Insight
What are KYC and customer due diligence?
In short
Know your customer (KYC) is the process of establishing and verifying who a customer is before doing business with them. Customer due diligence (CDD) is the wider discipline that KYC sits inside: understanding the purpose of the relationship, identifying any beneficial owner, checking for politically exposed persons, assigning a risk rating and reviewing all of it periodically. Enhanced due diligence (EDD) is the deeper version applied to higher-risk customers.
The distinction that trips most institutions up is between identification and verification. Writing down a name and NRC number is identification. Confirming that the number is real and belongs to the person in front of you is verification, and it is verification that a supervisor will test.
Identification versus verification
Identification collects the customer's details: full name, date of birth, nationality, identification number, address and, for a business, its registration details. Verification checks those details against an independent, reliable source. For individuals in Zambia that source is the NRC, issued by the Department of National Registration, Passport and Citizenship, or a passport. For companies it is the PACRA register and, where relevant, the ZRA taxpayer record.
A photocopy of an NRC proves that a document was presented. Checking the number against the registry proves the document is genuine and current. The registry verification page explains what each Zambian registry can confirm.
Purpose and nature of the relationship
CDD asks why the customer wants the account or policy and what activity to expect: salary deposits, trading receipts, remittances from abroad. This expected profile is what transaction monitoring later measures actual activity against. A profile that is never recorded cannot be monitored.
Beneficial ownership
When the customer is a company, trust or other legal arrangement, CDD must identify the natural persons who ultimately own or control it, the beneficial owners. This means walking up the ownership chain until real people are reached, recording their details, verifying them and screening them. Layered structures across several jurisdictions are a red flag in themselves.
Politically exposed persons
A politically exposed person (PEP) holds, or has held, a prominent public function, and the definition extends to family members and close associates. PEPs are not prohibited customers, but the corruption risk associated with public office means they attract enhanced due diligence: senior-management approval to onboard, source-of-wealth enquiries and closer monitoring. Screening against a PEP list, including the FIC's domestic list, is how most institutions identify them.
Risk rating and enhanced due diligence
Each customer receives a risk rating, typically low, medium or high, based on factors such as customer type, products used, geography and PEP status. The rating drives how much due diligence is done and how often it is refreshed. High-risk customers get EDD: more documentation, verified source of funds and wealth, and senior sign-off.
- Low risk: standard identification and verification, periodic review on a longer cycle.
- Medium risk: standard CDD with closer monitoring of the expected profile.
- High risk: EDD, senior approval, shorter review cycle and event-driven re-rating.
Periodic and event-driven review
Due diligence decays. Documents expire, directors change, a customer becomes a PEP. Institutions therefore refresh CDD on a cycle tied to the risk rating, and re-rate a customer whenever a trigger event occurs, such as a screening hit, a large unexpected transaction or a change in ownership. The review should be recorded with the same care as the original onboarding.
How ERMAML handles this
ERMAML, the Ontech Risk & Compliance Suite, runs onboarding workflows with live NRC, PACRA and ZRA registry checks, a beneficial-ownership walk-through with verification evidence, PEP and sanctions screening in the same pass, event-driven risk re-scoring, an EDD workflow with form and reviewer, a versioned document vault with renewal alerts, and periodic review cadenced by risk tier. See KYC and customer due diligence.
Frequently asked questions
What is the difference between KYC and CDD?
KYC is the identification and verification of who a customer is. CDD is the broader process that includes KYC and adds the purpose of the relationship, beneficial ownership, PEP checks, risk rating and ongoing review. In everyday use the terms overlap, but supervisors expect all of the CDD elements, not just identity.
What is enhanced due diligence?
The deeper due diligence applied to higher-risk customers such as PEPs, customers from high-risk jurisdictions or complex corporate structures. It typically adds source-of-funds and source-of-wealth enquiries, extra documentation, senior-management approval and closer, more frequent monitoring.
Do we need to verify an NRC, or is a copy enough?
Good practice is to verify. A copy shows a document was presented; checking the NRC against the national registry confirms it is genuine and belongs to the person. Confirm your regulator's current expectations, which increasingly favour registry verification.
How often should KYC be reviewed?
On a cycle set by the customer's risk rating, with high-risk customers reviewed most often, and immediately when a trigger event occurs such as a screening hit or ownership change. The intervals are a policy decision that the institution should document.
Sources
See ERMAML on your own data
Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.