What you should know about customer due diligence and onboarding

An estimated $800 billion - $2 trillion enters the global financial system every year from unknown sources. These funds often come from illegal organizations used to finance criminal activity, such as drug trafficking, terrorism, and financial crimes using the global financial infrastructure, or for purposes involving tax evasion.

This practice is known as “money laundering,” and has caused national and international organizations committed to protecting our financial infrastructure to fight back with measures known as “anti-money laundering” regulations, or “AML” for short. 

AML regulations require financial institutions to take measures to identify who they are doing business with. By verifying the identities of customers and business partners, financial institutions aim to reduce the risk of bad actors using their infrastructure to introduce illicit funds into the financial system. 

As the technology used for customer due diligence and onboarding has developed over the years, companies beyond the scope of traditional financial institutions have stepped in to enforce AML measures. From payment providers to technology platforms, or even founders raising capital, AML measures have become widely accepted as a best practice for getting to know the customers and partners you’re doing business with.

When implemented correctly, AML solutions help businesses stay compliant with regional and international regulations, build trusted relationships with their partners and customers, and help customers maintain confidence that their institutions are only servicing the legal and legitimate needs of their customers. 

Who regulates AML rules?

AML regulations around the world have developed since the 1970s when the United States passed the Bank Secrecy Act (BSA). It was the first AML legislation enacted that created rules for recordkeeping, customer identification, and special reporting of large cash transactions. 

Following the passage of the BSA, AML legislation continued to grow internationally with the creation of the Financial Action Task Force on Money Laundering (FATF) amongst G7 countries, new initiatives in the European Union, and eventually regulations across the MENA region throughout the 2000s and 2010s. 

How companies stay compliant with AML regulations

Companies are required to design an AML program that effectively verifies the identity of their customers and prevents money laundering. Many regional regulatory bodies enforce best practices set by the FATF.

Key components of an effective AML program include assigning a dedicated compliance team, creating internal procedures, conducting employee training, and chief among them, performing customer due diligence, also known as Know Your Customer (KYC). 

KYC—a critical component of an effective AML program—is a process designed to collect information and verify the legitimacy of your customers and business partners.

By using a risk-based approach to customer due diligence, companies aim to monitor both who they are dealing with and the nature of transactions that are occurring.

What does this process entail?

Depending on the nature of your business—who your stakeholders are and how you allocate resources across your company—your internal KYC procedures will likely differ. At its essence, your KYC process should seek to understand your customers’ overall profile, source of wealth and funds.

For financial institutions, the following personal information is commonly collected in order to execute their KYC processes: 

• Full name
• Contact details
• Date of Birth
• Nationality, with ID copies
• Country of residence and address
• Employment details and source of wealth
• Supporting documents (Proof of Address, Employment, and Source of Wealth corroboration as relevant, as well as professional online presence)
• Declarations regarding Politically Exposed Person (PEP) status, Source of Wealth, and others depending on jurisdiction / regulatory requirements
• Tax residency details

Document verification is often required as well (either digital or through certifications from authorized third parties, such as lawyers)

When customer due diligence needs to be conducted on an entity, the process is similar to KYC, however, the type of information collected will be a little different. This process is known as Know Your Business (KYB). Information collected can include: 

1) Company's constitutional documents

• This includes documents such as the Certificate of Incorporation, Articles of Association, Commercial License, Certificate of Incumbency or an equivalent depending on the jurisdiction of incorporation.

2. Ownership and Structure

• Register of Shareholders or the Ultimate Beneficial Owners (“UBOs”), Authorized Signatories, and Directors (including supporting documents).
• If an entity is part of a Group Holding structure, a full company structure chart showing relationships and ownership percentages of the related entities (as well as the relevant constitutional documents).

3. Proof of address and ID for UBOs, Directors and Authorized Signatories

• For UBOs, there is usually a threshold (e.g. for those holding above 10%, 25%, or greater depending on the jurisdiction).
• For proof of residential address, these documents are often required to be issued and dated within the last 3 months and certified (or otherwise verifiable) to be accepted.

4. Source of wealth or funds

• This includes a detailed list of the company's business activities, source of wealth, and source of funds for the company.
• Supporting documents substantiating the same (such as audited financial statements, bank statements or similar) may be requested.

If the initial verification checks indicate that a potential customer or business partner may be suspicious, the internationally recognized standard of a risk-based approach supports companies in performing enhanced due diligence on the individual or business. There are also certain procedures related to notifying the relevant regulatory body of any suspicious activities detected.  

Measures that companies take to address high-risk individuals

When an individual or business is deemed to present a high risk of being a bad actor or participating in illicit financial activities, companies must conduct further risk assessments, known as enhanced due diligence.

While there is no single objective measure that makes a person high risk, companies can follow international best practices for performing enhanced due diligence. Some common red flags for potentially high-risk people include:

• Has a history of committing financial crimes
• Is considered a politically exposed person (government officials, their relatives, and close associates)
• Works in an industry with a high risk of money laundering, such as owning a restaurant, a trading business, or other cash-heavy business types.
• Uses funds may originate from a sanctioned country
• Is on a sanctions list as an individual or business entity, or is located in a “high-risk” country 
• Has unusual transaction patterns
• Is providing inconsistent information regarding UBOs

A company’s specific AML procedures will determine its strategy when conducting enhanced due diligence on a high-risk person. Ultimately, the company’s goal is to further investigate the identity of the prospect, corroborate personal information with additional documentation, confirm their funds are from legitimate sources, and ensure that the person is acting in good faith and not trying to conduct any illicit activities. 

Depending on the company, enhanced due diligence may look like:

• Requesting supporting identity verification and proof of address
• Requiring additional documentation to show the source of wealth or funds
• Investigate media coverage of prospects and related people to identify past illicit activity 
• On-site visit with the prospect to physically match their identification to themselves
• Continuous monitoring of trade and money movement activity

Companies have their own guidelines when dealing with potentially high-risk customers and may determine a customer cannot be onboarded based on the outcome of their enhanced due diligence findings. 

The benefits of a fully digitized AML program

A robust AML program involves the collection of many documents and a thorough review of a prospective customer. 

Historically, manual KYC processes would take longer and present a security risk of keeping personal information confidential. 

Today, emerging technology service providers leverage a fully digitized approach to customer due diligence which has been shown to improve the customer experience, reduce the time it takes for most customers to be approved, and enhance the security of personal identification information through digital KYC modules, resulting in a seamless investor onboarding experience. 

AML programs around the world make our global financial infrastructure safer and more trustworthy for the billions of people who transact every day. 

Why does this matter in venture-backed companies?

As a venture-backed company, a meaningful part of your job is staying well-capitalized. To do this, you’ll have to raise capital from investors, often several times over the years. It’s critical that you understand who your stakeholders are before you enter into a decades-long relationship with them as you grow your business. Not only does this apply to the shareholders on your capitalization table, but also to your employees, suppliers, and business partners. 

Conducting due diligence on all stakeholders is a responsible measure to ensure long-term sustainability in your business relationships. 

How Zest can help 

As part of the MENA ecosystem, we are doing our part to ensure private market transactions occur among trusted and verified participants. We provide the tools to conduct and enhance KYC/KYB processes and keep your personal information confidential. 

We believe that over time, knowing your investors and business partners will become common practice in private market transactions. 

Get started with Zest today.