Questions that help KYC Analysts Determine Customer Risk from KYC Documents Collected

Sr.

Questions that KYC Analysts need to keep in mind while handling KYC Documents

Findings of Analysis

Impact of the Finding on Customer Risk Assessment (CRA)

1

How can the KYC document’s validity be determined?

The KYC document’s validity can be determined by verifying that the document has not expired and is authentic. It should be a valid document at the time of establishing the business relationship. If the document is expired or counterfeit, it will raise the question of the customer’s identity. It even poses a risk of money laundering, identity theft, or fraud.

A valid document for KYC coupled with no match in the screening result indicates a reduced risk of document fraud. It ensures that a KYC document presented by the customer is reliable and provides the correct information. A valid document also ensures that the customer is the one he claims to be and that the entity can proceed with business with the customer.

2

What is the Validity of the KYC Document in question? (Document Expired: Yes/No)

The validity of the KYC document can be seen from its expiry date. If the document has not expired, then it is considered a valid document for verifying the customer’s information. On the other hand, if the document is expired, then it cannot be considered a valid document.

A document that has not expired can be relied upon for customer information. It is a valid document for KYC verification. On the other hand, a document that is expired cannot be relied upon for customer verification, and an alternative document should be used for verification.

3

Does the KYC Analyst have access to another form of valid ID (i.e., a Driver’s License)? (Yes/No) when a customer presents an expired KYC document?

The customer presenting the expired KYC document can provide the KYC Analyst access to another form of valid ID. For e.g., if the customer has an expired Passport that cannot be relied upon, the same customer can have any valid document, such as a driver’s license. The expiration of one document does not affect the validity of another document. The other unexpired document can be relied upon for the customer’s verification. The Passport is generally used to verify name, nationality, and date of birth.

Access to any other form of valid ID paves the way for verification of a customer’s identity. If one document is expired and the other is not expired, then the other one can be used for verification. This will help identify the customer and assess risks associated with the customer.

4

Can the customer presenting the expired KYC document provide other alternative forms of identification? (Yes/No)

If the customer presents the expired KYC document can provide other supporting forms of identification. The purpose of the KYC document is to verify the customer’s details. If the supporting document provides the details and fulfils the purpose, then the customer can provide it.

Supportive forms of identification can be used to verify the customer’s details. If the customer presents an expired KYC document, then it cannot be used for verification in the normal course of business, and it also increases the risk of fraudulent activities. The supporting documents can be used to verify the customer details, resulting in fewer chances of fraud, ML, FT, PF, or any other illegal activity.

5

Can a KYC Analyst rely upon the publicly available information?

In events where KYC documents are inadequate or expired, the KYC Analyst can obtain the customer’s details from a publicly available source for verification. Publicly available sources such as regulatory bodies or ministry websites are trustworthy. It provides the correct information about the customer.

The information obtained from publicly available sources can be used to assess the ML, FT, or PF threat from the customer when KYC documents are missing, inadequate, or expired. The information available from trusted publicly available sources such as the ministry or regulatory body website is believed to be true as they have their own set of stringent compliance requirements, and hence, the chances of any risk decrease. For instance, if the customer is a corporate customer listed on a recognised stock exchange in UAE, then such information on the stock exchange website can be relied on to gather customer information, as listing on UAE’s stock exchange is possible only when certain compliance requirements are adequately met.

6

Does the customer have any prior business history with the reporting entity, or are they seeking to establish a fresh business relationship?

The information regarding the prior history of business relationships with customers provides the base in the cases of verification. The prior history can provide basic information on the customer, but fresh documents must be sought to verify the validity of existing information. In case of a new business relationship, the verification of all the valid documents carefully is necessary. However, KYC Analysts must exercise caution when dealing with known and existing customers as well. The duration of the business relationship and the customer’s authenticity or potential involvement in ML, FT, or PF are different things and should not be mixed.

The assessment of customer risk in the case of prior history with the reporting entity is not as easy as it looks. The customer information needs to be checked and updated across valid identification documents to ensure continuous compliance with CDD and meet ongoing monitoring requirements. Customer risk can be determined based on past history, taking into consideration the latest customer information and the intended purpose of the current and future course of business relationship. This will provide security to the regulated entity as the risk of fraud is less in these cases. In the case of new business relationships, the customer risk is uncertain unless CRA is conducted.

7

What is the impact of commencing or continuing a business relationship when accepting expired KYC documents?

In the normal course of business, customer verification cannot be done by accepting expired documents, and a business relationship cannot be established unless alternative valid ID documents are provided that help the regulated entity obtain the key information about the customer and verify the same and help fulfil CDD requirements in alignment with UAE’s AML/CFT laws. The use of expired KYC documents raises questions on the quality, efficiency, and stringency of a regulated entity’s CDD process and the regulator may impose a fine or penalty or both for inadequate and insufficient CDD measures of the regulated entity.

The verification of customer’s details from expired KYC documents must be avoided. Expired documents should not be accepted by regulated entities in UAE for completing the CDD obligation. Regulated entities must be mindful that if they come across expired KYC documents, then they should seek fresh documents or such deficiency of valid KYC document can be fulfilled by relying on valid and acceptable alternative source of information such as another valid KYC document that is issued by government body containing key information such as:

Ideally, the business relationship should not be established when CDD cannot be adequately concluded.

8

What is the risk level of the transaction or activity the customer seeks to engage in?

The ML, FT, and PF risk level of the transaction in which the customer seeks to engage affects the decision-making while dealing with a customer.

Knowing the risk level of the transaction or the activity the customer seeks to engage in provides basic insights into how to deal with that customer.

In the cases of expired KYC documents, the regulated entity must seek the latest KYC documents from the customer to keep CDD documents and details updated and relevant.

Customer Risk Assessment (CRA) helps in deploying commensurate due diligence measures and developing an accurate customer risk profile, which is helpful for ongoing monitoring of business relationships and detecting deviation of customer activity or transactions which might indicate potential involvement in ML, FT, or PF-related activities.

The degree of ML, FT or PF risk associated with the customer needs to be adequately and commensurately mitigated by deploying suitable control measures. For instance, if a customer is assigned a high-risk rating, then enhanced control measures must be deployed, such as seeking additional documents which are valid and relevant for enhanced customer due diligence (EDD).