The Invisible risk: Knowing your customer is key to preventing money laundering

Picture of Astrid Dominguez

Astrid Dominguez

  1. The Origins of Due Diligence and Know Your Customer

Current due diligence obligations did not emerge as a complex concept, but rather as a practical necessity: knowing who you are doing business with. One of the earliest precursors was the U.S. Bank Secrecy Act (BSA) of 1970, which required companies to maintain records and report information relevant to investigations. In simple terms, it marked the beginning of basic controls to prevent the use of the financial system for illicit purposes.

Over time, these controls evolved, and in the 1980s, the FATF introduced international standards that were strengthened following events such as the BCCI case and the September 11 attacks. Today, these obligations are no longer optional or general in nature, but rather form part of a structured system that companies must implement.

In practice, this translates into four key elements:

    • KYC is the starting point: identifying the customer.
    • Due diligence goes further, assessing risk and monitoring the relationship.
    • The know-your-customer policy defines internally how these processes are applied.
    • Measures are the concrete actions, such as requesting information, classifying risks, or monitoring transactions.

Understanding this difference is key, because it is not just about complying with a requirement, but about implementing a system that allows for the prevention of legal and reputational risks from the outset of the business relationship.

  1. Know Your Customer Policy

In practical terms, the “Know Your Customer” policy is the starting point of any anti-money laundering system. The Guatemalan Superintendency of Banks defines it as the set of policies and procedures that regulated entities must implement to identify their customers, verify their identity, and build a profile that allows them to understand who the customer is and what risk they pose.

This involves not only confirming that the customer is who they claim to be, but also gathering sufficient information to understand their activities, their expected behavior, and the nature of their relationship with the company. Based on this, appropriate and proportionate controls can be applied.

In practice, this policy allows companies to prevent their products or services from being used for illicit purposes. To this end, regulations require the adoption of programs, procedures, and internal controls that include specific measures for customer identification, verification, and monitoring, as part of a comprehensive risk management system. [1]

  1. Customer Due Diligence

Customer due diligence is the core of the anti-money laundering system. In simple terms, it is the process that allows a company not only to identify its customer but also to understand who they are, how they operate, and what level of risk they pose throughout the business relationship.

According to FATF standards, these measures must be applied at key moments, such as when initiating a business relationship, when conducting significant transactions, when suspicions arise, or when doubts emerge regarding customer information. In practice, this involves verifying identity through reliable sources, identifying the beneficial owner, understanding the purpose of the relationship, and continuously monitoring transactions.

This approach has also been adopted at the local level. The Superintendency of Banks requires similar measures, particularly regarding the identification of the customer and the beneficial owner. Meanwhile, the draft Law 6593 reinforces this concept by defining due diligence as a comprehensive process that includes policies, procedures, and controls to identify, verify, and monitor the customer, as well as to understand their transactions and risk profile.

Furthermore, the bill expands the circumstances in which these measures must be applied, including changes in risk level, the purchase of new products, or the detection of unusual transactions. In all cases, the principle is the same: the measures must be proportionate to the risk, which implies that not all customers are managed in the same way.

In practice, this translates into a key concept for companies: due diligence is not a one-time formality, but an ongoing process that helps prevent legal, operational, and reputational risks from the outset and throughout the entire customer relationship.

  1. Simplified and Enhanced Due Diligence

A key element of due diligence is that it is not applied uniformly. International standards and local regulations allow its scope to be adjusted according to the level of risk identified.

In low-risk cases, simplified due diligence measures may be applied, provided there is a documented prior assessment to support them. This implies more streamlined processes, but without eliminating the obligation to identify and verify the customer. However, these measures do not apply when there are unusual transactions or indications of higher risk.

Conversely, when high risks are identified, institutions must intensify controls. This entails a more in-depth analysis, greater verification of information, and stricter monitoring of the relationship. This approach is particularly relevant in situations such as relationships with politically exposed persons, transactions with high-risk jurisdictions, complex structures like trusts or non-domiciled entities, as well as in the use of new technologies or relationships without face-to-face contact.

In practice, this reflects a fundamental principle: not all customers or transactions are managed the same way. The key is to apply measures proportional to the risk, ensuring that controls are sufficient to prevent the misuse of products and services.

  1. Practical Recommendation

The risk of money laundering is not exclusive to the financial sector, but a latent risk for any company that interacts with customers, suppliers, or cash flows. In this context, it is crucial to recognize that exposure may exist even without direct intent.

Therefore, it is recommended that all entities, whether or not they are subject to specific regulation, implement at least a basic know-your-customer policy. This should evolve into due diligence measures that allow not only for identifying the customer but also for continuously monitoring their behavior and transactions.

In practice, having these controls in place allows for the timely detection of unusual activities and reduces legal, operational, and reputational risks, thereby strengthening decision-making and business sustainability.

References