{"id":7653,"date":"2026-10-22T12:45:00","date_gmt":"2026-10-22T09:45:00","guid":{"rendered":"https:\/\/legalbit.top\/en\/kyc-kyb-payment-providers\/"},"modified":"2026-10-23T16:17:18","modified_gmt":"2026-10-23T13:17:18","slug":"kyc-kyb-payment-providers","status":"publish","type":"post","link":"https:\/\/legalbit.top\/en\/kyc-kyb-payment-providers\/","title":{"rendered":"KYC and KYB for Payment Providers: Building a Risk-Based Customer Due Diligence Programme"},"content":{"rendered":"\n<div class=\"lbm\"><svg width=\"0\" height=\"0\" style=\"position:absolute\" aria-hidden=\"true\"><symbol id=\"i-list\" viewBox=\"0 0 24 24\"><path d=\"M9 6h11M9 12h11M9 18h11\"\/><path d=\"M4 6h.01M4 12h.01M4 18h.01\"\/><\/symbol><symbol id=\"i-user\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"8\" r=\"4\"\/><path d=\"M4 21c0-4 3.6-7 8-7s8 3 8 7\"\/><\/symbol><symbol id=\"i-ban\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M5.6 5.6l12.8 12.8\"\/><\/symbol><symbol id=\"i-layers\" viewBox=\"0 0 24 24\"><path d=\"M12 3l9 5-9 5-9-5z\"\/><path d=\"M3 13l9 5 9-5\"\/><\/symbol><symbol id=\"i-eye\" viewBox=\"0 0 24 24\"><path d=\"M2 12s4-7 10-7 10 7 10 7-4 7-10 7S2 12 2 12z\"\/><circle cx=\"12\" cy=\"12\" r=\"3\"\/><\/symbol><symbol id=\"i-doc\" viewBox=\"0 0 24 24\"><path d=\"M7 3h8l4 4v14H7z\"\/><path d=\"M15 3v4h4M10 12h6M10 16h6\"\/><\/symbol><symbol id=\"i-pen\" viewBox=\"0 0 24 24\"><path d=\"M4 20l4-1 11-11-3-3L5 16z\"\/><path d=\"M14 6l3 3\"\/><\/symbol><symbol id=\"i-alert\" viewBox=\"0 0 24 24\"><path d=\"M12 3l10 18H2z\"\/><path d=\"M12 10v4M12 17.5h.01\"\/><\/symbol><symbol id=\"i-bulb\" viewBox=\"0 0 24 24\"><path d=\"M9 18h6M10 21h4\"\/><path d=\"M12 3a6 6 0 0 0-3.5 10.9c.6.5 1 1.2 1 2.1h5c0-.9.4-1.6 1-2.1A6 6 0 0 0 12 3z\"\/><\/symbol><symbol id=\"i-info\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M12 11v5M12 8h.01\"\/><\/symbol><symbol id=\"i-coin\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M14.5 9.5c-.5-1-1.5-1.5-2.5-1.5-1.4 0-2.5.8-2.5 2s1.1 1.6 2.5 2 2.5.8 2.5 2-1.1 2-2.5 2c-1 0-2-.5-2.5-1.5M12 6.5v11\"\/><\/symbol><symbol id=\"i-clock\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M12 7v5l3 2\"\/><\/symbol><symbol id=\"i-globe\" viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M3 12h18M12 3c2.5 2.7 3.8 5.7 3.8 9s-1.3 6.3-3.8 9c-2.5-2.7-3.8-5.7-3.8-9S9.5 5.7 12 3z\"\/><\/symbol><\/svg><section class=\"lbm-intro\"><div class=\"lbm-intro-main\"><p class=\"lbm-lead\">Know your customer (KYC) and know your business (KYB) are the checks a payment company runs on its clients before and during the relationship. Banks, card schemes and supervisors judge you by how well you do them. From 10 July 2027 one EU regulation, the Anti-Money Laundering Regulation (AMLR), replaces the different national rules. This article explains in plain words how to decide how deeply to check each customer, what KYC and KYB include, when lighter checks are enough and where payment firms most often fail.<\/p><p class=\"lbm-verified\">Checked on 22 October 2026. Rules and sources are current as of this date.<\/p><ul class=\"lbm-toc\"><li><a href=\"#change\">What is changing<\/a><\/li><li><a href=\"#rba\">Risk-based approach<\/a><\/li><li><a href=\"#kyc\">KYC<\/a><\/li><li><a href=\"#kyb\">KYB<\/a><\/li><li><a href=\"#depth\">Simplified and enhanced<\/a><\/li><li><a href=\"#remote\">Onboarding<\/a><\/li><li><a href=\"#errors\">Common mistakes<\/a><\/li><li><a href=\"#practice\">Regulator practice<\/a><\/li><li><a href=\"#exit\">Refusal and review<\/a><\/li><li><a href=\"#choose\">What to do<\/a><\/li><li><a href=\"#faq\">FAQ<\/a><\/li><\/ul><\/div><\/section><section id=\"change\"><h2>What is changing and when<\/h2><p style=\"max-width:70ch\">Today national laws still apply in the EU, but the rules are moving to one regulation and common standards set by EU bodies.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><h3>The AMLR<\/h3><p>The Anti-Money Laundering Regulation (Regulation (EU) 2024\/1624) sets the duties of companies that must follow anti-money laundering rules, including customer checks. It applies from 10 July 2027.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-layers\"\/><\/svg><\/span><h3>AMLA standards<\/h3><p>AMLA is the new EU Anti-Money Laundering Authority. It has sent the European Commission its final draft technical standards, which say what information and documents to collect when checking a customer. They are proposed to apply six months after they enter into force.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-eye\"\/><\/svg><\/span><h3>EBA guidelines<\/h3><p>The EBA is the European Banking Authority, the EU body that sets common standards for banks and payment firms. Two of its guidelines already apply. One covers money laundering risk factors (EBA\/GL\/2021\/02) and the other covers checking customers remotely (EBA\/GL\/2022\/15, in force since 2 October 2023).<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-globe\"\/><\/svg><\/span><h3>The FATF standard<\/h3><p>FATF is the international body that sets anti-money laundering standards. Its Recommendation 10 is the base. Know who the customer and the real owner are, understand why they need your service and keep watching their transactions, with the depth set by risk.<\/p><\/div><\/div><\/section><section id=\"rba\"><h2>How the risk-based approach works<\/h2><p style=\"max-width:70ch\">The scope of checks follows risk. But the risk has to be assessed and written down, otherwise you cannot defend the approach before a supervisor.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-layers\"\/><\/svg><\/span><h3>Risk of the whole business<\/h3><p>Assess risk across your products, sales channels, customers and countries, and take into account national and EU risk assessments (AMLR, Article 10). Do this before you launch a new product, channel or market.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><h3>Risk of each customer<\/h3><p>How much you check depends on the risks of this customer and this relationship (Article 20). You must be able to show the supervisor at any time that your measures fit the risks.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-pen\"\/><\/svg><\/span><h3>Do not let one factor decide<\/h3><p>Under the EBA guidelines one risk factor alone does not move a customer to another category, and factors can be weighted. Business interests must not influence the rating. If a person overrides an automated score, the reason must be recorded.<\/p><\/div><\/div><\/section><section id=\"kyc\"><h2>KYC: what to check<\/h2><p style=\"max-width:70ch\">The AMLR lists the measures. They apply to every customer, and only the depth depends on risk.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><h3>Who the customer is<\/h3><p>Identify the person and verify identity. Under the draft standards you collect all given and family names from the ID, the place of birth, nationality and an address with country and city.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-ban\"\/><\/svg><\/span><h3>Sanctions and PEPs<\/h3><p>Check the customer and its owners against sanctions lists and find out whether they are politically exposed persons (PEPs), or their relatives or close associates. The draft standards also look at aliases, trade names and crypto wallet addresses.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-clock\"\/><\/svg><\/span><h3>Watching transactions<\/h3><p>Throughout the relationship, check that transactions match what you know about the customer and, when needed, check where the money comes from.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-coin\"\/><\/svg><\/span><h3>When to check<\/h3><p>The AMLR requires checks when the relationship starts, for a one-off transaction of EUR 10,000 or more and, for financial institutions, for a transfer of funds of EUR 1,000 or more (Article 19). FATF uses a threshold of 15,000 for one-off transactions.<\/p><\/div><\/div><\/section><section id=\"kyb\"><h2>KYB: checking a company and its real owners<\/h2><p style=\"max-width:70ch\">For a company the key question is not who signed the application but who really stands behind it and controls it.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><h3>The company<\/h3><p>Record the legal name and the trade name if it differs. Understand what the business does and confirm that the person signing may act for the company.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><h3>Beneficial owners<\/h3><p>A beneficial owner is a person who ultimately owns or controls the company. Identify them and take reasonable steps to verify. A stake of 25% or more normally makes someone an owner, but check control through other means as well, not only when no large shareholder is found.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-list\"\/><\/svg><\/span><h3>Where to verify<\/h3><p>Under the draft standards the sources include public and business registers, databases and reliable data providers. The central register of beneficial owners can be used in low-risk cases, but add information from the customer or other reliable sources.<\/p><\/div><\/div><\/section><section id=\"depth\"><h2>Simplified and enhanced checks<\/h2><p style=\"max-width:70ch\">Risk sets the depth. But neither a lighter nor a stricter check replaces the core measures.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-layers\"\/><\/svg><\/span><h3>Simplified checks<\/h3><p>At low risk you may postpone verifying the customer and its owners, but by no more than 60 days after the relationship starts. You may also update data less often, infer the purpose from the type of transactions and watch transactions less intensively. Monitoring must still be enough to spot unusual and suspicious activity (Article 33).<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-ban\"\/><\/svg><\/span><h3>Not an exemption<\/h3><p>Under the EBA guidelines a simplified check does not replace customer due diligence and cannot be used where money laundering or terrorist financing is suspected. FATF says the same.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-alert\"\/><\/svg><\/span><h3>Enhanced checks<\/h3><p>Needed for higher risk. Complex, unusually large or oddly patterned transactions, and those with no clear lawful purpose, need a close look at where the money comes from and goes. Measures include more information on the customer and owners, the source of funds and wealth, approval by senior management and closer monitoring (Article 34).<\/p><\/div><\/div><div class=\"lbm-cmp\"><table><thead><tr><th>Risk level<\/th><th>Typical profile (example)<\/th><th>Measures<\/th><\/tr><\/thead><tbody><tr><th scope=\"row\">Low<\/th><td>Regulated financial institution, transparent structure<\/td><td>Core checks and lighter measures under Article 33, with the reasons written down<\/td><\/tr><tr><th scope=\"row\">Medium<\/th><td>Typical customer, clear business<\/td><td>Full set of measures under Article 20, standard monitoring<\/td><\/tr><tr><th scope=\"row\">High<\/th><td>Complex structure, PEP, risky country, unusual transactions<\/td><td>Enhanced measures under Article 34, senior management approval, more frequent reviews<\/td><\/tr><\/tbody><\/table><\/div><p style=\"max-width:70ch\">This table is our example of an approach, not a rule of law. Each firm sets its own criteria in its risk assessment.<\/p><\/section><div class=\"lbm-svc\"><div><b>Need help with this topic?<\/b><p>We will review your situation and propose a solution for your project.<\/p><\/div><a class=\"lbm-svc-btn popmake-4929\" href=\"#\" role=\"button\">Contact us<\/a><\/div><section id=\"remote\"><h2>Onboarding customers online<\/h2><p style=\"max-width:70ch\">Most payment providers sign customers up online, and this is where supervisors find most problems.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><h3>Policy and testing<\/h3><p>The EBA guidelines require an approved policy and an assessment of the solution before it goes live. Is the data complete, are the sources reliable, and what are the fraud and impersonation risks.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-eye\"\/><\/svg><\/span><h3>Document and person<\/h3><p>Check security features and signs of tampering, and make sure the document is not just shown on a screen. Liveness detection, which proves a real person is present, is mandatory in all unattended solutions.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-list\"\/><\/svg><\/span><h3>Extra controls<\/h3><p>When needed, add a first payment from an account in the customer&#8217;s name, one-time passcodes or a call. The guidelines presume that solutions based on notified eIDAS electronic identification at substantial or high level, and on qualified trust services, meet the criteria.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-clock\"\/><\/svg><\/span><h3>Ongoing control<\/h3><p>Keep checking data quality, run scheduled and ad hoc reviews, and review affected customers when problems appear.<\/p><\/div><\/div><\/section><section id=\"errors\"><h2>Where payment providers go wrong most often<\/h2><p style=\"max-width:70ch\">The EBA report of 16 June 2023 on money laundering risks in payment institutions shows what supervisors look at.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-eye\"\/><\/svg><\/span><h3>Monitoring<\/h3><p>The EBA says that failure to monitor transactions in a meaningful way is widespread, monitoring systems are weak or missing in many firms and reports of suspicious transactions were rated poor.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><h3>Onboarding and PEPs<\/h3><p>Online onboarding often lacks safeguards, and firms fail to identify high-risk customers, including PEPs.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-layers\"\/><\/svg><\/span><h3>Agents<\/h3><p>There is no common EU approach to agent networks. Agents are often not covered by anti-money laundering rules themselves and work with several providers. The EBA rates the risk of criminals using agents as high.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-alert\"\/><\/svg><\/span><h3>New risks<\/h3><p>The EBA named virtual IBANs, white labelling and third-party acquirers as areas for further assessment.<\/p><\/div><\/div><div class=\"lbm-co dark\"><span class=\"lbm-ico\"><svg><use href=\"#i-alert\"\/><\/svg><\/span><div><b>What this means<\/b><p>The report is from 2023, but it reflects what supervisors think. If you have agents, white label or virtual accounts, describe in advance how you check end customers.<\/p><\/div><\/div><\/section><section id=\"practice\"><h2>Supervisory practice<\/h2><p style=\"max-width:70ch\">The AMLR does not apply yet, so look at what supervisors already punish. Below are two decisions of the UK regulator, the FCA (UK Financial Conduct Authority). They are not EU decisions and both concern banks, but the findings on onboarding, screening and high-risk controls are typical for payment providers too.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-alert\"\/><\/svg><\/span><h3>Monzo, 8 July 2025<\/h3><p>Fine of \u00a321,091,300. From October 2018 to August 2020 the bank accepted limited and sometimes implausible customer information (well-known London landmarks were given as home addresses), and its risk assessment and transaction monitoring were inadequate. From August 2020 to June 2022 it breached a restriction on opening accounts for high-risk customers and signed up more than 34,000 of them. Without the 30% discount for agreeing to settle, the fine would have been \u00a330,130,475.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-alert\"\/><\/svg><\/span><h3>Starling, 2 October 2024<\/h3><p>Fine of \u00a328,959,426. From 2017 its automated system screened customers against only part of the sanctions list. The bank had agreed with the FCA not to open accounts for high-risk customers, but between September 2021 and November 2023 it broke that promise and opened more than 54,000 accounts for about 49,000 such customers. Without the 30% discount the fine would have been \u00a340,959,426.<\/p><\/div><\/div><div class=\"lbm-co info\"><span class=\"lbm-ico\"><svg><use href=\"#i-info\"\/><\/svg><\/span><div><b>What this means<\/b><p>In both cases the customer base grew faster than the controls. Check that screening covers the full list and that a restriction agreed with a supervisor is enforced technically, not only written into a policy.<\/p><\/div><\/div><\/section><section id=\"exit\"><h2>Refusing a customer and checking existing ones<\/h2><p style=\"max-width:70ch\">A check that cannot be completed must end in refusal, and existing customers are not exempt from the new rules.<\/p><div class=\"lbm-roles\"><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-ban\"\/><\/svg><\/span><h3>If the check cannot be completed<\/h3><p>Do not carry out the transaction or start the relationship, end an existing one and consider reporting a suspicious transaction to the financial intelligence unit (AMLR, Article 21). FATF has the same rule.<\/p><\/div><div class=\"lbm-role\"><span class=\"lbm-ico\"><svg><use href=\"#i-clock\"\/><\/svg><\/span><h3>Existing customers<\/h3><p>Under the draft standards, existing high-risk customers must be brought into compliance within one year after the standards apply, and the rest within five years. This is a draft, so the final deadlines depend on what is adopted.<\/p><\/div><\/div><\/section><section id=\"choose\"><h2>What to do now<\/h2><p style=\"max-width:70ch\">Most of the preparation does not depend on when the standards are adopted.<\/p><ol class=\"lbm-steps\"><li><span class=\"lbm-ico\"><svg><use href=\"#i-doc\"\/><\/svg><\/span><div><h3>Update the risk assessment of the whole business<\/h3><p>Products, channels, customer groups, agents and countries. Record the assessment and the review dates.<\/p><span class=\"lbm-tag\">Start here<\/span><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-layers\"\/><\/svg><\/span><div><h3>Describe the customer risk model<\/h3><p>Which factors you consider, how you weight them, who may override a rating and how overrides are recorded.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-user\"\/><\/svg><\/span><div><h3>Build a KYB procedure<\/h3><p>Ownership chart, beneficial owners with a check of control through other means, authority of representatives and verification sources.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-globe\"\/><\/svg><\/span><div><h3>Review online onboarding<\/h3><p>The solution, liveness and document checks, and extra measures for high risk.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-eye\"\/><\/svg><\/span><div><h3>Review monitoring and agents<\/h3><p>Scenarios, thresholds and alert handling, and checks on customers brought in through agents and white label.<\/p><\/div><\/li><li><span class=\"lbm-ico\"><svg><use href=\"#i-clock\"\/><\/svg><\/span><div><h3>Draft a transition plan<\/h3><p>Deadlines up to 10 July 2027 and the review of existing customers under the draft standards.<\/p><\/div><\/li><\/ol><div class=\"lbm-co dark\"><span class=\"lbm-ico\"><svg><use href=\"#i-alert\"\/><\/svg><\/span><div><b>Benchmark<\/b><p>The AMLR applies from 10 July 2027, while the AMLA standards will apply once the Commission adopts and publishes them. Tie your plan to the first date.<\/p><\/div><\/div><\/section><figure class=\"lbm-pull\"><q>A risk-based approach works only as long as you can show how you assessed the risk.<\/q><cite>The LegalBit team<\/cite><\/figure><section id=\"faq\"><h2>Frequently asked questions<\/h2><div class=\"lbm-faq\"><details><summary>What is the risk-based approach?<\/summary><p>It is not a way to skip checks but a way to choose their depth by risk. All core measures apply to every customer, but their scope depends on the risk assessment.<\/p><\/details><details><summary>Can we rely on the central beneficial ownership register?<\/summary><p>Under the draft standards it may be used in low-risk cases, but the information must be supplemented with customer data or other reliable sources.<\/p><\/details><details><summary>What if a customer does not provide documents?<\/summary><p>If the check cannot be completed, the firm does not carry out the transaction or start the relationship, ends existing ones and considers a report to the financial intelligence unit (AMLR, Article 21).<\/p><\/details><details><summary>When will the AMLA standards apply?<\/summary><p>The final drafts have been sent to the Commission. After adoption and publication in the Official Journal they are proposed to apply six months after entry into force, while the AMLR itself applies from 10 July 2027.<\/p><\/details><\/div><p class=\"lbm-more\"><b>See also: <\/b><a href=\"\/en\/travel-rule-crypto\/\">Travel Rule for crypto businesses<\/a>; <a href=\"\/en\/payment-institution-emi-licence-eu-uk-canada\/\">EMI and payment institution licence in the EU, UK and Canada<\/a>; <a href=\"\/en\/transaction-laundering-and-miscoding\/\">Transaction laundering and miscoding<\/a>; <a href=\"\/en\/payfac-sub-merchant-liability\/\">Payment Facilitators, Aggregators and ISOs: Who Is Responsible for Sub-Merchants<\/a>; <a href=\"\/en\/igaming-responsible-gambling-aml\/\">Responsible gambling and AML for operators<\/a>; <a href=\"\/en\/accepting-crypto-payments-business\/\">Accepting crypto payments in business<\/a>. Services: <a href=\"\/en\/regulatory-and-compliance\/\">regulatory and compliance<\/a>.<\/p><div class=\"lbm-src\"><b>Sources<\/b><ul><li><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1624\/oj\" rel=\"nofollow noopener\" target=\"_blank\">EUR-Lex: Regulation (EU) 2024\/1624 on the prevention of the use of the financial system for money laundering (AMLR)<\/a><\/li><li><a href=\"https:\/\/www.amla.europa.eu\/press-release-amla-finalises-key-standards-private-sector_en\" rel=\"nofollow noopener\" target=\"_blank\">AMLA: Press release, AMLA finalises key standards for the private sector<\/a><\/li><li><a href=\"https:\/\/www.amla.europa.eu\/system\/files\/2026-09\/Factsheet%20on%20RTS%20under%20Article%2028(1)%20AMLR.pdf\" rel=\"nofollow noopener\" target=\"_blank\">AMLA: Factsheet on RTS on Customer Due Diligence under Article 28(1) AMLR<\/a><\/li><li><a href=\"https:\/\/www.amla.europa.eu\/policy\/public-consultations\/consultation-draft-rts-customer-due-diligence_en\" rel=\"nofollow noopener\" target=\"_blank\">AMLA: Consultation on the draft RTS on Customer Due Diligence<\/a><\/li><li><a href=\"https:\/\/www.eba.europa.eu\/sites\/default\/files\/document_library\/Publications\/Guidelines\/2023\/EBA-GL-2023-03\/1061654\/Guidelines%20ML%20TF%20Risk%20Factors_conslidated.pdf.pdf\" rel=\"nofollow noopener\" target=\"_blank\">EBA: Guidelines on ML\/TF risk factors, EBA\/GL\/2021\/02 (consolidated)<\/a><\/li><li><a href=\"https:\/\/www.eba.europa.eu\/sites\/default\/files\/document_library\/Publications\/Guidelines\/2022\/EBA-GL-2022-15%20GL%20on%20remote%20customer%20onboarding\/1043884\/Guidelines%20on%20the%20use%20of%20Remote%20Customer%20Onboarding%20Solutions.pdf\" rel=\"nofollow noopener\" target=\"_blank\">EBA: Guidelines on the use of Remote Customer Onboarding Solutions, EBA\/GL\/2022\/15<\/a><\/li><li><a href=\"https:\/\/www.eba.europa.eu\/sites\/default\/files\/document_library\/Publications\/Reports\/2023\/1056453\/Report%20on%20ML%20TF%20risks%20associated%20with%20payment%20institutions.pdf\" rel=\"nofollow noopener\" target=\"_blank\">EBA: Report on ML\/TF risks associated with payment institutions (16.06.2023)<\/a><\/li><li><a href=\"https:\/\/cfatf-gafic.org\/index.php\/documents\/fatf-40r\/376-fatf-\" rel=\"nofollow noopener\" target=\"_blank\">FATF Recommendation 10: Customer due diligence (text published by CFATF)<\/a><\/li><li><a href=\"https:\/\/www.fca.org.uk\/news\/press-releases\/fca-fines-monzo-21m-failings-financial-crime-controls\" rel=\"nofollow noopener\" target=\"_blank\">FCA: Press release, FCA fines Monzo \u00a321m for failings in financial crime controls (8 July 2025)<\/a><\/li><li><a href=\"https:\/\/www.fca.org.uk\/news\/press-releases\/fca-fines-starling-bank-failings-financial-crime-systems-and-controls\" rel=\"nofollow noopener\" target=\"_blank\">FCA: Press release, FCA fines Starling Bank \u00a329m for failings in financial crime systems and controls (2 October 2024)<\/a><\/li><\/ul><\/div><\/section><\/div>\n\n\n\n<div class=\"lb-ac\"><h2>This is what we do<\/h2><p>How we help payment and fintech companies:<\/p><ul><li><a href=\"https:\/\/legalbit.top\/en\/regulatory-and-compliance\/\">Regulatory and compliance<\/a><\/li><li><a href=\"https:\/\/legalbit.top\/en\/risk-assesment-consulting\/\">Risk assessment<\/a><\/li><\/ul><\/div>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"BlogPosting\", \"headline\": \"KYC and KYB for Payment Providers: Building a Risk-Based Customer Due Diligence Programme\", \"description\": \"What the AMLR, AMLA standards, EBA guidelines and FATF require of a payment provider: risk assessment, KYC, KYB, beneficial owners, enhanced checks, onboarding.\", \"url\": \"https:\/\/legalbit.top\/en\/kyc-kyb-payment-providers\/\", \"mainEntityOfPage\": \"https:\/\/legalbit.top\/en\/kyc-kyb-payment-providers\/\", \"image\": \"https:\/\/legalbit.top\/wp-content\/uploads\/2026\/10\/kyb_fintech-scaled.webp\", \"datePublished\": \"2026-10-22T09:45:00Z\", \"dateModified\": \"2026-10-22T09:45:00Z\", \"inLanguage\": \"en\", \"author\": {\"@type\": \"Organization\", \"name\": \"LegalBit\", \"url\": \"https:\/\/legalbit.top\/\"}, \"publisher\": {\"@type\": \"Organization\", \"name\": \"LegalBit\", \"url\": \"https:\/\/legalbit.top\/\"}}<\/script>\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"What is the risk-based approach?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"It is not a way to skip checks but a way to choose their depth by risk. All core measures apply to every customer, but their scope depends on the risk assessment.\"}},{\"@type\":\"Question\",\"name\":\"Can we rely on the central beneficial ownership register?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Under the draft standards it may be used in low-risk cases, but the information must be supplemented with customer data or other reliable sources.\"}},{\"@type\":\"Question\",\"name\":\"What if a customer does not provide documents?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"If the check cannot be completed, the firm does not carry out the transaction or start the relationship, ends existing ones and considers a report to the financial intelligence unit (AMLR, Article 21).\"}},{\"@type\":\"Question\",\"name\":\"When will the AMLA standards apply?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The final drafts have been sent to the Commission. After adoption and publication in the Official Journal they are proposed to apply six months after entry into force, while the AMLR itself applies from 10 July 2027.\"}}]}<\/script>\n","protected":false},"excerpt":{"rendered":"<p>Know your customer (KYC) and know your business (KYB) are the checks a payment company runs on its clients before and during the relationship. Banks, card schemes and supervisors judge you by how well you do them. From 10 July 2027 one EU regulation, the Anti-Money Laundering Regulation (AMLR), replaces the different national rules. This [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":7652,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[82],"tags":[105,115,112,138,120,114,117],"post_folder":[],"class_list":["post-7653","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance-and-aml","tag-aml","tag-compliance","tag-eu","tag-fatf","tag-fintech","tag-kyc","tag-payments"],"_links":{"self":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts\/7653","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/comments?post=7653"}],"version-history":[{"count":24,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts\/7653\/revisions"}],"predecessor-version":[{"id":8177,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/posts\/7653\/revisions\/8177"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/media\/7652"}],"wp:attachment":[{"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/media?parent=7653"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/categories?post=7653"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/tags?post=7653"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/legalbit.top\/en\/wp-json\/wp\/v2\/post_folder?post=7653"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}