KYC compliance is the set of controls used to verify a customer’s identity and assess whether onboarding meets legal and policy requirements. In practice, it includes collecting identity evidence, checking it against trusted sources, and retaining auditability. The control must be designed to match jurisdiction, risk level, and business model.
Expanded Definition
KYC compliance is the operational control set used to verify a customer’s identity, screen for risk, and retain evidence that onboarding met jurisdictional and policy requirements. In regulated environments, it sits at the intersection of AML obligations, fraud prevention, and recordkeeping discipline, with requirements shaped by the business model and the geography in which a service operates.
For NHI and agentic AI governance, KYC is relevant because the same assurance mindset often governs how organisations approve machine-created accounts, API credentials, delegated agents, and third-party integrations. The difference is that human onboarding frameworks do not automatically translate to non-human identities, so teams must not assume that customer verification rules cover service-account trust, identity proofing for bots, or tool access approval. Industry usage is still evolving, and no single standard governs every KYC implementation across sectors. The most common misapplication is treating a one-time onboarding check as sufficient when the customer relationship, risk profile, or credential exposure changes after activation.
Authorities such as FATF Recommendations — AML and KYC Framework and NIST Cybersecurity Framework 2.0 help anchor KYC in risk-based governance, but they do not remove the need for organisation-specific control design.
Examples and Use Cases
Implementing KYC rigorously often introduces onboarding friction and evidence-management overhead, requiring organisations to weigh faster customer activation against stronger assurance and auditability.
- A fintech validates a customer’s legal name, address, and beneficial ownership before enabling account funding, then retains the decision trail for regulator review.
- A SaaS provider screens enterprise customers against sanctions and adverse-media lists, while recording why an exception was accepted for a high-risk jurisdiction.
- A marketplace re-verifies a merchant when transaction patterns change materially, because the original KYC file no longer reflects current risk.
- A platform applies different KYC depth for low-value accounts versus high-limit accounts, aligning checks with the business’s risk appetite and jurisdictional obligations.
- An engineering team extends KYC-like evidence collection to a third-party automation partner, but supplements it with NHI lifecycle controls because Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs shows that identity assurance alone does not solve credential rotation, offboarding, or privilege control.
For governance depth, Ultimate Guide to NHIs — Regulatory and Audit Perspectives is useful when teams need to connect evidence retention to defensible oversight, while ISO/IEC 27001:2022 Information Security Management provides a broader control-management lens.
Why It Matters in NHI Security
KYC compliance matters in NHI security because identity proofing failures often become access-control failures later. If onboarding evidence is weak, incomplete, or stale, downstream teams may provision privileges, create credentials, or approve integrations on the basis of assumptions rather than verified trust. That creates audit gaps, increases fraud exposure, and makes it harder to justify why an identity was trusted in the first place.
This is especially important because NHIMG research shows that NHIs outnumber human identities by 25x to 50x in modern enterprises, which means weak identity governance can scale faster than manual review processes. KYC discipline also aligns with broader control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where auditability, access approval, and evidence retention are required. Organisations should distinguish customer due diligence from machine identity governance, because the control objective is similar but the implementation surface is different.
Organisations typically encounter KYC weaknesses only after a failed regulator review, fraud event, or disputed account decision, at which point the control is operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack surface, NIST CSF 2.0, NIST SP 800-63 and NIST AI RMF set the technical controls, and EU AI Act define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA | KYC supports identity proofing and access authorization within the CSF. |
| NIST SP 800-63 | IAL | KYC-style identity proofing aligns with identity assurance level concepts. |
| OWASP Non-Human Identity Top 10 | NHI-01 | KYC is adjacent to NHI onboarding, where identity trust and governance must be explicit. |
| NIST AI RMF | AI risk management requires governance of identity, data, and operational trust. | |
| EU AI Act | AI governance relies on traceable identity and accountability for providers and deployers. |
Map KYC evidence, screening, and review steps to identity assurance and authorization workflows.
