The KYC process: a complete guide for landlords

KYC stands for Know Your Customer. It is the umbrella term for the processes an organisation uses to establish who it is doing business with, verify relevant information and assess risks. For organisations with statutory customer due diligence (CDD) obligations, this is an important part of their operations.

What is KYC?

At its core, a KYC process consists of three components:

• Identification: establishing who the customer and relevant associated persons are.
• Verification: checking that the information provided is accurate and up to date.
• Risk assessment: determining which risks the customer relationship entails and which measures are appropriate.

KYC and Customer Due Diligence

KYC and Customer Due Diligence are often used interchangeably. CDD describes the broader customer investigation in which an organisation examines identity, ownership structure, the purpose of the relationship and potential risks. How it is carried out in practice depends on the applicable legal framework and the risk profile.

The KYC process step by step

1. Customer identification

Collect the information needed to identify the customer, directors and ultimate beneficial owners. This can be done with valid identity documents and digital identity verification, depending on what is appropriate and permitted.

2. Verification

Check information against reliable and independent sources. Company details, for example, can be compared with official registers. For individuals, document checks can be combined with a liveness or selfie check.

3. Risk assessment

Assess factors such as business activities, ownership structure, country risks, PEP status, sanctions and relevant adverse media. Record which information led to the conclusion. The final decision to accept or reject remains a human one.

4. Ongoing monitoring

A customer profile can change. Monitoring helps to recognise relevant signals, after which an employee decides whether further investigation or a reassessment is needed. The frequency and depth should match the risk profile.

5. Reporting and record-keeping

Keep checks, supporting rationale and decisions in a single file. Also consider privacy, retention periods, access control and an appropriate legal basis for processing personal data.

Key points of attention

Use reliable sources

Base identification and verification on up-to-date documents, official registers and appropriate digital verification tools. Also check how exceptions and potential matches are followed up.

Keep the process workable for the customer

A careful process does not have to be unnecessarily cumbersome. Request information at the right moment, explain why it is needed and avoid customers having to provide the same information more than once.

Protect personal data

KYC involves processing sensitive personal data. Do not collect more than necessary, secure files, restrict access and set retention periods in line with the applicable rules.

Common challenges

• Scattered information: documents, checks and decisions are held in different systems.
• Inconsistent execution: employees do not always follow the same steps.
• Manual monitoring: periodic checks take a lot of time and are difficult to evidence.
• Balancing customer experience: additional questions can cause friction when context is missing.

How KYC software can help

An integrated platform can bring document and identity checks, company information, PEP and sanctions screening, adverse media, monitoring and record-keeping together in one workflow. This reduces hand-offs and makes it easier to trace which steps have been carried out.

Software does not replace judgement. Policy, risk methodology and acceptance decisions remain with the organisation and its employees.

Implementing in five steps

1. Determine which customers and services require customer due diligence.
2. Define which information, sources and checks are needed for each risk level.
3. Make KYC part of the standard customer acceptance process.
4. Train employees and assign responsibilities.
5. Regularly evaluate whether the process and documentation are still appropriate.

Frequently asked questions

Who is required to carry out KYC?

Customer due diligence is mandatory for organisations that fall under the relevant laws and regulations. For landlords, this depends on the specific services provided and the circumstances.

How often should the due diligence be repeated?

That depends on the risk and on relevant changes. A fixed schedule can help, but a risk-based approach also takes events and new signals into account.

Can KYC be fully automated?

Many checks and administrative steps can be supported or automated. Assessing context and potential matches, and making the final decision, require human responsibility.