Know Your Customer (KYC) refers to the set of regulatory requirements and related processes used to identify and confirm the identity of customers, understand ownership and control structures, assess customer risk, and monitor customer relationships over time.
While KYC first emerged within banking, regulatory developments over the past decade have extended its scope across financial services and into a growing range of professional and non-financial sectors.
This paper outlines some of the key global regulatory frameworks that underpin KYC requirements and looks at how those frameworks apply across banking, asset management, insurance, and professional services. It brings together guidance and rules issued by the Financial Action Task Force (FATF), the European Union, US FinCEN, and the UK government, which collectively help influence how Customer Due Diligence (CDD) is defined and implemented worldwide.
Below is a list of five key pieces of global regulatory guidance and legislation that directly underpin KYC processes. These are some of the foundational frameworks that inform KYC and CDD obligations globally across banks, asset management, insurance, professional services, and other regulated entities.
1. FATF Recommendations: Recommendation 10 (Customer Due Diligence)
Issuer: Financial Action Task Force (FATF)
Why it matters:
2. EU Anti‑Money Laundering Directive (AMLD): CDD/KYC Requirements
Issuer: European Union
Why it matters:
3. U.S. Customer Due Diligence Final Rule (FinCEN CDD Rule)
Issuer: U.S. Department of the Treasury, FinCEN
Why it matters:
4. U.S. Customer Identification Program (CIP) Requirements (BSA / USA PATRIOT Act §326)
Issuer: U.S. Treasury (via FinCEN), with CIP rules typically issued jointly with relevant federal functional regulators; FinCEN can issue rules directly where no such regulator exists.
Why it matters:
5. UK, The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR17): KYC/CDD Rules, with an amendment in 2019 to incorporate the EU’s 5th Money Laundering Directive to strengthen and expand CDD. This expanded the scope of regulated entities (e.g., crypto asset exchange providers, custodian wallet providers, art market participants).
Issuer: UK Government: HM Treasury
Supervision and monitoring: Compliance with MLR 2017 is overseen through a sector based AML supervisory framework in the UK, with ongoing monitoring requirements assessed by relevant regulators (including the FCA, HMRC, and other statutory bodies depending on firm type). This approach is intended to support a more consistent application of KYC and CDD obligations across financial and non financial sectors.
Why it matters:
A decade ago, KYC was widely seen as a banking task: a checklist to complete before opening an account. Today, that view has changed.
From a mid-tier bank onboarding cross-border corporates to a global asset manager launching a new fund, to an insurer distributing products through independent brokers, to a law or accounting firm advising on complex transactions – KYC has become a lifecycle obligation that cuts across sectors and client relationships.
This isn’t happening by accident. It’s being driven by a convergence of global regulatory frameworks, and here are some examples:
Let’s look at how the story plays out, sector by sector.
The story starts where KYC first took root: in banking.
Global and regional banks sit squarely in the sights of major KYC and AML frameworks. Under FATF Recommendation 10, banks are treated as financial institutions that are expected to identify and verify customers and beneficial owners, understand the nature and purpose of the relationship, and monitor accounts for potentially suspicious activity.
In the EU, banks are “obliged entities” under the AMLD, with a harmonized framework for CDD, enhanced due diligence (EDD), and ongoing monitoring.
In the US, CIP rules require banks and other covered financial institutions to collect and verify key identifiers before opening accounts, while the FinCEN CDD Rule obliges them to identify and verify beneficial owners of legal entity customers at account opening.
Recent developments in the U.S. further illustrate how KYC and AML expectations evolve. In April 2026, FinCEN issued a notice of proposed rulemaking (NPRM) to reform AML/CFT program requirements under the Bank Secrecy Act. The proposal signals a shift toward evaluating whether AML programs are operating in a risk-based and reasonably effective manner, with greater emphasis on how institutions assess and prioritize risk, rather than solely on procedural adherence.
It also introduces further distinctions between the design of a program and how it is implemented in practice, alongside expectations that firms allocate attention and resources aligned to higher-risk customers and activities. If finalized, the changes would align U.S. supervisory expectations more closely with other international principles that emphasize risk-based approaches and ongoing monitoring across the customer lifecycle.
More broadly, a recent US Financial Integrity Executive Order points toward continued strengthening of AML and KYC expectations, including greater emphasis on customer identification, beneficial ownership, and risk assessment frameworks.
Switching to the UK, banks are required to comply with MLR 2017, applying risk-based CDD and ongoing monitoring across their customer base.
For a bank, these evolving principles and requirements mean KYC is not a static file captured at onboarding. It’s one foundational element for risk-based relationship management. New products, new geographies, new counterparties, and changes in ownership are often reflected in dynamic customer risk profiles, supported by robust data on identity, beneficial ownership, sanctions exposure, adverse media, and more.
Next, we move to the buy‑side.
Asset managers have historically focused on investor suitability, distribution agreements, and fund documentation. But regulators are now expecting greater AML and KYC alignment with banks, especially for products that attract cross-border flows or complex holding structures.
Under FATF, asset management fits within the definition of “financial institutions” subject to CDD obligations.
The EU AMLD designates asset managers as obliged entities, introducing CDD, EDD and monitoring obligations over investors and certain intermediaries.
In the US, mutual funds are specifically named in the FinCEN CDD Rule.
And UK asset managers fall under MLR 2017 as financial institutions.
The result of this is that fund managers may increasingly need to look beyond basic name-screening at subscription toward:
This can lead asset managers toward the same kind of KYC, and ongoing monitoring infrastructure banks have been building, but with nuances around distributors, platforms, and complex fund structures.
Insurance has often been viewed as lower risk than transactional banking. But for life and investment-linked products, regulators increasingly see a similar risk profile: money in, money moved, money out, sometimes across borders and over long timeframes.
Under FATF, life insurers are included within the scope of financial institutions subject to CDD rules.
In the EU, insurance undertakings offering life insurance or other investment-related services are obliged entities under AMLD, with applicable CDD and monitoring obligations.
And in the UK, those same insurers are subject to MLR 2017 requirements for CDD, beneficial ownership checks, and ongoing monitoring.
For insurers, the risk lens is different, focusing on:
To manage that risk, insurers may consider KYC and AML capabilities that can support a more holistic view between the customer, the product, and behavior over time, not just at inception.
A striking change in the global KYC story is the rise of professional services firms, i.e., law firms, accounting practices, tax advisers, and trust and company service providers, as explicit AML-regulated entities.
The FATF recognizes these as Designated Non-Financial Businesses and Professions (DNFBPs) and recommends countries regulate them in a similar manner to financial institutions, with risk-based and proportionate CDD and monitoring obligations.
The EU AMLR goes further, explicitly designating auditors, external accountants, and tax advisers — and, in defined circumstances, legal professionals — as obliged entities who are required to apply CDD and submit suspicious activity reports where applicable.
In the UK, guidance by HM Revenue and Customs on “who needs to register for money laundering supervision” says that firms providing audit, accountancy, tax advice, and certain legal or trust and company services fall within the scope of MLR 2017.
In practice, that means professional services firms may be expected to:
And for their own clients (banks, asset managers, corporates), these firms themselves often become important third parties who may need to be risk-assessed and monitored.
Taken together, these developments tell a story that KYC is no longer just a banking task. It is a cross-sector, cross-lifecycle discipline that supports AML compliance and third-party risk management.
For organizations operating across borders, or those serving customers who do, the implication is that a unified, data-driven view of who you are doing business with, what their risk profile is, and how that risk evolves over time can be important.
That’s an area where advanced KYC, supplier risk, and AML solutions come in:
In other words: turning regulatory pressure into an opportunity to better understand counterparties and help demonstrate to regulators, customers, and investors that financial crime and third-party risk are a priority.
KYC requirements are shaped by a set of globally recognized regulatory frameworks that, while implemented through different legal regimes, generally reflect a consistent underlying approach. Across FATF, EU, US, and UK standards, regulators place emphasis on understanding customer identity, ownership, and control, assessing risk on a proportionate basis, and maintaining oversight as relationships evolve.
This paper illustrates that these expectations don’t apply solely to banks. Asset managers, insurers, and professional services firms are increasingly within scope. Changes in regulation also mean an expansion of scope to crypto asset exchange providers and custodian wallet providers; and even sporting organizations or participants in the art market may also fall within EU, UK, and FATF scope. And broader policy initiatives focused on integrating financial technology and digital assets into regulated financial systems may, over time, extend the range of entities operating within frameworks where KYC and AML obligations apply. These developments reflect the role these sectors play in facilitating financial activity, managing value over time, or acting as intermediaries in complex structures.
In parallel, KYC obligations have expanded beyond initial onboarding to encompass ongoing monitoring, and the ability to explain or document how risk-based judgements are made and updated.
While the application of KYC varies by jurisdiction and sector, the direction of travel is broadly aligned. Regulators appear to be focused on consistency, transparency, and the use of reliable information to support CDD and AML oversight. For organizations operating across borders, this creates a shared regulatory reference point, alongside practical challenges in managing data, ownership complexity, and changing risk profiles.
Understanding the landscape of KYC-related regulation may be the first step.
As KYC requirements continue to apply across jurisdictions and sectors, organizations are increasingly expected to be able to articulate a clear, evidence-based understanding of who they are doing business with and how related risks may evolve over time. In this context, Moody’s solutions support firms by providing data, analytical context, and workflow capabilities that can be informed by widely adopted regulatory frameworks.
Moody’s solutions help bring together data relevant to KYC, AML, and CDD, including identity and entity data, ownership and control structures, sanctions and politically exposed persons (PEPs), and adverse media. These datasets can be used to support risk-based assessments informed by FATF principles and their implementation across EU, US, and UK regulatory regimes.
Beyond initial onboarding, Moody’s capabilities can be used by organizations seeking to maintain regularly updated customer and counterparty profiles as relationships, ownership structures, and external risk indicators change. This reflects the regulatory emphasis on ongoing monitoring, or so-called “perpetual KYC,” rather than point-in-time checks.
Moody’s solutions can be applied across sectors, including banking, asset management, insurance, and professional services. In each case, they can support businesses working toward a more consistent approach to CDD, third‑party assessment, and AML‑related risk oversight, while being flexible to sector‑specific considerations such as intermediaries, distribution models, or complex legal structures.
By providing a more unified view of identity, ownership, and external risk signals, Moody’s data supports organizations in helping illustrate how KYC-related insights are sourced, assessed, and maintained. This can help organizations respond to supervisory queries, support internal governance, and navigate cross-border regulatory expectations.
Moody’s solutions can play a supporting role in the KYC ecosystem, helping organizations to interpret and operationalize regulatory requirements through data, context, and analytical insight.
For more information, please get in touch with the team at any time.
Disclaimer: As of May 2026. This report is partially derived from online research and has not been independently validated or audited. Moody’s neither represents nor warrants the accuracy or completeness of the information presented herein and disclaims any and all liability in relation to its accuracy or suitability for any particular purpose.
This content is for informational purposes only and does not constitute legal, financial, compliance, or other professional advice. Please consult with a qualified professional for specific legal, financial, compliance, or other professional advice.
For more terms and conditions pertaining to Moody’s products and services, refer to the https://www.moodys.com/web/en/us/legal/global-disclaimer.html on Moody’s website.