identity, understanding the purpose of the relationship and assessing the risk of money laundering or terrorist financing. UK law calls this customer due diligence (CDD). It applies before a business relationship starts and for as long as it lasts.

KYC refers to individuals. For companies, the same checks are often called know your business (KYB), and they focus on the people who own or control the firm. You will also see the term "customer identification program" (CIP). That is a US requirement and has no direct equivalent in UK law.

The UK legal framework for KYC

The core rules are in the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, known as the MLRs. They sit alongside the Proceeds of Crime Act 2002, which makes money laundering an offence and governs suspicious activity reporting.

For banks and insurers, the FCA supervises compliance. The JMLSG guidance explains how financial firms are expected to apply the MLRs, and the FCA takes it into account when it reviews your controls.

The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 changed several KYC rules from 30 June 2026:

The KYC process in five steps

The MLRs set out what customer due diligence must include. The requirements fall into five steps.

1. Identify and verify the customer

You collect the customer's details and verify them against documents or information from a reliable, independent source (regulation 28). For individuals, that usually means a passport or photocard driving licence plus proof of address. For companies, it means the company's registered details from Companies House.

2. Verify anyone acting on the customer's behalf

When a director or authorised signatory acts for your customer, you verify their identity and check their authority to act.

3. Identify the beneficial owners

You establish who ultimately owns or controls the customer. Anyone holding more than 25% of the shares or voting rights counts as a beneficial owner. You can use the Companies House register of people with significant control (PSC), but the MLRs do not let you rely on it alone.

Since 18 November 2025, Companies House has required new directors and PSCs to verify their identity. Existing directors and PSCs have until November 2026 to do the same, which makes the register more reliable for your KYB checks.

4. Assess the risk

You understand the purpose of the relationship and check whether the customer or a beneficial owner is a politically exposed person (PEP) under regulation 35. Where the risk is higher, enhanced due diligence applies under regulation 33, such as evidence of the source of funds.

Specialised screening systems handle the checks against sanctions and PEP lists. Their results belong in the customer file.

5. Keep records for five years

You keep copies of the evidence and the records of your checks for five years after the business relationship ends (regulation 40). Once that period is over, regulation 40 also requires you to delete personal data, unless another law requires you to keep it or the customer has agreed.

Where KYC breaks down in practice

The rules are clear. Day to day, KYC breaks down at the documents and at the question of how you prove each decision later.

Decide which evidence you accept

When it is unclear whether a mobile phone bill counts as proof of address, each case handler decides differently. Those inconsistencies are exactly what supervisors find in the file. In July 2025, the FCA fined Monzo £21.1 million for financial crime control failings, including accounts opened with implausible addresses such as well-known London landmarks.

Write down which documents you accept for which purpose and how old they may be. Apply that list the same way at every capture, so expired or unsuitable evidence never reaches the customer file.

Don't leave edited documents to the naked eye

Changing the address on a genuine document takes seconds with AI tools. On a scanned copy, the edit is almost impossible to spot.

Machine-readable features help. The checksums in the machine-readable zone (MRZ) of a passport or ID card must match the printed details. Doxis reads the ID data and compares the MRZ with the printed fields automatically, so any mismatch reaches your team as a specific point to check.

Make every decision provable

When the FCA or your auditors review a file, what counts is what you can show: which document you received, and who accepted it and when.

Keep all KYC evidence in one digital customer file. An audit trail records every access and change, and the five-year retention period under regulation 40 runs automatically.

KYC continues after onboarding. Signatories change and ID documents expire. The MLRs require ongoing monitoring under regulation 28(11), including keeping customer information up to date, at intervals that reflect each customer's risk.

When a customer fails to provide updated evidence by your deadline, you may have to restrict the account and, as a last step, end the relationship.

Treat these reviews as an ongoing task in the customer file. Record each ID document's expiry date and the next review date for each risk category. Reminders prompt your team in time, and missing evidence is visible at a glance.

For UK groups with entities in the EU, one difference matters. From 10 July 2027, the EU Anti-Money Laundering Regulation sets fixed maximum intervals for these updates: one year for higher-risk customers and five years for all others.

Automate the checks, keep the decisions with your team

When every ID copy is typed in and compared by hand, any application that arrives in the evening or at the weekend waits until the next working day. That costs you customers and ties your team to routine work.

Split the work clearly. Software reads ID data in seconds and validates it, while your team handles the cases with inconsistencies and makes every decision.

Trading 212 speeds up onboarding with Doxis

The London-based online broker Trading 212 checked new customers' payment cards and proof of address by hand. Onboarding was slow, and missing or incorrect documents led to frequent rejections that compliance and support had to follow up one by one.

Document data is now extracted and validated in real time. The teams focus on the cases that need a decision.

• Fewer rejected applications due to missing or incorrect documents
• Less manual work for compliance and customer support

Keep KYC evidence audit-ready with Doxis

With Doxis, ID documents are read and validated as they arrive, and your team concentrates on the cases that need a decision. Every check lands in the customer file, so you can evidence each customer when the FCA or your auditors ask.

Capture and filing work together on one platform. Doxis AI.dp reads the ID data, and audit-proof archiving keeps the evidence available for the full retention period.

• ID data read in seconds and checked against the MRZ
• One digital customer file per customer with all KYC evidence
• A complete audit trail for every check and every change
• Review reminders for keeping existing customers up to date
• Retention periods under regulation 40 managed automatically

Doxis is a Leader in the Gartner® Magic Quadrant™ for Document Management 2026. Request a free demo to see how Doxis checks your KYC evidence and brings it together in one complete customer file.

FAQs for know your customer