People look for the know your customer law and find that there is not one. The obligations that firms describe as KYC are spread across statute, regulation and supervisory expectation, and which of them reach a given firm depends on what that firm is. This page maps the layers rather than pretending to a single source, and is clear about where a software site stops and your counsel starts.
Three layers, not one law
The first layer is statute, which requires certain financial institutions to run anti-money-laundering programmes at all. The second is regulation, which is where the specifics live: identifying customers, identifying the beneficial owners behind legal entity customers, keeping records and keeping them for a stated period. The third is supervisory expectation and examination practice, which is where a firm learns what its regulator considers adequate. Firms get into difficulty by reading only the second layer and treating it as a ceiling.
Whether it reaches you is the first question
The rules are written by institution type. A bank, a broker-dealer, a money services business and a futures commission merchant are each addressed separately, and plenty of firms that describe themselves as fintechs are regulated through a partner rather than directly. That is the question to settle before anything else, and it is not one a website can settle for you. What is safe to say is that firms in this position generally end up holding the same file whether the obligation is theirs or their partner's, because the partner asks for it.
To define KYC usefully, define the file
The acronym is not defined anywhere authoritative, which is why every vendor defines it as whatever they sell. The definition that survives contact with an examiner is a practical one: knowing who your customer is, holding the evidence, rating the risk they represent, and keeping that judgement current. Anything that helps you produce those four things is KYC. Anything that does not is a feature.
Questions people ask about know your customer laws
Is there a single know your customer law?
No. There is a stack of statute, regulation and supervisory expectation, and which parts apply depends on what kind of firm you are. Treating one regulation as the whole obligation is a common and expensive mistake.
Do these rules apply to a startup that is not a bank?
Sometimes directly, often indirectly through a partner bank or a sponsor that imposes the same requirements contractually. Either way the practical outcome is usually the same: somebody will ask you to produce customer files, and you will need them.
Can this site tell us what applies to us?
No, and it will not try. This is software for keeping the file. Whether a rule reaches your business is a question for your own policy and your own counsel, and we would rather say so plainly than imply otherwise.