Strengthening the KYC process by averting these 12 common mistakes
With the rise in financial crimes, Know Your Customer (KYC) has become a critical part of the anti-money laundering (AML) strategy for regulated entities, including financial institutions, Designated Non-Financial Businesses and Professions and IFSCA-regulated entities.
The Prevention of Money Laundering Act, 2002 (PMLA) and IFSCA (AML, CFT, and KYC) Guidelines, 2022 require regulated entities to undertake relevant AML measures, including Customer Due Diligence to prevent money laundering. As a key component of Customer Due Diligence, KYC helps regulated entities identify suspicious customers.
KYC is about identifying the customer, the beneficial owners and the beneficiaries and verifying their identities before establishing a business relationship. In the course of KYC, the regulated entities get to know the customers’ true identities, based on which the entity can decide whether to work with them or not. Thus, with KYC, the regulated entities can shield the business from the financial criminals and the ill effects of money laundering and terrorism financing.
The KYC process is not as straightforward as it looks. KYC must be attended with full attention to avoid the common mistakes. It is a critical function to help optimize the AML compliance efforts.
So, let’s dive into the common mistakes necessary to avoid the same to strengthen the KYC process and implement it as an invaluable foundation of AML compliance.
Top KYC blunders to avoid
Concerning the AML regulatory provisions for India, the regulated entities must implement and carry out KYC for all their customers, suppliers and associated business partners. The regulated entity must follow the key best practices to avert these common mistakes. If not, the reporting entity might be vulnerable to financial crime, making it a costly and time-consuming affair to mitigate and manage risks. These standard errors around KYC are:
Considering KYC an administrative task and not a value addition exercise
Yes, KYC is essential for AML compliance. The entity must identify and verify its customers to determine their risk profiles. But generally, it has been observed that the entities consider it as an administrative task. KYC is perceived as a task that hinders routine business operations. A costly task. A regulatory burden to carry.
But that won’t be a wise standpoint.
The KYC process is more than a compliance requirement. With KYC, the entities can identify the customers and collate the necessary information to determine the customer’s risk profile. It can help the entity reduce risks and protect the revenues and business operations from money laundering threats.
Thus, the entities can save the brand reputation from going awry. To enjoy these benefits, viewing KYC as a strategic initiative is essential. A value-adding exercise for the business, not just restricted to compliance needs. A way to allow honest customers to use the products and services and block the dishonest and illegal ones.
Losing sight of the changes in AML and KYC regulations
In the current dynamic times, regulations evolve now and then. As and when new threats arise, regulators make changes in AML regulations. So, the provisions become tighter. These evolving laws can lead to amendments in KYC requirements.
The regulated entity must keep track of these changes. If the entity misses the changes, the KYC procedures will be incomplete and ineffective. The KYC procedures must align or adjust to local laws and industry standards. Ignoring them can lead to blunders in the KYC, leading to non-compliance, fines, and other problems like engagement with criminals.
Absence of a proper plan for conducting the KYC process
KYC is a cumbersome process. It consumes a lot of time. It can be tiresome for teams and customers. KYC requires the collection of many data points on each customer and managing the customer onboarding process. Whatever it may require, it is essential and critical for AML compliance. So, having a proper plan for KYC is a must.
Before engaging in routine KYC tasks, the entity must make a plan with details on information points, processes, resources responsible, and timelines, i.e., a detailed KYC Program. The entity must define the workflow for KYC. It includes coordination points between compliance, business, and technical teams. The reporting entity can have a successful execution of KYC processes only when a sturdy KYC plan exists.
A shortage of budget for KYC
KYC is essential for reporting entities to achieve AML compliance. The entities must continuously conduct the KYC as and when new customers are onboarded or there are changes in the existing customers’ details. Thus, constant monitoring of all existing customers is also critical.
All these activities need a proper amount of time and money investment. Investment in terms of technology, skilled human resources, and employee hours. So, the regulated entity must make a proper budget allocation for KYC. It is an expensive exercise, but it can keep the business safe from financial crime threats.
Inadequate, outdated, or incomplete data on customers
The KYC process involves identifying and verifying customers before forming a business relationship. It is essential to avoid the threats of money laundering and terrorism financing. So, the entity must be cautious in its execution.
The KYC process is incomplete if data points are missed, or the entity forgets to collect a few details on a customer. Also, outdated data will lead to outdated results. The data gaps can mar the entity’s compliance efforts.
Data quality ensures detailed and insightful customer risk assessment. If any details are missed, the customer might prove risky even though the entity may have put them on a no-risk or low-risk list. This impacts the business operations. So, it’s better to ensure data security, integrity, accuracy, and quality. Such quality data ensures a comprehensive assessment of each customer during the complete Customer Due Diligence process.
No use of technology for the KYC process
The KYC process requires the regulated entity to collect and analyse customer data. The entity must verify the data with identity documents and other reliable, independent sources.
If this process is managed manually, errors, duplication, or missing data are possible, resulting in flaws in the KYC process. It affects the business, exposing it to higher threats of money laundering and other financial crimes.
One of the recommended solutions is to use technological systems for KYC. Such technology automates the process around customer data collection, organization, cleansing, categorization, or analysis. Thus, it saves time, costs, and effort, increasing efficiency and effectiveness in the KYC process.
Engaging unskilled and untrained employees in KYC exercise
High-tech people are committing financial crimes. They identify loopholes in processes or technologies and use them to their advantage. They find innovative ways to launder money and commit fraud. If the fraudsters are proficient and capable in their work, how can an unskilled worker be expected to identify such crimes?
So, the regulated entity must engage knowledgeable, experienced, and skilled people for AML activities. Similarly, the engagement of well-trained and qualified persons to carry out the KYC process is also necessary. They must understand different red flags that may be observed during the customer identification or verification process, including risk indicators related to customer behaviour. They must undergo training around details and documents to be verified to conclude the KYC process better.
Not using multiple, credible data sources
The regulated entities should rely on more than one source to verify the customers’ identities. Some of the examples of credible data sources include:
- Ministry of Corporate Affairs’ list of businesses
- List of GST taxpayers
- Industry associations’ list of firms
- List of corporate taxpayers
- List of PEPs
- Sanction lists
- Credit reports of companies
- Global watchlists
Checking and verifying the customer’s identity on multiple reliable sources boosts the confidence that the entity is dealing with the right customers.
Lack of communication and coordination between departments and teams handling KYC
The regulated entity may have a dedicated team to handle the KYC process, with different sub-teams working on different tasks. For example, one team collects data while the other verifies the collected information.
The entity must ensure communication among the team members and data sharing for a smooth process. The entity can also create a shared database of customers with accessibility permissions so that team members work on the same data sets. They must coordinate with each other to build the customer’s risk profile.
A small communication gap might ruin all the AML efforts, affecting the quality of the KYC process.
Asking for too much or too little information
Keep the KYC forms in optimum sizes. The entity cannot keep it so long that potential customers lose interest in forming a business relationship. Also, it cannot be too short that the form does not serve informational purposes, necessary to identify the customer and assess the customer risk. So, try to have all the necessary questions in it. Also, ask for necessary proof and documents to verify the information provided.
If necessary, information is excluded, and the regulated entity cannot create a risk profile. The available information will be insufficient to know whether the client is risky or not. If too many unnecessary data points are included, irrelevant as AML measures, clients will find it a prolonged, tedious exercise. This will demotivate the customer, resulting in business loss.
The mandatory compliance needs and the good-to-have details necessary for understanding the risk posed by the business relationship must be included in the KYC form.
Ignoring customer experience for KYC
We all know how tiresome and time-consuming exercise KYC is! No one would like to fill out lengthy forms every year. Or visit the office to submit documents for verification. Remote verification is not possible in some cases. These are all the situations that can make the business lose potential customers or move to its competitors.
So, it becomes crucial to focus on improving customer experiences. Yes, digitalization is a solution. However, it must align with overall operations and the AML compliance requirements. The regulated entity can use customized, automated solutions to improve customer interaction with the system.
Disregarding the importance of continuous monitoring – KYC Remediation
Constant monitoring of customers is essential to track the changes in customer details and know the changes in their risk level.
KYC is not a one-time activity. Instead, the KYC process includes KYC remediation, focusing on the ongoing review of the customer’s information to identify the changes in the customer’s information and determine if the customer’s details submitted earlier are valid and whether the originally assessed risk holds good.
Ignoring KYC remediation or lapses in the continuous monitoring of the customer profile may lead to exploitation of the business by the customers originally tagged as low-risk and, thus, imposition of non-compliance penalties and reputational damage.
Thus, monitoring the customers’ details and documents is an excellent practice.
AML India – the help you need for KYC
So, with this list of blunders to be avoided while conducting KYC, the entity must develop and implement a smooth, seamless, and accurate process to generate quality KYC outcomes. These results help the entity in preventing money laundering and terrorism financing.
And if any professional support around KYC compliance is needed, AML India is the best partner.
AML India is a distinguished provider of AML compliance services in India. We help the reporting entities comply with all the AML requirements, ensuring the entity is ready to safeguard itself from money laundering threats.
We also enable the entities to comply with the KYC requirements in accordance with India’s AML regulations. We help design a customized KYC plan and program to collate necessary customer information and verify identities.
About the Author
Pathik Shah
FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)
Pathik is a Chartered Accountant with more than 25 years of experience in compliance management, Anti-Money Laundering, tax consultancy, risk management, accounting, system audits, IT consultancy, and digital marketing.
He has extensive knowledge of local and international Anti-Money Laundering rules and regulations. He helps companies with end-to-end AML compliance services, from understanding the AML business-specific risk to implementing the robust AML Compliance framework.
