What is a KYC document? Meaning, types and requirements explained

A KYC document is formal documentation, such as a passport or utility bill, that a regulated firm uses to verify a customer’s identity and address under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs 2017). Know Your Customer (KYC) documentation is a legal requirement for all firms regulated by the Financial Conduct Authority (FCA) in the UK, and forms the foundation of customer due diligence (CDD). In business-to-business contexts, KYC is also an acronym for “Know Your Client.”

Collecting and verifying KYC documents is not optional. Regulated firms that fail to meet their KYC documentation obligations under the MLRs 2017 face FCA enforcement action, regulatory fines, and in serious cases, criminal liability. Whether you are a bank, payment institution, electronic money institution, or fintech, getting KYC documentation right from the onboarding stage is essential.

Why are KYC documents required?

KYC documents are required because regulated firms must verify the identity of their customers before establishing a business relationship. The Financial Action Task Force (FATF), the global body responsible for setting standards to combat money laundering and terrorist financing, mandates that identity verification must be carried out using reliable, independent source documentation. In the UK, this obligation is embedded in the MLRs 2017 and overseen by the FCA, with detailed guidance provided by the Joint Money Laundering Steering Group (JMLSG).

The requirement to collect KYC documents is part of a firm’s broader CDD obligations. It applies at onboarding, when the nature of a relationship changes, and when a firm has reason to doubt the accuracy of previously collected information. For firms operating across multiple jurisdictions, KYC documentation requirements may vary, which is why a consistent, auditable KYC procedure is essential.

The scale of the underlying problem makes clear why these obligations exist. According to Cifas’s Fraudscape 2026 report, more than 444,000 fraud cases were recorded on the UK’s National Fraud Database in 2025, the highest number ever in a single year. Identity fraud and account takeover accounted for almost three-quarters of all cases, with over 242,000 identity fraud cases recorded in that year alone. 

The use of synthetic identities is a growing concern: criminals are building AI-generated profiles that mimic real customers, making it increasingly difficult for firms that rely on manual processes to detect fraudulent applications.

KYC documentation requirements exist precisely to counter this. By establishing a clear, verified record of who a customer is at the point of onboarding, regulated firms lay the foundation for every subsequent AML control.

What are the consequences of inadequate KYC documentation?

The FCA’s enforcement record leaves little ambiguity about what is at stake. In 2025, the FCA issued fines totalling over £124 million, the vast majority of which were tied to anti-money laundering and financial crime control failures. The cases driving that figure share a consistent pattern: KYC documentation failures at the point of onboarding that compounded over time into systemic compliance breakdowns.

Recent FCA enforcement actions involving KYC and financial crime control failures include:

• Nationwide Building Society was fined £44 million in December 2025 for failings in anti-money laundering systems and controls, the largest fine of the year.
• Barclays, fined a combined £42 million across two entities in July 2025, with Barclays Bank UK plc fined £3.1 million for failures in client money account opening controls, and Barclays Bank PLC fined £39.3 million for failing to identify, assess, monitor and manage money laundering risks linked to a corporate banking customer.
• Monzo Bank, fined £21.1 million in July 2025 for inadequate customer due diligence, insufficient risk assessment, and opening over 34,000 high-risk accounts in direct breach of an FCA order

The FCA no longer asks whether a firm has a KYC policy. It asks whether that policy works in practice. Firms that treat KYC documentation as a one-time onboarding task rather than an active, ongoing control are consistently the ones that face enforcement action.

What documents are required for KYC?

KYC documentation for individuals falls into three categories: proof of identity, proof of address, and, in some cases, proof of income. Companies and other legal structures have a separate set of document requirements. The specific KYC documents required can vary depending on a customer’s risk profile, the nature of the product or service, and the sector in which the firm operates.

Proof of identity documents

Proof of identity is a mandatory KYC document for all individuals. Acceptable forms include:

• Passport
• Driving licence
• National identity card with a photograph of the applicant (accepted for foreign nationals where issued by their country of origin, including EU member state identity cards)
• Birth certificate
• Benefit book or original notification letter

In most cases, proof of identity documents must include a photograph of the applicant. Importantly, a single document cannot serve as both proof of identity and proof of address. These are two distinct KYC requirements that must be satisfied by two separate documents.

Proof of address documents

A proof of address document must be in the customer’s name and issued within the last three months. Acceptable KYC documents for proof of address include:

• Utility bill (issued within the last three months)
• Bank statement (issued within the last three months)
• Local authority council tax bill
• Mortgage statement
• Tenancy agreement for the current year
• Tax demand letter
• UK driving licence (if not used as proof of identity)

The three-month rule exists because proof of address is intended to confirm a customer’s current address, not their former address. Documents older than three months are considered unreliable for this purpose.

Many customers no longer receive paper statements. JMLSG guidance permits digital bank statements and electronically issued utility bills in many circumstances, provided the firm applies appropriate controls to verify their authenticity.

Proof of income documents

Proof of income is an additional KYC requirement that applies when a customer applies for certain products or services, or when enhanced due diligence (EDD) is triggered by a customer’s risk profile. Acceptable documents include:

• Bank statements
• Payslips
• Income tax returns

What KYC documents are required for companies and legal structures?

For business customers, KYC documentation is part of a broader Know Your Business (KYB) process. The documents required for KYC at the company level depend on the entity’s legal structure, whether it is listed on a regulated market, the number of partners or directors involved, and the nature of the business relationship.

Common corporate KYC documents include:

• Certificate of incorporation
• Dated extract from the relevant stock exchange (for listed entities)
• Recent audited accounts
• Entry from a relevant professional body register
• List of trustees (for trust structures)
• Constitutional documents that establish, manage, or regulate the structure
• Beneficial ownership documentation identifying Ultimate Beneficial Owners (UBOs)

Under the MLRs 2017, regulated firms must identify any individual who owns or controls more than 25% of a company. This is the Ultimate Beneficial Owner (UBO) threshold, and documenting UBO relationships is a core part of the KYC process for corporate customers. In the UK, regulated firms can query the Companies House register of beneficial ownership directly as part of their KYB checks, providing a real-time, authoritative data source that removes the need for manual cross-referencing.

How does KYC document verification work?

KYC document verification is the process by which a regulated firm confirms that the documents provided by a customer are genuine, up to date, and belong to the person presenting them. Understanding how this process works is as important as knowing which documents are required, particularly as financial services move increasingly online and fraud tactics grow more sophisticated.

What is the difference between manual and digital KYC verification?

Traditional KYC required customers to submit physical documents in person or by post, which were reviewed manually by compliance analysts. This process is slow, resource-intensive, and prone to human error. Digital KYC document verification, often referred to as electronic KYC (eKYC), replaces manual review with automated checks that can be completed in seconds, with no reduction in regulatory rigour. Given that fraudsters are increasingly shifting tactics, including a notable rise in false mobile-app applications, the ability to verify documents at speed and at scale is no longer a convenience: it is a compliance necessity.

How do automated KYC document checks work?

Modern KYC platforms use artificial intelligence (AI) and optical character recognition (OCR) to automatically scan, read, and validate identity documents. The system extracts data fields such as name, date of birth, and document number, cross-references them against authoritative data sources, and flags discrepancies for review. This approach is considerably faster and more consistent than manual document assessment, and produces a clear audit trail for regulatory purposes.

Liveness checks and biometric verification

Biometric verification adds a further layer to the KYC process. Facial recognition technology matches a customer-submitted selfie against the photograph on their government-issued identity document. Liveness detection algorithms confirm that the image is of a real person in real time, preventing spoofing attempts using printed photographs, screen replays, or deepfakes. This is particularly relevant given the documented rise of AI-generated synthetic identities in the UK, where criminals are increasingly using generative tools to produce convincing fraudulent documentation at scale.

What happens if a KYC document is rejected?

Common reasons for KYC document rejection include:

• Expired documents
• Mismatched names between proof of identity and proof of address
• Documents older than three months
• Poor image quality on digital submissions
• Suspected tampering or alteration

Regulated firms must have a clear remediation process in place, meaning a defined path for the customer to fix the issue and resubmit, rather than being left stuck or rejected outright. In practice, this means notifying the customer of exactly which document failed and why, giving them a simple way to upload a corrected version, and tracking the case so it does not stall indefinitely in a queue. Document re-upload is consistently one of the highest-friction points in onboarding, and customers who are rejected without clear guidance often do not return to finish the process.

What is the difference between KYC documents and Anti-Money Laundering (AML) compliance?

KYC documents establish a customer’s identity. Anti-Money Laundering (AML) controls determine what the customer actually does once the relationship begins by monitoring their actual account activity against the profile they provided at onboarding. The two are closely related but serve different functions within a firm’s compliance programme:

• KYC documentation verifies a customer’s identity and address at the point of onboarding and captures their intended activities, such as expected transaction volumes and the nature of their business.
• AML controls monitor what the customer actually does over time, tracking real transactions, amounts, and patterns to check whether their behaviour still matches what they originally declared.

Both are required under the MLRs 2017 and are directly connected: the KYC documentation collected during onboarding forms the customer profile against which ongoing transaction monitoring is measured. If a customer’s real activity later diverges from that declared profile, for example, unexpectedly large payments, unusual patterns like round-sum transfers, or transactions linked to high-risk jurisdictions, that divergence can trigger a KYC review or a suspicious activity report (SAR).

KYC documentation is therefore not a one-time task. It is reviewed and refreshed throughout the customer relationship as part of a firm’s ongoing AML programme, not collected once at onboarding and left untouched. The enforcement actions covered above reinforce this point: the firms fined most heavily were not those that lacked documentation at onboarding, but those whose KYC records were never updated, were not verified against behaviour, or were not stress-tested against the risk they were supposed to manage.

Getting KYC documentation right

Getting KYC documentation right is not a one-time exercise. It is an ongoing discipline that must withstand regulatory scrutiny long after a customer is onboarded.

For UK-regulated firms looking to strengthen their KYC documentation process, RelyComply provides a platform built for the compliance functions of regulated financial institutions. Arrange a demo with our team to see how it works in practice.

Frequently asked questions about KYC documents