The Future of KYC Is Layered—and Data-Driven

Know Your Customer rules were designed to stop financial crime, but in practice, they are increasingly being bypassed by both human error and machine-generated deception.

Last year, Barclays was fined £42 million (roughly $56.9 million) for failing to properly vet clients for money laundering risks. In this case, the UK lender had access to all the information required to flag the offending clients but failed to follow through.

More broadly, similar issues persist across the banking sector. In many instances, institutions conduct perfunctory KYC checks during onboarding but fail to maintain ongoing monitoring. It is often only after the fact that they discover their “verified” customers had been bribed or coerced into becoming money mules.

Meanwhile, the threat landscape itself is also evolving. In a growing number of recent cases, cybercriminals have used technologies such as artificial intelligence to generate convincing fake documents and synthetic identities capable of bypassing financial institutions’ verification protocols.

Taken together, these challenges are driving a broader assessment of the KYC model. In a recent PaymentsJournal podcast, Jon Jones, Chief Commercial Officer at Data Zoo, and Jennifer Pitt, Senior Fraud Analyst at Javelin Strategy & Research, discussed how these risks are accelerating the evolution of identity verification, and how trusted data within a layered approach has become essential to identifying and addressing modern fraud threats.

Establishing Trusted Registries

Although the pandemic is often credited with accelerating the shift toward digital identity proofing, the change had already been underway for years. One key driver has been the growthof the digital economy, which has helped organizations build substantial datasets on users’ biometric information, behavioral analytics, and device intelligence.

While this data can be a powerful tool for identity verification, it is of limited value if it is inaccurate.

“The role of data in KYC is becoming increasingly important and it comes down to one word: trust,” Jones said. “The advancement of AI has resulted in single-layered solutions becoming somewhat compromised and institutions increasingly need to leverage authoritative data. For example, checks through government or credit-based authorities have become table stakes going forward.”

“If you look at fake images and documents, it's very easy to have them created now,” he said. “Creating a synthetic identity from an image or a document is not that hard, but maintaining the presence and consistency across government records or credit bureaus is much harder. It requires the need for trusted registries in some form of the process.”

Synthetic identities pose a particular challenge because they are created by blending real and fabricated data into a new entity. This means there is no direct victim to report fraudulent activity, and often no clear red flags for organizations at onboarding.

This is just one of the reasons why changes to the current KYC model have become paramount.

“When I was in banking, I saw that KYC was treated as a onetime check and the KYC team would just look at static identity data,” Pitt said. “Once that matched, they would move on, and KYC wasn't being done after that initial check. What we need is the idea of perpetual or continuous KYC, where we're using automated tools to look at KYC or identity verification processes in the background.”

The Three Levels

In addition to ongoing customer checks, there must be protocols in place to continuously validate data. Data has become the lifeblood of an effective KYC process, and the potential for corruption through fraudulent or erroneous information makes stringent verification essential.

“We typically look at trust from three levels,” Jones said. “The first one is the authoritative nature of the data, meaning does it come from a real-time primary source like a government record or an M&O with clear privacy policy gui