204.5 billion. That’s the amount of non-cash payments made in the U.S. in 2021, according to the Federal Reserve. That’s a lot of money being exchanged—and also provides a huge amount of possibility for financial crime.
Financial crime can take on several faces, including (cyber) fraud, cryptocurrency scams, and money laundering—and companies offering financial services can lose out on serious bucks. In the U.S., white-collar crime can cost annual losses as high as $300 billion. Meanwhile, in the European Union, it’s estimated to cost between €715 billion to €1.87 trillion a year. Of course, financial criminal activity doesn’t have to just lead to monetary loss—it could also lead to a data breach of customer information. Either way, the stakes can be high and the consequences far-reaching.
If you’re starting a vertical SaaS company, Know Your Customer (KYC) should be high on your list of priorities to check off before launching. Even if you’re not in the financial industry, you’ll need a payment processor or payment service provider (PSP) to start generating revenue, which means you’ll need to either have a proper risk management framework in place—or work with a PSP that has one. If you’re starting the underwriting process and have no idea how to make sense of the complex world of KYC and all the terminology involved, you’re in the right place. From EDD and eKYC to AML to CDD, we’re going to cover everything you need to know about KYC in this article.
TL;DR
- Know Your Customer, or KYC, is the process of ensuring that companies can verify their (current or potential) customers’ identities and their financial profiles.
- KYC’s three main components are the customer identification program (CIP), which was imposed by the USA Patriot Act in 2011; customer due diligence (CDD); and regular monitoring of the customer’s account and activities, which is also called enhanced due diligence (EDD).
- To choose the right KYC provider, some of the factors you should look at are if the provider offers automated KYC processes, integration with existing systems, future-proof scalability, and full compliance with regulatory requirements.
What Exactly is KYC?
Know Your Customer, or KYC, is the process of ensuring that companies can verify their (current or potential) customers’ identities and their financial profiles. In the U.S., there are three main components of KYC: the customer identification program (CIP), which was imposed by the USA Patriot Act in 2011; customer due diligence (CDD); and regular monitoring of the customer’s account and activities, which is also called enhanced due diligence (EDD).
It’s important to note that even though CDD and KYC are similar processes that involve verifying customers’ identity, they aren’t the same. While internationally CDD can be seen as a key component of KYC compliance, within the U.S., it’s the opposite: customer due diligence is an ongoing process that is a part of the KYC requirements, which in turn is part of the broader anti-money laundering (AML) regulations set in place for financial institutions.
Why KYC Matters for SaaS Companies
There are a wide range of reasons why companies need to comply with the KYC process—primarily regulatory and ethical.
Within the U.S., the U.S. Financial Crimes Enforcement Network (FinCEN), stipulates that customers and financial institutions ensure KYC compliance to limit illegal activities like money laundering, which is why KYC is seen as a component of AML.
Failure to comply with AML and KYC frameworks can lead to an array of legal and financial consequences, as compliance with AML requirements has been a part of legislation since as far back as 1970.
Companies have had to pay serious fines over the years: Commerzbank London had to pay £37.8 million ($47.3 million), while Goldman Sachs faced a fine of $2.9 billion for its role in financial crime. Between 2008 to 2018, $26 billion was handed out in fines, with 91% coming from the U.S.
That said, besides the legal and financial repercussions, there are ethical reasons to have a strong AML and KYC policy in place. With the increased risk of fraud, consumers want to know that they’re partnering with a company that is doing its utmost best to keep their money safe.
If it’s not clear that your SaaS company is taking KYC seriously—or worse, it comes out due to a scandal—you risk serious reputational damage, which could lead to customer churn. With a rigorous KYC process in place, it’s possible for financial service providers to offer companies the peace of mind that they can be aware of their client’s identity, risk tolerance, and financial standing—minimizing the risk of financial crime while keeping customer data safe.
What The KYC Process Looks Like
While there’s no such thing as a fully standardized KYC process for most businesses, all compliant financial institutions in the U.S. must ensure their customers go through the CIP, CDD, and EDD as part of the merchant onboarding process. Let’s dive a little deeper into each of these components.
Introduce the customer identification program (CIP)
Basically, the CIP requires that companies get four pieces of identifying information about their client for identity verification. This includes their name, date of birth, address, and identification number (such as a social security number). This legal requirement was codified into U.S. law through the Patriot Act, and requires financial institutions to “form a reasonable belief that it knows the true identity of each customer.” This can involve comparing the information provided to databases, and ensuring the customer isn’t a politically exposed person (PEP), on any sanctions list, or suspected to be involved in terrorism financing. The data must be securely kept for at least five years after the account is closed should it be needed down the road.
Customer due diligence
Customer due diligence is the process of collecting a customer’s data to verify their identity and determine the customer’s risk profile, establishing if there should be a business relationship. The level of CDD and risk-based approach varies on the consumer risk and types of transactions that will be carried out.
For example, if you’re a SaaS company that deals with high-dollar transactions, or works in the gambling vertical, your risk assessment outcome will likely be high, and regulatory requirements would mean a more intense CDD process. This doesn’t mean you wouldn’t be onboarded as a client, but rather that you’d have more stringent KYC regulations to deal with. You’d also likely have to undergo enhanced due diligence (EDD), which is used for customers with a higher risk of identity theft, money laundering, or other illegal activities.
Various factors play a role in risk ratings, like transaction patterns, geographic location, customer reputation, fund source, or PEP status. While there isn’t a standardized risk rating system, the CDD framework should be able to determine whether a potential client is high-risk or not.
Regular monitoring and periodic reviews
While CIP and CDD can help to protect financial institutions’ reputations when an account is opened, ongoing monitoring is required to ensure that any suspicious financial transactions are detected and flagged as soon as possible so appropriate action can be taken.
Choosing the Right KYC Solution Provider
“A good beginning is half the task” has never been truer than when looking for a reliable KYC provider as a SaaS company taking on payments. Here are a few things you should be on the lookout for when shopping around.
eKYC support: A fully manual KYC procedure is almost never feasible given the global scale on which transactions take place. Not only is it significantly more time-consuming and costly, there’s also a higher risk of error and a data breach. While technology is constantly evolving, some of the more common automated KYC approaches in (digital) onboarding involve using AI algorithms, third-party API integrations, and OCR. By partnering with a provider that uses automated KYC paired with human precision, you can ensure you get the best of both worlds.
Integration with existing systems: Look for a solutions provider that will adapt to your way of working, not the other way around: just because KYC and AML is a regulatory requirement doesn’t mean it should feel like pulling teeth. The digitization of KYC can streamline the process, with many payment processors or financial institutions using API-based applications for identity verification. Industry champions will be able to strike the right balance between providing a seamless onboarding experience without sacrificing security.
Scalability and compliance: Your future payment processor shouldn’t be a temporary solution; they should be able to support you whether you’re processing a thousand or a hundred thousand payments. Make sure you can determine if they can grow alongside you, and double-check to see if they regularly review their KYC, CDD, and EDD policies. For example, ask what local registries they have access to and types of documents they can see, what databases they’re connected to, what KYC information and biometrics they track, and what long-term steps they’re taking to combat the general uptick in fraud. Plus, make sure to research them to see if they’ve ever been mentioned in the news for noncompliance with AML regulations.
While this isn’t an exhaustive list—customer service, flexibility, and data storage are other factors to consider to help you get started with your KYC process.
Wrapping up
If you’re searching for a powerful payment service provider that puts compliance front and center, look no further than Stax Connect. From online credit card payments to in-person contactless transactions and everything in between, our all-in-one payments processing platform offers a range of powerful payment solutions to sustainably scale your SaaS business, while ensuring Level 2 PCI Compliance for all your merchant onboarding needs.
Contact us for a free demo today.
FAQs about KYC
Q: What is Know Your Customer (KYC)?
Know Your Customer, or KYC, is a mandatory process to verify the identities and financial profiles of current or potential customers. It involves three main components: the customer identification program (CIP), customer due diligence (CDD), and regular monitoring of the customer’s account and activities, also known as enhanced due diligence (EDD).
Q: Why is KYC important for SaaS companies?
KYC is crucial for SaaS companies, primarily for regulatory and ethical reasons. Compliance with KYC helps limit illegal activities like money laundering. Failure to comply with KYC and anti-money laundering (AML) frameworks can lead to legal and financial repercussions. Ethically, a strong AML and KYC policy assures customers that their money is safe, thus enhancing the company’s reputation.
Q: What are the main components of KYC?
The three main components of KYC are the customer identification program (CIP), customer due diligence (CDD), and enhanced due diligence (EDD). CIP involves obtaining four pieces of identifying information about the client for identity verification. CDD is the process of collecting a customer’s data to verify their identity and determine their risk profile. EDD involves regular monitoring of the customer’s account and activities to detect any suspicious financial transactions.
Q: What factors should one consider when choosing a KYC solution provider?
When choosing a KYC solution provider, consider if they offer automated KYC processes, integration with existing systems, future-proof scalability, and full compliance with regulatory requirements. The provider should be able to adapt to your business operations and grow alongside you.
Q: What is the significance of eKYC?
eKYC, or electronic Know Your Customer, is an automated approach to the KYC process. It simplifies and speeds up the identification and verification process, reduces the risk of errors and data breaches, and helps companies comply with regulatory requirements efficiently. It typically involves AI algorithms, third-party API integrations, and OCR.
Q: What is the relationship between KYC and AML?
KYC is part of the broader anti-money laundering (AML) regulations set in place for financial institutions. While KYC focuses on verifying customer’s identity and assessing their financial profiles, AML involves measures to prevent illegal activities, such as money laundering and terrorist financing. Compliance with both KYC and AML is legally required and crucial for maintaining a company’s reputation and legal standing.
Q: How does KYC help prevent financial crime?
KYC helps prevent financial crime by ensuring that companies can confirm their customers’ identities and understand their financial profiles. It allows companies to detect and monitor any suspicious financial activities, thereby minimizing the risk of financial crime and keeping customer data safe.
Q: What is the role of regular monitoring and periodic reviews in KYC?
Regular monitoring and periodic reviews are part of the enhanced due diligence (EDD) process in KYC. They are necessary to ensure that any suspicious financial transactions are detected and flagged as soon as possible. This ongoing monitoring helps protect the financial institutions’ reputations and enables timely action against potential financial crimes.
Q: What are the consequences of non-compliance with KYC regulations?
Non-compliance with KYC regulations can result in legal and financial consequences, including hefty fines. It can also lead to reputational damage, which could cause customer churn and affect the company’s standing in the market.
Q: What is Stax Connect in the context of KYC?
Stax Connect is a payments processing platform that ensures Level 2 PCI Compliance for merchant onboarding needs. It provides a range of powerful payment solutions to sustainably scale your SaaS business while ensuring compliance with KYC regulations.
