Know Your Customer (KYC)

Know Your Customer (KYC) is the process of confirming that a borrower is who they say they are, and understanding enough about them to judge the risk of doing business with them. It is the front door of anti-money-laundering compliance and fraud prevention.

In the US, the formal rule for banks and credit unions is the Customer Identification Program (CIP), issued under the Bank Secrecy Act. Before opening an account, which includes making a loan, a bank must collect at least four facts about each customer:

1. Name
2. Date of birth, for an individual
3. Address
4. An identification number, such as a taxpayer ID for US persons

The bank must then verify that information within a reasonable time. It can use documents, such as a driver's license, database checks, or both. Since June 2025, federal regulators have let banks obtain the taxpayer ID from a reliable third-party source instead of directly from the customer, as long as the rest of the rule is met.

KYC goes beyond identity. It also means understanding the purpose of the relationship, building a risk profile and watching for unusual activity over time. For business borrowers, it extends to owners and controllers through Know Your Business (KYB).

Many nonbank lenders are not directly covered by the CIP rule. But their bank partners, warehouse lenders and investors often require similar checks by contract, and sanctions rules apply to everyone.

Why it matters for lenders

Identity fraud is one of the main ways lenders lose money. Stolen identities, synthetic identities built from real and made-up details, and straw borrowers all enter at onboarding.

For banks and credit unions, KYC is also an exam topic. Examiners check that the identity program is written, followed and documented for each customer. Missing records count as failures.

How it works in practice

An online lender receives an application from a sole proprietor. The system captures name, date of birth, address and Social Security number from the loan application and runs an identity check through a data provider. It also runs OFAC screening against the Office of Foreign Assets Control's sanctions lists.

The name and Social Security number match, but the address on file is different. The file goes to an analyst, who asks for a recent utility bill. Once it matches, the analyst clears the flag, and the result, date and reviewer are saved on the loan.

When KYC runs in a separate portal, staff paste results into notes or forget to save them. Running checks from the loan record and storing results there keeps the evidence with the file for the next review or exam.