Use a risk-based approach, not a one-size-fits-all checklist. Low-risk customers usually need standard customer identification and address proof. Higher-risk cases such as PEPs, customers in high-risk jurisdictions, or complex corporate structures need enhanced due diligence, including source of wealth and source of funds evidence. The control objective is to match document depth to risk exposure and regulatory expectations.
How to set the evidence bar by customer risk
For KYC, the right question is not “what documents can we collect?” but “what evidence is enough to support the risk decision?” Low-risk customers can often be verified with standard identity and address documents, while higher-risk cases need stronger corroboration of source, ownership, and financial activity. That means the document set should expand when the customer profile creates more uncertainty, more potential harm, or more regulatory scrutiny.
The practical test is whether the documents together create reasonable confidence in identity, control, and purpose of the relationship. A simple retail customer usually needs a narrower evidence pack than a politically exposed person, a customer from a higher-risk jurisdiction, or a complex legal entity with layered ownership.
What “enough” looks like for low-risk versus higher-risk customers
Low-risk cases are usually about confirming who the customer is and where they can be reached. In practice that means standard identity documents, address proof, and any basic account-opening checks required by policy. The focus is on consistency and validity rather than exhaustive corroboration.
Higher-risk cases need evidence that closes the gaps that standard documents do not cover. That is where enhanced due diligence comes in, including source of wealth and source of funds evidence, ownership documentation for corporates, and deeper checks where the customer profile or geography raises the risk of misuse, concealment, or sanctions exposure.
Complex structures deserve special attention because the core problem is not only identifying the legal entity, but understanding who ultimately controls it and why the relationship makes sense. If the structure is opaque, the file should not be treated as “complete” simply because the required documents were uploaded.
How compliance teams should make the decision in practice
Build the decision around customer risk indicators, not around a fixed document checklist. Identity Proofing and KYC Guide is useful here because it connects document verification, identity assurance, and account-opening fraud into one operating model.
Use the risk rating to decide whether you need basic proof, additional corroboration, or an enhanced file. A low-risk customer may be accepted once core identity and address evidence is validated, but a higher-risk customer should trigger a deliberate request for financial provenance, ownership evidence, or other supporting material that explains the relationship.
That decision also has to align with the applicable AML expectations. FATF Recommendations set the international baseline for customer due diligence and enhanced due diligence, while EBA AML/CFT Guidance is a strong reference point for EU firms deciding when standard checks stop being sufficient.
Risk and Threat Considerations
KYC fails when teams treat documents as a box-ticking exercise instead of a risk control. Weak evidence selection can let synthetic identities, concealed beneficial ownership, or unexplained funds pass through onboarding, especially when the file looks complete but does not explain the customer’s real exposure.
Failure mechanism: teams over-rely on low-value documents, skip escalation for higher-risk profiles, or accept incomplete source-of-funds and source-of-wealth evidence because the customer has already passed basic identity checks.
Impact: the institution absorbs higher financial-crime, sanctions, and regulatory risk, and may have to remediate files later when the customer relationship is already live and harder to unwind.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | KYC evidence establishes and verifies external customer identity. |
| IA-12 — Identity Proofing | Risk-based KYC depends on proofing strength that matches customer risk. | |
| AC-6 — Least Privilege | Risk-based KYC limits data collection to what is needed for the risk tier. | |
| Recommendation — Use IA-8-aligned proofing controls to validate customer identity before onboarding. Apply IA-12 to scale proofing depth with the customer risk profile. Collect only the evidence needed to support the assigned risk decision. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity Management | KYC document decisions support identity governance and control of customer identities. |
| A.5.17 — Authentication Information | KYC relies on trustworthy identity evidence and supporting credentials or records. | |
| A.5.18 — Access Rights | Escalated KYC cases affect whether customers should be approved or restricted. | |
| Recommendation — Define identity evidence requirements by customer risk level and document them consistently. Protect and validate identity evidence before accepting it into onboarding. Tie onboarding approval and exceptions to documented risk acceptance. | ||
Practitioner Guidance
What to prioritise: define the minimum acceptable document set for each risk tier, then add explicit escalation triggers for PEP status, adverse geography, unusual ownership, or inconsistent economic purpose. That makes reviewer judgment repeatable and audit-friendly.
What to verify: do not just check whether a document exists, verify whether it actually answers the open question in the file. For a low-risk individual, that may be identity and address; for a higher-risk case, it may be ownership, control, source of funds, or source of wealth.
Decision rule: if the evidence only proves identity but not the customer’s risk story, treat the case as incomplete and escalate rather than forcing it into a standard onboarding path.
Practitioner takeaway: “Enough” KYC evidence is the smallest document set that still lets you defend the customer’s risk rating, the source of value, and the reason the relationship is acceptable.
Related resources from NHI Mgmt Group
- How should compliance teams structure video KYC for higher-risk onboarding cases?
- How should security teams govern non-human identities for compliance?
- How should security teams govern non-human identities for SOC 2 compliance?
- Why do non-human identities create compliance risk even when policies exist?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
