What is KYC? Know Your Customer Explained for South African Businesses
Know Your Customer (KYC) is one of the most important concepts in modern business compliance. Yet despite how frequently the term appears in regulatory frameworks, financial legislation, and onboarding processes, many businesses remain uncertain about exactly what KYC entails, why it is required, and how it applies to them specifically within the South African context.
This guide provides a comprehensive explanation of KYC — what it means, why it matters, and what South African businesses need to know in order to comply effectively.
What is Know Your Customer (KYC)?
Know Your Customer (KYC) is a term that refers to the set of procedures, checks, and mechanisms that businesses use to verify the identity of their customers before — and during — a business relationship. At its core, KYC is the process of confirming that a customer is exactly who they claim to be.
KYC procedures typically involve verifying a customer's identity using official documentation and trusted data sources, screening the customer against financial crime risk indicators, and conducting ongoing monitoring to ensure that the risk profile of the customer does not change over the course of the business relationship.
KYC is intrinsically linked to Identity Verification. While identity verification is a broad term referring to the process of establishing and confirming an individual's identity, KYC is a more specific term that applies that verification process in a business and regulatory context (specifically, to ensure that a business knows who it is dealing with before any transaction or service is rendered).
What Does KYC Stand For?
KYC stands for Know Your Customer. The term is used globally across financial services, banking, insurance, payments, and a wide range of other industries to describe the due diligence processes that businesses are required ro conduct on their customers, or may otherwise choose to run for additional risk assessment and mitigation:
In practice, KYC checks establish and confirm the following:
- That the individual exists and is who they claim to be
- That the individual's identity documents are authentic and valid
- Whether the individual is a Politically Exposed Person (PEP) or associated with any sanctions
- Whether the individual poses any risk of money laundering, fraud, or financial crime
- That the individual's contact and address information is accurate and verifiable
Why is KYC Required?
KYC requirements exist for two fundamental reasons: regulatory compliance and fraud prevention.
From a regulatory standpoint, KYC is a central component of Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) legislation across the world. Governments and international regulatory bodies require businesses to conduct KYC checks in order to prevent financial crime, reduce the risk of money laundering, and ensure the integrity of the financial system. The Financial Action Task Force (FATF) — the leading global intergovernmental body on AML/CFT policy — identifies KYC as a foundational requirement for any robust AML/CFT framework.
From a fraud prevention standpoint, KYC checks allow businesses to verify the authenticity of a customer's identity before committing to a transaction or relationship. By scanning for red flags early in the onboarding process, businesses can identify fraudulent individuals, avoid costly disputes, and protect themselves from the reputational and financial damage associated with fraud.
What is KYC in South Africa?
In South Africa, KYC obligations are primarily governed by the Financial Intelligence Centre Amendment Act (FICA) — the country's central AML/CFT legislation. FICA creates legal obligations for certain businesses, institutions, and organisations to verify the identities of their customers and conduct ongoing due diligence throughout the business relationship.
Under FICA, these businesses are designated as Accountable Institutions (AIs). Due to the nature of their activities, AIs are exposed to a heightened risk of being used to facilitate money laundering or other financial crimes. Consequently, South African law requires AIs to comply with a comprehensive range of KYC obligations, which include customer identity verification, AML risk screening, address verification, and ongoing monitoring.
Accountable Institutions in South Africa span a wide range of industries, including banking, insurance, forex, payments, wealth management, iGaming, real estate, legal services, and motor vehicle dealerships, among others. The exact scope of KYC obligations for a given AI will vary depending on its categorisation under FICA and its own Risk-Based Approach (RBA) to compliance.
It is worth noting that South Africa's greylisting by the FATF in February 2023 — due to critical deficiencies in its AML/CFT framework — has significantly elevated the urgency of KYC compliance for South African businesses. Since being greylisted, South Africa has undertaken substantial legislative reforms to strengthen its AML/CFT framework, and regulatory scrutiny of KYC practices has increased considerably as a result.
What Checks Are Included in KYC?
KYC is not a single check — it is a collection of verification and due diligence procedures that work together to establish a comprehensive picture of a customer's identity and risk profile. The specific checks required will vary depending on the business, its industry, and the applicable regulatory framework.
A comprehensive KYC process will typically include the following:
Identity Verification
Identity verification confirms that an individual is who they claim to be. In South Africa, this is achieved by verifying a customer's South African ID number against the Department of Home Affairs (DHA) National Identification System (HANIS) database — the authoritative source of identity information for South African citizens. This process returns key information such as the customer's full name, date of birth, vital status, citizenship, and marital status.
AML and Sanctions Screening
AML screening checks whether a customer poses any financial crime risk. This includes determining whether the individual is a Politically Exposed Person (PEP), appears on any regulatory enforcement or sanctions lists, is associated with adverse media, holds an insolvency or disqualified director status, or is designated as a Profile of Interest. In South Africa, this screening is typically powered by globally recognised risk intelligence databases.
Address Verification
Address verification confirms that the residential address provided by a customer is accurate and associated with their identity. This is an important component of FICA compliance, as Accountable Institutions are required to verify the residential address of their customers as part of the onboarding process.
Biometric and Document Verification
For more comprehensive KYC workflows, businesses may also conduct biometric checks — such as comparing a customer's selfie or identity document photograph with the photo held on record at the Department of Home Affairs — to confirm that the physical individual matches the verified identity.
Ongoing Monitoring
KYC is not a once-off process. Accountable Institutions are required to conduct ongoing monitoring of their customer base to ensure that any changes to a customer's risk profile — such as becoming a PEP or being placed under sanction — are identified and acted upon promptly.
What is the Difference Between KYC and FICA?
KYC and FICA are related but distinct concepts. KYC refers to the global set of procedures and checks used to verify customer identities and assess financial crime risk. FICA, on the other hand, is South Africa's specific legislative framework that legally requires Accountable Institutions to conduct KYC as part of their compliance obligations.
In other words, FICA is the law — and KYC is the mechanism through which that law is complied with. A business that conducts thorough KYC is, in most cases, meeting its core FICA obligations. Accordingly, understanding KYC is essential for any South African business that falls within the definition of an Accountable Institution and is required to pass a FIC audit.
What is the Difference Between KYC and KYB?
Whereas KYC refers to the verification of individual customers, Know Your Business (KYB) refers to the equivalent due diligence checks conducted on businesses, institutions, and organisations. KYB checks verify the registration, ownership, structure, and legitimacy of a legal entity rather than an individual.
It is important to note that KYC is a broad term and can be used in place of KYB in general conversation. KYB, however, is a specific term and cannot be used to refer to checks conducted on individuals. In many compliance workflows, KYB checks will include elements of individual identity verification — such as director identity checks — that bridge both disciplines.
Who Needs KYC Services in South Africa?
Any South African business that is designated as an Accountable Institution under FICA is legally required to conduct KYC. This encompasses a broad range of sectors and business types — from large commercial banks and insurance companies to small forex providers, iGaming operators, attorneys, estate agents, and high-value goods dealers.
Beyond legal obligation, many businesses that are not formally classified as Accountable Institutions choose to conduct KYC voluntarily, recognising that the ability to verify customer identities and screen for risk is a powerful tool for fraud prevention, regardless of regulatory requirement.
KYC Solutions for South African Businesses
As South Africa's leading provider of world-class KYC, identity verification, and due diligence solutions, ThisIsMe empowers businesses of every size to meet their FICA compliance obligations with ease. With access to 45+ services — from real-time identity verification against the DHA's HANIS database to AML risk screening powered by global risk intelligence — ThisIsMe provides the tools businesses need to verify customers, mitigate risk, and pass their FIC audits, stress-free. To experience our full suite of KYC solutions and find out how we can serve your business, contact our team here.
