Know your customer (KYC) and know your business (KYB) are the checks a payment company runs on its clients before and during the relationship. Banks, card schemes and supervisors judge you by how well you do them. From 10 July 2027 one EU regulation, the Anti-Money Laundering Regulation (AMLR), replaces the different national rules. This article explains in plain words how to decide how deeply to check each customer, what KYC and KYB include, when lighter checks are enough and where payment firms most often fail.
Checked on 22 October 2026. Rules and sources are current as of this date.
What is changing and when
Today national laws still apply in the EU, but the rules are moving to one regulation and common standards set by EU bodies.
The AMLR
The Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) sets the duties of companies that must follow anti-money laundering rules, including customer checks. It applies from 10 July 2027.
AMLA standards
AMLA is the new EU Anti-Money Laundering Authority. It has sent the European Commission its final draft technical standards, which say what information and documents to collect when checking a customer. They are proposed to apply six months after they enter into force.
EBA guidelines
The EBA is the European Banking Authority, the EU body that sets common standards for banks and payment firms. Two of its guidelines already apply. One covers money laundering risk factors (EBA/GL/2021/02) and the other covers checking customers remotely (EBA/GL/2022/15, in force since 2 October 2023).
The FATF standard
FATF is the international body that sets anti-money laundering standards. Its Recommendation 10 is the base. Know who the customer and the real owner are, understand why they need your service and keep watching their transactions, with the depth set by risk.
How the risk-based approach works
The scope of checks follows risk. But the risk has to be assessed and written down, otherwise you cannot defend the approach before a supervisor.
Risk of the whole business
Assess risk across your products, sales channels, customers and countries, and take into account national and EU risk assessments (AMLR, Article 10). Do this before you launch a new product, channel or market.
Risk of each customer
How much you check depends on the risks of this customer and this relationship (Article 20). You must be able to show the supervisor at any time that your measures fit the risks.
Do not let one factor decide
Under the EBA guidelines one risk factor alone does not move a customer to another category, and factors can be weighted. Business interests must not influence the rating. If a person overrides an automated score, the reason must be recorded.
KYC: what to check
The AMLR lists the measures. They apply to every customer, and only the depth depends on risk.
Who the customer is
Identify the person and verify identity. Under the draft standards you collect all given and family names from the ID, the place of birth, nationality and an address with country and city.
Sanctions and PEPs
Check the customer and its owners against sanctions lists and find out whether they are politically exposed persons (PEPs), or their relatives or close associates. The draft standards also look at aliases, trade names and crypto wallet addresses.
Watching transactions
Throughout the relationship, check that transactions match what you know about the customer and, when needed, check where the money comes from.
When to check
The AMLR requires checks when the relationship starts, for a one-off transaction of EUR 10,000 or more and, for financial institutions, for a transfer of funds of EUR 1,000 or more (Article 19). FATF uses a threshold of 15,000 for one-off transactions.
KYB: checking a company and its real owners
For a company the key question is not who signed the application but who really stands behind it and controls it.
The company
Record the legal name and the trade name if it differs. Understand what the business does and confirm that the person signing may act for the company.
Beneficial owners
A beneficial owner is a person who ultimately owns or controls the company. Identify them and take reasonable steps to verify. A stake of 25% or more normally makes someone an owner, but check control through other means as well, not only when no large shareholder is found.
Where to verify
Under the draft standards the sources include public and business registers, databases and reliable data providers. The central register of beneficial owners can be used in low-risk cases, but add information from the customer or other reliable sources.
Simplified and enhanced checks
Risk sets the depth. But neither a lighter nor a stricter check replaces the core measures.
Simplified checks
At low risk you may postpone verifying the customer and its owners, but by no more than 60 days after the relationship starts. You may also update data less often, infer the purpose from the type of transactions and watch transactions less intensively. Monitoring must still be enough to spot unusual and suspicious activity (Article 33).
Not an exemption
Under the EBA guidelines a simplified check does not replace customer due diligence and cannot be used where money laundering or terrorist financing is suspected. FATF says the same.
Enhanced checks
Needed for higher risk. Complex, unusually large or oddly patterned transactions, and those with no clear lawful purpose, need a close look at where the money comes from and goes. Measures include more information on the customer and owners, the source of funds and wealth, approval by senior management and closer monitoring (Article 34).
| Risk level | Typical profile (example) | Measures |
|---|---|---|
| Low | Regulated financial institution, transparent structure | Core checks and lighter measures under Article 33, with the reasons written down |
| Medium | Typical customer, clear business | Full set of measures under Article 20, standard monitoring |
| High | Complex structure, PEP, risky country, unusual transactions | Enhanced measures under Article 34, senior management approval, more frequent reviews |
This table is our example of an approach, not a rule of law. Each firm sets its own criteria in its risk assessment.
We will review your situation and propose a solution for your project.
Onboarding customers online
Most payment providers sign customers up online, and this is where supervisors find most problems.
Policy and testing
The EBA guidelines require an approved policy and an assessment of the solution before it goes live. Is the data complete, are the sources reliable, and what are the fraud and impersonation risks.
Document and person
Check security features and signs of tampering, and make sure the document is not just shown on a screen. Liveness detection, which proves a real person is present, is mandatory in all unattended solutions.
Extra controls
When needed, add a first payment from an account in the customer’s name, one-time passcodes or a call. The guidelines presume that solutions based on notified eIDAS electronic identification at substantial or high level, and on qualified trust services, meet the criteria.
Ongoing control
Keep checking data quality, run scheduled and ad hoc reviews, and review affected customers when problems appear.
Where payment providers go wrong most often
The EBA report of 16 June 2023 on money laundering risks in payment institutions shows what supervisors look at.
Monitoring
The EBA says that failure to monitor transactions in a meaningful way is widespread, monitoring systems are weak or missing in many firms and reports of suspicious transactions were rated poor.
Onboarding and PEPs
Online onboarding often lacks safeguards, and firms fail to identify high-risk customers, including PEPs.
Agents
There is no common EU approach to agent networks. Agents are often not covered by anti-money laundering rules themselves and work with several providers. The EBA rates the risk of criminals using agents as high.
New risks
The EBA named virtual IBANs, white labelling and third-party acquirers as areas for further assessment.
The report is from 2023, but it reflects what supervisors think. If you have agents, white label or virtual accounts, describe in advance how you check end customers.
Supervisory practice
The AMLR does not apply yet, so look at what supervisors already punish. Below are two decisions of the UK regulator, the FCA (UK Financial Conduct Authority). They are not EU decisions and both concern banks, but the findings on onboarding, screening and high-risk controls are typical for payment providers too.
Monzo, 8 July 2025
Fine of £21,091,300. From October 2018 to August 2020 the bank accepted limited and sometimes implausible customer information (well-known London landmarks were given as home addresses), and its risk assessment and transaction monitoring were inadequate. From August 2020 to June 2022 it breached a restriction on opening accounts for high-risk customers and signed up more than 34,000 of them. Without the 30% discount for agreeing to settle, the fine would have been £30,130,475.
Starling, 2 October 2024
Fine of £28,959,426. From 2017 its automated system screened customers against only part of the sanctions list. The bank had agreed with the FCA not to open accounts for high-risk customers, but between September 2021 and November 2023 it broke that promise and opened more than 54,000 accounts for about 49,000 such customers. Without the 30% discount the fine would have been £40,959,426.
In both cases the customer base grew faster than the controls. Check that screening covers the full list and that a restriction agreed with a supervisor is enforced technically, not only written into a policy.
Refusing a customer and checking existing ones
A check that cannot be completed must end in refusal, and existing customers are not exempt from the new rules.
If the check cannot be completed
Do not carry out the transaction or start the relationship, end an existing one and consider reporting a suspicious transaction to the financial intelligence unit (AMLR, Article 21). FATF has the same rule.
Existing customers
Under the draft standards, existing high-risk customers must be brought into compliance within one year after the standards apply, and the rest within five years. This is a draft, so the final deadlines depend on what is adopted.
What to do now
Most of the preparation does not depend on when the standards are adopted.
Update the risk assessment of the whole business
Products, channels, customer groups, agents and countries. Record the assessment and the review dates.
Start hereDescribe the customer risk model
Which factors you consider, how you weight them, who may override a rating and how overrides are recorded.
Build a KYB procedure
Ownership chart, beneficial owners with a check of control through other means, authority of representatives and verification sources.
Review online onboarding
The solution, liveness and document checks, and extra measures for high risk.
Review monitoring and agents
Scenarios, thresholds and alert handling, and checks on customers brought in through agents and white label.
Draft a transition plan
Deadlines up to 10 July 2027 and the review of existing customers under the draft standards.
The AMLR applies from 10 July 2027, while the AMLA standards will apply once the Commission adopts and publishes them. Tie your plan to the first date.
A risk-based approach works only as long as you can show how you assessed the risk.The LegalBit team
Frequently asked questions
What is the risk-based approach?
It is not a way to skip checks but a way to choose their depth by risk. All core measures apply to every customer, but their scope depends on the risk assessment.
Can we rely on the central beneficial ownership register?
Under the draft standards it may be used in low-risk cases, but the information must be supplemented with customer data or other reliable sources.
What if a customer does not provide documents?
If the check cannot be completed, the firm does not carry out the transaction or start the relationship, ends existing ones and considers a report to the financial intelligence unit (AMLR, Article 21).
When will the AMLA standards apply?
The final drafts have been sent to the Commission. After adoption and publication in the Official Journal they are proposed to apply six months after entry into force, while the AMLR itself applies from 10 July 2027.
See also: Travel Rule for crypto businesses; EMI and payment institution licence in the EU, UK and Canada; Transaction laundering and miscoding; Payment Facilitators, Aggregators and ISOs: Who Is Responsible for Sub-Merchants; Responsible gambling and AML for operators; Accepting crypto payments in business. Services: regulatory and compliance.
- EUR-Lex: Regulation (EU) 2024/1624 on the prevention of the use of the financial system for money laundering (AMLR)
- AMLA: Press release, AMLA finalises key standards for the private sector
- AMLA: Factsheet on RTS on Customer Due Diligence under Article 28(1) AMLR
- AMLA: Consultation on the draft RTS on Customer Due Diligence
- EBA: Guidelines on ML/TF risk factors, EBA/GL/2021/02 (consolidated)
- EBA: Guidelines on the use of Remote Customer Onboarding Solutions, EBA/GL/2022/15
- EBA: Report on ML/TF risks associated with payment institutions (16.06.2023)
- FATF Recommendation 10: Customer due diligence (text published by CFATF)
- FCA: Press release, FCA fines Monzo £21m for failings in financial crime controls (8 July 2025)
- FCA: Press release, FCA fines Starling Bank £29m for failings in financial crime systems and controls (2 October 2024)
This is what we do
How we help payment and fintech companies:
