When knowing the customer is no longer enough
Knowing who a customer is has long been a cornerstone of financial crime compliance. Know Your Customer (KYC) processes help financial institutions establish customer identities, verify information and understand the individuals and businesses they serve.
Yet identity verification is only one part of understanding financial crime risk.
Customer information is typically collected during onboarding, when individuals or businesses first establish a relationship with a financial institution. Over time, however, circumstances change. Customer activities evolve, transaction patterns shift and information that was once accurate may no longer reflect the customer's current profile.
For UK banks and financial institutions operating in an increasingly digital financial environment, relying solely on information gathered at onboarding can leave important gaps in the understanding of customer risk.
This is where the concept of Know Your Data (KYD) becomes relevant.
Rather than treating customer information as a static record, KYD places greater emphasis on the quality, relevance and context of the data used to inform compliance decisions. It encourages institutions to look beyond declared information and consider what other available data may reveal about customer behaviour, relationships and potential risk.
The shift is not about replacing KYC. It is about building on its foundations to develop a more complete, data-aware approach to customer due diligence.
From customer identity to customer context
Traditional KYC establishes an essential starting point: who the customer claims to be and whether that identity can be verified.
A broader, data-aware approach asks additional questions. Does the available information remain accurate? Is the customer's activity consistent with their stated profile? Are there changes or inconsistencies that warrant further investigation?
Answering these questions requires institutions to consider information from multiple relevant sources, rather than relying on a single customer record.
Digital presence and publicly available information.Relevant online information may help institutions understand a customer's professional background, business relationships or public profile. Where discrepancies emerge between available information and the customer's declared circumstances, these may warrant further assessment.
Screening and adverse information.Screening against relevant sanctions lists, politically exposed person (PEP) information, adverse media and other applicable risk sources can help identify potential exposure that may not be apparent from onboarding documentation alone.
Transaction data and behavioural patterns.Transaction activity can provide valuable context about how a customer uses an account or financial service. Changes in transaction frequency, value, counterparties or other behavioural patterns may indicate a need to reassess the customer's risk profile.
These sources should not be viewed in isolation. An unusual transaction or an inconsistency in publicly available information does not, by itself, establish wrongdoing. The objective is to bring relevant information together so that compliance teams can assess risk more accurately and make better-informed decisions.
For UK financial institutions managing diverse customer bases and complex financial relationships, this wider perspective can support a more dynamic approach to customer risk.
How KYD strengthens customer due diligence
Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) depend on having relevant, reliable information about the customer and the risks associated with the relationship. A data-aware approach can strengthen these processes in several ways.
More informed compliance decisions.When decisions are based on multiple relevant sources of information, compliance teams can develop a more complete picture of a customer's circumstances. This helps move assessments beyond isolated data points towards a better understanding of the wider context.
A clearer view of changing risk.Customer risk is not necessarily fixed at the point of onboarding. Changes in behaviour, financial activity or other relevant circumstances may require institutions to review their initial assessment. Using available data to identify meaningful changes can support more timely reviews and help ensure that customer profiles remain relevant.
More targeted risk assessment.Different customers present different levels and types of risk. A broader understanding of customer information can help institutions identify specific areas that require attention, rather than relying exclusively on generic customer categories or static profiles.
Stronger support for regulatory compliance.Reliable customer information and appropriate monitoring help financial institutions demonstrate that their compliance decisions are informed by relevant evidence. A data-aware approach can also support more consistent application of risk-based controls across customer relationships.
The value of KYD therefore lies not in collecting the largest possible volume of information, but in identifying and using the right information to support proportionate, explainable compliance decisions.
The challenge of data quality and governance
A broader approach to customer information also brings greater responsibility.
More data does not automatically lead to better decisions. Incomplete records, outdated information, inconsistent formats and inaccurate customer profiles can weaken risk assessments and affect the reliability of compliance processes.
For example, an outdated customer profile may cause legitimate activity to appear unusual. Inaccurate or incomplete information may also make it harder for investigators to distinguish genuine risk from a false alert.
Financial institutions therefore need to consider not only what information they can access, but also whether it is accurate, relevant, sufficiently current and appropriate for the intended purpose.
This requires a structured approach to data governance, including:
- Accuracy and validation:Establishing processes to identify and correct inaccurate or outdated customer information.
- Purpose limitation:Ensuring that personal information is used for appropriate, clearly defined purposes.
- Data minimisation:Avoiding the collection or use of information that is unnecessary for the intended compliance activity.
- Access and security:Protecting sensitive information through appropriate access controls and security measures.
- Retention and deletion:Managing records in line with applicable legal and regulatory obligations.
- Accountability:Maintaining appropriate oversight of how customer data is accessed, assessed and used in compliance decisions.
For UK institutions, responsible data management must remain part of the wider compliance strategy. The objective is to improve the quality of risk intelligence without compromising privacy, security or appropriate handling of personal information.
A mature KYD approach recognises that data quality and data governance are fundamental to effective financial crime controls, rather than separate technical considerations.
Balancing data awareness with data protection
Expanding the sources of information used in customer risk assessments raises important questions about privacy and responsible data use.
India's Digital Personal Data Protection Act, 2023, and its rules show how data protection requirements add complexity to compliance operations.
The broader principle applies in the UK and in every other market: financial institutions must consider the lawful basis, purpose and appropriate handling of personal information when designing data-driven compliance processes.
A data-aware approach should not be interpreted as permission to collect or analyse every available piece of customer information. The use of data must remain proportionate to the intended purpose and consistent with applicable requirements.
Institutions need to consider how information is obtained, whether it is relevant to the risk being assessed, who can access it and how long it should be retained. They must also ensure that data-driven assessments are subject to appropriate oversight.
The challenge is to achieve a balance: developing a more complete understanding of customer risk while maintaining responsible data practices and protecting customer information.
When these principles are built into compliance processes from the outset, institutions are better positioned to make informed decisions without losing sight of their obligations to customers.
Building a data-aware compliance function
Moving from KYC towards KYD involves more than introducing new data sources or deploying additional technology. It requires a broader shift in how the compliance function understands, manages and uses information.
Financial institutions need processes that connect customer records, relevant screening information and transaction activity in ways that support meaningful risk assessment. They also need teams that can interpret the information, recognise inconsistencies and determine when further investigation is appropriate.
Technology can help bring relevant data together, identify patterns and highlight changes that may require attention. However, effective outcomes depend on the quality of the underlying information, the suitability of the controls and the judgement applied when interpreting results.
For UK banks and financial institutions, this means treating data quality, customer due diligence, monitoring and governance as connected parts of the same compliance framework.
A data-aware function is not simply one that has access to more information. It is one that understands the limitations of its data, recognises the significance of changes and uses relevant evidence to support proportionate decisions.
From knowing the customer to understanding the data
KYC remains an essential foundation of financial crime compliance. But in a changing financial environment, verifying a customer's identity at onboarding is only the beginning of the process.
Know Your Data extends that foundation by encouraging institutions to examine the quality, context and relevance of the information that informs customer risk assessments. It supports a more dynamic understanding of customer behaviour while highlighting the need for responsible data governance.
For UK financial institutions, the opportunity lies in bringing these elements together: reliable customer information, meaningful transaction insights, appropriate risk assessment and robust data management.
Ultimately, effective compliance depends not simply on how much an institution knows about its customers, but on how well it understands and uses the information available to it.
Moving from KYC towards KYD represents an important step in that direction.
Frequently asked questions
What is Know Your Data (KYD)?
Know Your Data is a data-aware approach to financial crime compliance that focuses on the quality, relevance and context of information used to inform customer due diligence and risk decisions.
What is the difference between KYC and KYD?
KYC focuses on establishing and verifying a customer's identity and understanding who they are. KYD builds on that foundation by examining the quality and context of available information, including whether customer activity remains consistent with the declared profile.
Does KYD replace KYC?
No. KYD does not replace KYC. It builds on KYC by encouraging institutions to use relevant, reliable and current information to develop a more complete understanding of customer behaviour and risk.
Why is KYC information not always enough for ongoing AML monitoring?
Customer circumstances, transaction patterns and geographic exposure can change after onboarding. Information collected at the start of a relationship may therefore no longer provide a complete picture of current customer risk.
What types of data can support a KYD approach?
Relevant sources may include customer records, transaction data, behavioural patterns, screening results, adverse information and appropriate publicly available information. These sources should be assessed together and used only where relevant to the intended compliance purpose.
How can KYD strengthen customer due diligence?
A data-aware approach can help compliance teams identify changes in customer behaviour, reassess risk more effectively and base decisions on multiple relevant sources rather than isolated data points.
Why are data quality and governance important in KYD?
Incomplete, outdated or inconsistent information can weaken risk assessments and create unreliable alerts. Data governance helps ensure information is accurate, relevant, appropriately accessed, protected and retained for suitable periods.
How can financial institutions balance KYD with data privacy?
They should ensure that information is obtained and used for appropriate purposes, is proportionate to the risk being assessed, and is subject to suitable access controls, security, retention practices and oversight.