Know Your Customer’s Customer (KYCC): A Complete Guide

Know Your Customer's Customer (KYCC) is the compliance practice of verifying and monitoring the identities, activities, and risk profiles of your customers' end-customers — the people and businesses your clients transact with. While standard KYC focuses on verifying your direct customers, KYCC extends that scrutiny one layer deeper into the transaction chain to detect money laundering, terrorist financing, and fraud that would otherwise remain hidden behind intermediary relationships.

KYCC is embedded within broader AML frameworks — FATF Recommendation 13 on correspondent banking, the EU's AMLD6, and the FinCEN CDD Rule in the US. For any business that facilitates transactions on behalf of others — payment processors, BaaS platforms, correspondent banks, or crypto exchanges — KYCC is increasingly critical to both regulatory compliance and operational risk management.

What Is KYCC (Know Your Customer's Customer)?

KYCC — Know Your Customer's Customer — is the process of identifying, verifying, and assessing the risk profiles of the end-users, beneficiaries, and counterparties that your direct customers interact with. It extends standard KYC specifically for businesses acting as intermediaries in financial transactions.

The concept originates from FATF Recommendation 13, which requires correspondent banking institutions to understand the respondent's business and assess the adequacy of its AML/CFT controls. In practice, KYCC applies far beyond correspondent banking — any business that facilitates payments or provides infrastructure for other businesses to serve their own customers faces KYCC obligations.

Practical example: A payment facilitator (PayFac) onboards an electronics merchant. Standard KYC verifies the merchant's identity and ownership. But KYCC asks: Who are the merchant's customers? Are they structuring payments to launder funds? Is the merchant processing for unlicensed sub-merchants?

Without KYCC, businesses become unwitting conduits for money laundering — bad actors exploit the gap by hiding behind a seemingly legitimate customer.

As one compliance practitioner observed on a popular AML industry forum: "KYCC is where most fintechs get caught out. They nail KYC on the merchant but have zero visibility into the merchant's customer base."

Where Does KYCC Fit in the Compliance Framework?

KYCC does not exist in isolation. It is one layer in a structured compliance framework where each process addresses a different dimension of risk. Understanding how these layers relate prevents duplication and ensures proportional due diligence.

The relationship is hierarchical: KYC is the umbrella process, CDD and EDD are its risk-tiered components, KYB applies KYC principles to business entities, and KYCC extends the entire framework one layer downstream to your customer's customers. Each layer can trigger the others — a high-risk KYB finding on a merchant may escalate to EDD, which may then require KYCC on the merchant's end-users.

For a deeper look at how business verification (KYB) works in practice, see our guide on checking company legitimacy.

What Is the Difference Between KYC and KYCC?

The core distinction: KYC verifies who you are doing business with; KYCC verifies who *they* are doing business with.

Why it matters: The Panama Papers and subsequent leaks revealed that standard KYC routinely failed to detect illicit flows routed through shell companies and intermediary structures. The funds appeared clean at the direct customer level — the laundering happened one or two layers deeper in the transaction chain, exactly where KYCC provides visibility.

Which Industries Need KYCC?

KYCC obligations are not limited to traditional banks. Any business that sits between a regulated financial system and end-users faces downstream verification requirements — either by regulation or by the practical reality of managing intermediary risk.

The BaaS accountability gap is particularly acute. In 2024–2025, the OCC issued formal enforcement actions against multiple sponsor banks for inadequate BSA/AML oversight of their fintech partners — including failures in monitoring fintech end-users. The regulatory message is clear: the sponsor bank cannot delegate KYCC responsibility to the fintech partner, even if the partner handles day-to-day onboarding.

What Are the Regulatory Frameworks Driving KYCC?

KYCC obligations derive from multiple overlapping regulatory frameworks. No single regulation is titled "KYCC" — instead, the requirement is embedded across AML/CFT laws that mandate due diligence on downstream relationships.

FATF Recommendations (Global Standard)

• Recommendation 13 (Correspondent Banking): Requires institutions to understand the nature of the respondent's business, assess the adequacy of its AML/CFT controls, and obtain approval from senior management before establishing new correspondent relationships.
• Recommendation 16 (Wire Transfers): Revised in June 2025 to strengthen transparency for cross-border payments, domestic transfers, and VASP transactions — requiring originator and beneficiary information to travel with the payment (the "Travel Rule").

European Union

• AMLD6 (Directive 2024/1640): Expands money laundering definitions, mandates interconnected UBO registers across the EU, and enhances CDD for high-risk scenarios including intermediary structures.
• AMLR (Regulation 2024/1624): Creates a directly applicable EU-wide AML rulebook with harmonized CDD/EDD requirements — no national transposition needed.
• AMLA: The new EU Anti-Money Laundering Authority began operations in 2025 and will directly supervise high-risk financial institutions starting in 2028. It is issuing ~23 regulatory technical standards by mid-2026.

United States

• FinCEN CDD Rule (2018): Requires financial institutions to identify and verify beneficial owners of legal entity customers and conduct ongoing monitoring.
• Section 312, USA PATRIOT Act: Mandates Enhanced Due Diligence (EDD) for foreign correspondent accounts — including assessing money laundering risks, obtaining respondent AML program details, and monitoring for nested accounts.

United Kingdom

• Economic Crime and Corporate Transparency Act (ECCTA) (effective September 2025): Widens corporate liability for failure to prevent fraud and strengthens AML governance expectations — including a new single AML supervisor for professional services.

Enforcement Signals the Regulatory Direction

The scale of recent enforcement actions underscores why KYCC cannot be treated as optional:

These are not isolated incidents. Global AML fines surged 417% year-over-year in H1 2025, reaching $1.23 billion — with KYCC-adjacent failures (correspondent banking, nested accounts, intermediary oversight) representing a significant share.

How to Conduct KYCC

There is no single prescribed process for KYCC — it must be adapted to your business model, customer risk profile, and regulatory jurisdiction. However, the following four-step framework provides a practical starting point.

Step 1: Identify Which Customers Need KYCC

Not every customer requires KYCC. Apply a risk-based approach (as mandated by FATF Recommendation 1) to focus resources on customers whose business models create downstream risk.

High-risk indicators that trigger KYCC:

Risk scoring approach: Assign weighted scores across these indicators. A binary "high/low" classification misses nuance — use a tiered model (e.g., 1–10 scale) that maps to proportional KYCC intensity. Customers scoring above your threshold get full KYCC; those below get periodic reviews.

Step 2: Analyze the Payment Flow Within Your Platform

Once high-risk customers are identified, map their transaction flows to understand where money originates and where it goes.

Key checks:

• Who receives payments? Legitimate businesses vs. unknown individuals vs. entities in high-risk jurisdictions.
• Where is money going? Domestic, offshore, or routing through multiple jurisdictions (a classic layering indicator).
• Structuring patterns? Frequent transactions just below reporting thresholds (e.g., multiple $9,500 transfers to avoid the US $10,000 CTR threshold).
• Velocity anomalies: Sudden spikes in transaction volume or value vs. the customer's historical baseline.

Graph analytics tools are effective here — they map transaction networks visually, revealing hidden connections that flat database queries miss.

Step 3: Verify Third-Party Connections (UBOs & Key Counterparties)

You do not need to verify every single end-user in your customer's ecosystem. Focus on the entities that pose the greatest risk:

• Ultimate Beneficial Owners (UBOs): Identify the natural persons who ultimately own or control the customer's business. Cross-reference against sanctions lists, PEP databases, and adverse media. EU AMLD6 mandates interconnected UBO registers across the EU — use them.
• Major transaction counterparties: Entities that appear frequently in your customer's transaction flow. Are they registered businesses? Do they appear on any watchlists?
• Legal entity verification: Confirm that business counterparties are registered, active, and operating in the jurisdiction they claim. Shell companies and dormant entities are red flags.

For a detailed walkthrough of business legitimacy verification, see our KYB guide.

Step 4: Continuous Monitoring, Not Just One-Time Checks

KYCC is not a one-time onboarding exercise. Customer risk profiles evolve — business models shift, new transaction partners emerge, and sanctions lists update daily.

Ongoing monitoring triggers:

• Changes in the customer's business model or ownership structure
• New high-volume transaction counterparties appearing in the flow
• Sanctions or PEP list updates that affect existing counterparties
• Adverse media flagging the customer or their key counterparties
• Regulatory changes in jurisdictions where the customer operates

2026 regulatory expectation: FATF's October 2025 recommendations update emphasized "effectiveness" over formal compliance — regulators will scrutinize whether KYCC programs actually mitigate risk through continuous monitoring, not just whether the program exists on paper. The shift is from periodic reviews (e.g., annual re-checks) to event-triggered, perpetual KYCC.

What Technology Powers Effective KYCC Programs?

Manual KYCC is impractical at scale. Modern programs rely on three technology pillars:

Graph analytics is foundational for KYCC. Traditional queries check records in isolation — they cannot see that Entity A connects to Entity B through Entity C via a shared UBO in a third jurisdiction. Graph databases model these multi-hop relationships natively, making them essential for detecting layered structures.

AI-driven dynamic scoring moves KYCC from static (check once, review annually) to continuous (real-time updates as transactions, watchlist changes, or adverse media emerge). According to Moody's analysis of correspondent banking KYCC, the industry is shifting to perpetual monitoring driven by event triggers rather than calendar-based reviews.

How Signzy Helps Organizations Implement KYCC

KYCC programs require identity verification, business verification, AML screening, and transaction monitoring — typically stitched together from multiple vendors. Signzy consolidates these into a single, API-driven compliance infrastructure.

• KYC/KYB foundation: One Touch KYC verifies identities across 120+ countries in under 5 seconds. The KYB suite traces UBO structures through corporate registries in 180+ countries, including multi-layered ownership chains.
• Downstream screening: AML screening covers 1,000+ global watchlists (OFAC, UN, EU, FinCEN, SEBI, RBI) with fuzzy logic matching for name variations and transliterations. Watchlists update daily.
• Ongoing monitoring: AI-powered transaction monitoring detects structuring, layering, and rapid fund movements across payment types — generating regulatory-ready SAR/STR reports with audit trails.
• No-code configuration: Compliance teams can configure KYCC verification flows, adjust risk thresholds, and deploy jurisdiction-specific rules without developer involvement.

For organizations building their first KYCC program, start with robust KYC and business verification to filter high-risk customers at onboarding, then layer KYCC for customers whose business models create downstream exposure.