Know Your Customer’s Customer

What Know Your Customer's Customer Means in Practice

Know Your Customer's Customer extends due diligence beyond the immediate counterparty to the downstream customers that intermediary serves. It matters when indirect exposure, hidden distribution chains, or layered relationships make the true risk profile unclear.

That shift changes the unit of analysis. Instead of asking only whether the direct business partner is legitimate, organisations also ask what types of customers, sectors, geographies, payment flows, or resale channels sit behind that partner and whether those patterns increase financial crime exposure.

Why the Term Exists

The term reflects a practical gap in standard customer due diligence. A direct customer can look acceptable on its face while still acting as a conduit into higher-risk activity, including fraud, sanctions exposure, money laundering typologies, or misuse of the partner’s platform or distribution channel.

In many programmes, Know Your Customer's Customer is not a universal obligation but an enhanced diligence response. It is used when the risk is indirect, when the intermediary obscures the end user, or when the business model depends on customers whose own customer base creates material exposure.

For financial crime and onboarding teams, the key question is not simply “who is our counterparty?” but “what business is that counterparty really enabling?” The answer can materially affect acceptance decisions, ongoing monitoring, and escalation thresholds.

How It Differs from Standard Customer Due Diligence

Standard due diligence focuses on the immediate customer or relationship holder. Know Your Customer's Customer adds a second layer, looking through that relationship to understand the parties, use cases, and transaction patterns ultimately reached through it.

This is especially relevant in correspondent relationships, resellers, marketplaces, payment intermediaries, platform providers, and other models where customer identity and activity are not fully visible at the first hop. The stronger the intermediary’s control over downstream onboarding and transaction monitoring, the more important it becomes to understand those controls rather than relying on the intermediary’s assurance alone.

The concept is often confused with collecting more documents from the direct customer. In reality, it is about visibility and risk attribution, not just paperwork. The goal is to understand the downstream customer base well enough to judge whether the intermediary’s business model is compatible with the organisation’s risk appetite and regulatory duties.

What Good Visibility Looks Like

Effective extended diligence usually combines business-model analysis, customer-base profiling, transaction-flow review, and an assessment of the intermediary’s own controls. A useful review asks whether downstream customers are screened, whether activity is monitored, and whether the partner can identify unusual patterns when they arise.

Where the downstream customer base is broad or opaque, FATF Recommendations, the AML and KYC framework provide the core baseline for customer due diligence, beneficial ownership, and ongoing risk-based controls. For identity assurance at onboarding, NHIMG’s Identity Proofing and KYC Guide explains how stronger verification methods reduce the chance that the first layer of trust is already compromised.

When the downstream customer profile itself creates risk, the practical issue is whether the intermediary can still demonstrate transparency, escalation, and control. If it cannot, the organisation may need to treat the relationship as higher risk even if the direct counterparty appears compliant on paper.

Risk and Threat Considerations

Know Your Customer's Customer is designed to reduce hidden exposure, because the direct counterparty may not be the real source of financial crime, sanctions, fraud, or misuse. Indirection creates a blind spot: the immediate customer can be legitimate while the downstream customer base contains the behaviour or geography that drives the actual risk.

Failure mechanism: Risk is created when an intermediary cannot reliably reveal, screen, or monitor the customers it serves, allowing unsafe activity to flow through a relationship that otherwise appears acceptable.

Impact: Organisations can misprice risk, miss suspicious activity, fail due diligence expectations, and retain relationships that become vectors for laundering, sanctions breach, fraud enablement, or regulatory scrutiny.

Practitioner Guidance

Governance implication: Treat Know Your Customer's Customer as an escalation path, not a blanket requirement. Use it when the business model, distribution chain, or regulatory context makes downstream visibility materially important to the decision about onboarding, monitoring, or retention.

What to watch for: Opaque reseller structures, platform aggregation, high-risk customer segments, weak downstream screening, and inconsistent explanations of who actually uses the product or service are the signals that usually justify deeper review. The most useful judgment is often whether the intermediary can evidence control over its own customer base, not just describe it.

Related resources from NHI Mgmt Group

• How do you know if passkeys are actually improving customer IAM?
• How do teams know if customer identity self-service is working safely?
• How do organisations know whether an AI assistant roadmap is being driven by real customer demand?
• What is the difference between Know Your Customer and Know Your Agent in agentic commerce?