This article is a contribution from one of our content partners, Avollone
Implementing Know Your Customer (KYC) procedures is essential for businesses operating in industries with products that are more likely to be used for financial crime, trading in countries and areas with sanctions, counterparties that increase the financial crime risk, or companies there regulated by AML / CTF regulation. KYC helps prevent financial crimes, protect the company’s reputation, and ensure compliance with regulatory standards.
If you’re looking to get started with KYC, here are ten steps to guide you through the process.
The first step in implementing KYC is to understand the regulatory requirements relevant to your industry and region. Different countries have varying regulations concerning KYC and anti-money laundering (AML) practices. Research the specific laws and guidelines that apply to your business. This understanding will help you design a KYC process that meets legal standards and avoids potential fines or penalties.
As a non-regulated company, it is very helpful to implement KYC using regulatory principles. This ensures that you meet the expected standards from your counterparties and makes it easier to explain it to them. It also increases the likelihood of designing an effective KYC process.
Another key component of this first step is that you need to understand what risk you are trying to mitigate before you design your policy. The best approach would be a Risk Assessment, where you would systematically identify, evaluate, and manage risks that are likely for your business—in particular, the ones that would be potentially hazardous or negatively impact your organization.
Once you are familiar with the regulatory requirements, the next step is to define your KYC framework and policies.
A KYC framework is based on various levels of documentation. The starting point for the Framework is the Financial Crime Risk Assessment, which we have referenced in the previous step. If it hadn’t been completed yet, then it should be done first to identify the inherent risks that the company is exposed to and must mitigate. Based on the risk assessment, then a number of policies will be created which outline how the risks must be mitigated, and the roles and responsibilities which define who should do what across the organization. The procedures, guides, and templates are the practical implementation that make up this framework of how to comply with the company’s Kyc and financial crime prevention program.
Your KYC policy should outline the objectives, scope, and requirements for KYC, screening, and assessing the counterparty risk. It should also detail the roles and responsibilities of employees involved in the KYC process. A well-defined policy serves as a blueprint for your KYC implementation and ensures consistency across your organization.
Designing the KYC process involves mapping out the steps your company will take to verify customer identities and monitor their activities. This process typically includes:
Most companies will also build the sanctions, PEP, and adverse media screening into the KYC process. An effective screening process depends on quality KYC data, and the screening result is important for the counterparty risk assessment.
Implementing KYC manually can be time-consuming and prone to errors. Selecting the right technology solutions can streamline the process and enhance accuracy. Look for KYC software that offers features like automated data collection, identity verification, risk assessment, and transaction monitoring. Ensure that the technology is scalable and compliant with relevant regulations.
A tool should also make it easier to design your KYC process (step 3) since it should come with helpful workflows.
Effective KYC implementation requires knowledgeable and vigilant staff. Provide comprehensive training to employees involved in the KYC process. Training should cover the importance of KYC, regulatory requirements, your company’s KYC policy, and how to use the selected technology tools. Ensure that your staff is trained to recognize red flags and understand the reporting protocols. Regular training sessions should be conducted to keep staff updated on the latest trends and regulatory changes.
One of the most important of all the steps is to just get started. The previous steps are important as they provide you with the overall approach, strategy, and procedure for your KYC, but all the planning in the world will not be useful if implementation is not started. So, we strongly recommend that as soon as you can, start collecting and verifying your counterparties’ information—and then assess and document their risk levels within your selected tool.
Remember, even if the above steps seem very comprehensive, it is better to start small and mature as you gain more insight into your risk and process. The most effective control is the one that has been implemented.
Part of an effective KYC process is the ability to detect, review and escalate suspicious activities, so establish clear internal processes for the reporting within your organization of such activities. Prompt and accurate analysis and escalation with concerning, suspicious or unusual behavior with your counterparties is crucial when it comes to compliance and preventing financial crimes.
Accurate record-keeping is a crucial aspect of KYC compliance. Ensure that all customer information and data are meticulously documented and securely stored. Maintaining thorough records not only helps in audits and regulatory reviews but also supports internal investigations and risk assessments. With the right tool and technology, it can serve as your reliable data management system to handle and protect these records, ensuring they are easily accessible when needed, while still meeting GDPR and other privacy requirements.
Creating a culture of compliance within your organization is essential for the success of your KYC program. This involves promoting awareness of the importance of KYC and AML regulations among all employees, not just those directly involved in the KYC process. Encourage ethical behavior and a proactive approach to identifying and mitigating risks. Leadership should set the tone by emphasizing the importance of compliance in all business activities. Regular internal communications, training, and incentives can help reinforce this culture and ensure everyone is committed to maintaining high standards of integrity.
KYC implementation is an ongoing effort that requires regular review and improvement. Periodically audit your KYC processes to identify any gaps or inefficiencies. Solicit feedback from staff and customers to understand their experiences and make necessary adjustments. Stay informed about regulatory changes and industry best practices to keep your KYC procedures up-to-date and effective.
By following these ten steps, your company can establish a strong KYC framework that helps prevent financial crimes, protect your reputation and build trust with customers and stakeholders.
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click [HERE] or fill out the form below.
This article is from our partner, Ebury
We want our clients to stay on top of current Fraud & Security trends to help keep your money safe; that’s why we’d like to share some tips to avoid scams, guide you through the detection, prevention and recovery stages and on how to comply with the Data Protection Regulation.
Investment scams have always been on our radar, from property investment scams to pyramid schemes, but the new scam of choice for 2021 seems to be cryptocurrency schemes. With cryptocurrency being one of the newer concepts when it comes to investment, fraudsters are provided with an opportunity to exploit this knowledge gap in consumers. These cryptocurrency schemes are convincing, with some even using fake celebrity endorsements. The schemes prompt potential investors to fill in a contact form, which is followed up with a telephone call from the scammer encouraging the investor to set up a cryptocurrency wallet. During this process, the scammer installs remote access software onto the investor’s device. Over time, the victim is encouraged to invest increasingly large amounts until the scammer finally empties the wallet and flees. With these particular scams, the warning signs include the unrealistic promise of big profits or ‘get rich quick’ advertising and the corporate names that these scammers masquerade under will not be registered with the FCA. It is also important to note that a legitimate investment in cryptocurrency would always involve a digital wallet that only the account holder can access – if someone else can directly control it, alarm bells should be raised.
We have recently become aware of a successful scam doing the rounds internationally. A scam company called ‘Infinity Electronic’, ‘Infinity Element’ or ‘Ocean Components’ claims to sell electronic goods. It takes payments from international customers to bank accounts in a variety of names, located in Hong Kong. The goods promised are never sent, and by the time the victims realise, the company’s website is down and can no longer be contacted. Should you fall victim to a scam of this kind, we recommend reporting it to local law enforcement or your local fraud reporting agency. If the payment has been processed via Ebury, let us know at fraud@ebury.com.
To avoid falling victim to scams, or any form of APP fraud, follow these tips:
Securing communication via email has become essential for every organization. Here at Ebury, we take email security very seriously and aim to protect our employees from social engineering techniques such as phishing. Attackers are now favouring simpler phishing attacks harvesting user credentials, as opposed to more sophisticated attacks involving malware. User credentials can allow an attacker access to an email account and, consequently, to sensitive information that the attacker can use to dupe their victims. Be suspicious if you receive emails asking you to verify your account or enter login details. These emails may redirect you to spoofed websites that can capture your credentials. Do not get scared by urgent requests – instead, go directly to the correspondent website and access it from there to verify your account status. We are aware that detection can be challenging. Bigger organisations such as Ebury rely on machine learning engines to detect compromised accounts and quickly activate an incident response plan. For smaller businesses, it is critical to read your emails with care, check the sender, analyse the language used and look out for unusual requests such as a change of bank details for a supplier. To make sure your own account has not been compromised, regularly check for any forwarding rules or email filters in your email settings. Detection is important, but we would also like you to become familiar with some prevention measures that will help to keep your account safe. Always use complex, unique passwords and avoid using the same credentials across different systems, as this will leave you vulnerable to attackers. Always configure multi-factor authentication where available and, if possible, utilise security mechanisms to detect phishing attacks or potentially compromised accounts. If you think your email account has been compromised, please follow these email recovery steps:
Tips to help sole traders, small and medium-sized businesses in understanding and assist in complying with their data protection obligations
Ebury is committed to ensuring the security and protection of the personal information we collect and process to provide a consistent and compliant approach to data protection. The key principles we adhere to are;
With this in mind, it is important to acknowledge that cybersecurity and, in turn, implementing good data protection and security practices is everyone’s responsibility. Cyberattacks don’t only happen to large corporations. Small businesses, groups and individuals have to protect their IT systems, too. Being your own boss is great, and there are many rewards; however, there are also many responsibilities in ensuring you protect the information that is important to you. Following these tips is a good starting point in protecting the information you work with;
Even if you don’t think you use or keep a lot of data, you still need to know what personal data you have, so make a quick list of it if you haven’t already.
More Info
Also take into consideration the data you have saved on smartphones, tablets or computers. This could be people’s names and contact details, email addresses or notes that you have made.
If you are processing and storing personal information, you need to let people know what you’re doing with their data. The easiest way to do this is to have a privacy notice available, either in a hard copy or on your website (see Ebury’s Privacy Policy (UK))
More Info
People have a right to know what you’re doing with their personal data. Many small business owners use third-party suppliers to provide them with a ready-made privacy notice. If you choose this route over making your own, be aware that you still need to know what it says. Your privacy notice sets out your commitment to the individuals (e.g. customers/clients) who are trusting you with their personal data.
Where you are processing and storing personal data, you have to protect people’s data from getting lost or falling into the wrong hands. Data Security doesn’t have to cost the earth, but any business that wants to be trusted has to get it right. If you are using, storing or processing lots of data, and in particular personal/sensitive data, then you need to take some extra steps to keep it safe.
Information Commissioner’s Office [Data Protection when it’s just you]
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
This article is a contribution from our partner, Avollone
Artificial intelligence is transforming how organizations manage Know Your Customer (KYC), Customer Due Diligence (CDD), sanctions screening and financial crime investigations. AI agents can review documents, extract information, prepare questionnaires and support risk assessments. For compliance teams dealing with growing workloads, the opportunity to reduce repetitive manual work is significant.
But as organizations move from experimenting with AI to relying on it for daily operations, another question is emerging: What happens when the cost of AI increases?
As Stacia Garr explores in her Harvard Business Review article, How to Respond to the Coming AI Cost Shock, the economics of enterprise AI are changing. For financial crime compliance teams, understanding those economics is becoming an important part of building sustainable AI-powered operations.
Agentic AI refers to artificial intelligence systems that can plan and execute multiple tasks toward a defined objective, using tools, information and predefined permissions. In KYC and financial crime compliance, AI agents can support document collection, information extraction, questionnaire completion, sanctions investigations and due diligence reviews. Unlike traditional automation, which follows fixed instructions, agentic systems can coordinate several steps within a workflow. However, their activities still require appropriate controls, validation and human oversight.
Most organizations evaluate AI investments based on expected efficiency gains. If an AI system reduces the time required to complete a KYC request from an hour to 15 minutes, the potential productivity benefit is relatively easy to understand. But the cost of delivering that automation can be harder to predict.
Many AI services charge based on tokens, which represent units of information processed by a model. Costs can depend on the model used, the volume of information processed, the number of interactions and the complexity of the workflow. In her HBR article, Garr argues that enterprise AI adoption has benefited from software vendors absorbing substantial infrastructure and processing costs, creating expectations around inexpensive or included AI functionality. She warns:
“The era of artificial pricing is coming to an end.”
As vendors introduce or expand usage-based pricing, organizations may find that AI processing becomes a more significant variable operating expense. This is particularly relevant for financial crime compliance, where workload complexity can vary considerably. An AI agent handling a straightforward corporate KYC questionnaire may require relatively little processing. Another investigating a multinational ownership structure could need to examine hundreds of documents, identify connected entities and perform multiple rounds of analysis. The second workflow may consume substantially more computing resources.
Token consumption is an important cost driver for many AI-powered compliance workflows. Consider two hypothetical KYC cases: The first involves a domestic company with a straightforward ownership structure, a small number of directors and readily available corporate documents. The second involves an international corporate group with multiple subsidiaries, complex beneficial ownership, documents in several languages and additional due diligence requirements.
Even if both cases are classified as KYC reviews, their AI processing requirements may be very different.
Agentic systems can also perform repeated reasoning steps, retrieve information and reprocess documents as they work toward completing a task.
Risk consultant Pedro Arevalo – who has deep expertise in risk, financial crime and fraud, including the application of AI, advanced analytics and technology to strengthen controls, improve decision-making and transform customer and operational processes – highlights this concern in his LinkedIn commentary on the potential AI cost shock for financial crime compliance operations, observing that documents, connected parties, ownership layers and transactions can materially increase token consumption. This creates a potential mismatch between the number of KYC cases completed and the computing resources required. For organizations planning AI adoption, measuring the average cost per completed case is therefore more useful than looking only at the price per million tokens.
The return on investment from AI in KYC should reflect the full cost of completing a compliance process. This includes AI processing costs, software fees, implementation, human review, quality assurance and exception handling.
A practical approach is to compare the total cost of an AI-assisted workflow with the cost of completing the same work manually, while maintaining comparable quality and control standards. For example, an organization could assess how much time AI saves when preparing KYC responses, how often human reviewers need to correct its work and how frequently cases require additional investigation. As Garr explains:
“The key pricing elements are out of your control.”
Her point refers to the uncertainty surrounding interactions per agent, usage per request and unit pricing.
For compliance leaders, this implys that understanding AI return on investment requires monitoring both processing costs and the operational value delivered. The objective isn’t simply to maximize automation. There’s also a need to reduce the cost and effort of completing KYC accurately, with consistency and within acceptable risk parameters.
AI can prepare information, identify inconsistencies and recommend next steps. But organizations still need people who understand the regulatory context and can exercise professional judgment. This becomes particularly important when cases involve complex ownership structures, sanctions exposure, politically exposed persons or enhanced due diligence.
There is also an operational resilience consideration. If an organization becomes heavily dependent on AI and subsequently faces a major price increase, provider outage or service disruption, it needs a practical way to maintain essential compliance operations. Garr highlights the risks of losing institutional knowledge when organizations replace employees with AI-driven processes. And Pedro Arevalo raises the same concern specifically for financial crime compliance, asking:
“If AI becomes too expensive, can humans absorb the work?”
This is a particularly relevant question for compliance teams, where experienced professionals may need years to develop expertise in financial crime risk assessment and investigations. Organizations should therefore retain sufficient internal expertise, document procedures and establish contingency arrangements. The most resilient model would combine AI efficiency with human accountability.
Many have pointed out that not every task requires the most advanced or expensive AI model, and this is certainly true for compliance. Extracting information from a standardized document, identifying missing questionnaire fields and preparing a simple summary may require different capabilities from analyzing complex ownership structures or evaluating ambiguous adverse media findings. So, organizations can potentially reduce costs by matching the model to the task. For example, simpler models may handle routine extraction and classification, while more capable models are reserved for complex analysis. Some organizations may also consider open-weight models for suitable tasks, although infrastructure, maintenance, security and validation costs still need to be included. Arevalo makes a similar recommendation, encouraging organizations to balance commercial and open models rather than relying on the most expensive LLM for every compliance task.
Some have considered the usage of lower-cost models. However, it needs to be weighed against their ability to meet the necessary standards for accuracy, reliability and data protection. Models that do not will fail at meeting both the economic and data requirements, causing more work and risk.
Predictability starts with understanding how AI is actually being used. Compliance teams should establish baseline processing costs for common workflows, including KYC questionnaire completion, document extraction, ownership analysis and screening investigations. They should also monitor how costs change with case complexity and volume.
Vendor arrangements matter as well. Organizations should understand how usage is priced, whether there are consumption limits, how price changes are handled and what happens when demand exceeds forecasts.
Garr recommends incorporating AI consumption into broader organizational planning rather than treating it solely as a technology expense. Arevalo extends this argument to financial crime compliance, recommending that organizations:
“Plan capacity and budgets around headcount AND tokens.”
This recognizes that AI is becoming an operational resource alongside human expertise.
Organizations should also distinguish between purchasing AI infrastructure directly and using software that incorporates AI into its services. Customers may not be billed per token, but underlying AI economics can still influence pricing and service delivery.
Sustainable AI adoption requires a balance between automation, cost control, governance and operational resilience. For KYC teams, one effective approach is to apply AI where it can eliminate repetitive administrative work while preserving human review for decisions that require judgment, and this is particularly relevant to information collection and KYC response management.
Fintech / Regtech saas software providers such as Avallone have AI-powered KYC capabilities uniquely designed to support activities such as preparing KYC responses, reusing previously validated information and coordinating tasks across the response process. For example, Avallone’s KYC Responder lets organizations reduce the effort involved in repeatedly answering similar requests from banks and other counterparties, and their KYC Collector supports structured information gathering, document management, screening and risk assessment workflows.
Centralizing information and reusing validated data can also reduce unnecessary duplication, although actual AI cost savings depend on system design and usage.
There is no argument that agentic AI has considerable potential to improve KYC and financial crime compliance operations. But automation should not be measured solely by how many tasks an AI agent can complete or how much employee time it saves.
Organizations also need to understand processing costs, changing usage patterns, human oversight requirements and the financial implications of scaling AI across their operations.
The next stage of AI adoption in compliance will require organizations to think about capacity in two dimensions: people and computing resources so that KYC operations that remain efficient, reliable and financially sustainable as AI becomes part of everyday work.
Stacia Garr, Harvard Business Review, “How to Respond to the Coming AI Cost Shock,” August 17, 2026. https://hbr.org/2026/08/how-to-respond-to-the-coming-ai-cost-shock
Pedro Arevalo, LinkedIn commentary on the potential AI cost shock for financial crime compliance operations, October 13, 2026. https://lnkd.in/p/etXbM6n2
OpenAI, “What Are Tokens and How to Count Them?” https://help.openai.com/en/articles/4936856-what-are-tokens-and-how-to-count-them
Have more KYC questions?
Avallone is here for you. Connect with one of our KYC professionals who can address your questions, concerns and needs.
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
This article is a contribution from our content partner, TreasurySpring
AI agents could gradually change how corporate treasurers manage cash, reducing the inertia that keeps large balances in low-yielding bank accounts and putting pressure on banks’ deposit funding.
Torsten Slok, Apollo’s Chief Economist, put out a short note recently asking whether an agentic bank run is coming. He argues that AI assistants could soon start moving household cash automatically into accounts paying over 3%, rather than leaving it in US checking accounts paying 0.1% on average. If enough people did that, banks would lose a lot of the cheap funding they rely on to lend.
Although he’s talking about households, I think something similar could eventually happen in corporate treasury, although it might take longer. The balances are much bigger, most sit well above any deposit insurance limit, and moving them means treasury policies, approvals, and an audit trail. Nobody wants to explain to their board that an agent moved £20m somewhere it shouldn’t have.
When it does happen, though, I think the impact on banks could be much bigger too. I don’t necessarily mean a bank run in the traditional sense. More likely, it means gradually removing some of the inertia that keeps corporate cash sitting in low-yielding bank accounts today.
In July, the average rate on UK companies’ interest-bearing instant-access deposits was 1.97%. In the euro area it was 0.60%.
For context, central bank rates today are 3.75% in the UK and 2.50% in the euro area. They aren’t directly comparable with the rates available on corporate deposits, but they give a sense of the gap. A 178 basis point difference on £10m, for example, is equivalent to £178,000 a year.
For banks, this spread matters a lot. US banks’ net interest margin was 3.32% in the second quarter, according to the FDIC. In the UK, the Bank of England says aggregate net interest margins across the major banks increased year-on-year in the first quarter, with UK-focused banks benefiting from higher structural hedge income. Across European banks, net interest margins are around 1.6%. Cheap deposits aren’t the only thing driving those margins, but they’re clearly valuable to banks.
None of this is because treasurers aren’t paying attention. Nearly half of the organisations in the AFP’s 2026 benchmarking survey have fewer than five people in treasury. Moving cash somewhere new usually means another onboarding and KYC process, plus internal approvals, and there’s nearly always something more pressing that week.
It’s also worth saying that rate isn’t the only reason companies keep money with their relationship banks. Balances often sit alongside an RCF, better FX pricing, or access to capital markets business, and those relationships have real value. My view is that most teams just don’t have the time to work out how much of their balance the relationship genuinely needs, what could sit somewhere else, and what leaving it there is costing them. That’s the kind of analysis an agent could eventually run every day. In combination with access to secured institutional-grade products, treasurers could have an opportunity to generate enhanced risk-adjusted returns on their cash.
AI adoption will take time. Andrej Karpathy describes current models as having jagged intelligence, and anyone who uses them regularly will recognise that. They can do something genuinely impressive and then get something simple wrong.
Our own AI in Treasury Report, a survey of 55 treasury professionals, found only about a quarter use AI regularly. Cash flow forecasting is where they most want help, chosen by 73%, yet more than three quarters say accuracy is their biggest concern. Only 4% want AI involved in executing transactions. For now, treasurers want AI that supports decisions rather than one that carries them out, which I think is a reasonable position to hold today.
It is changing quickly though, with many companies looking to address issues with existing AI models. One interesting example is TypeSafe AI, which released Jev in early access this month. It isn’t a chatbot. It’s designed to take in messy information and return structured decisions. TypeSafe says it gives more consistent answers than a large language model and tells you how confident it is in each one.
It’s early, and those claims will need to be proven in practice, but the direction is interesting for treasury. Deciding where surplus cash should sit this week given your policy, existing exposures, and today’s rates is exactly the sort of structured problem that these systems should eventually be able to help with.
The other thing that will set the pace is infrastructure. An agent can only act on cash if the places holding it can be reached programmatically, with the right permissions and controls. Most corporate banking infrastructure wasn’t designed with autonomous agents in mind. My feeling is that platforms built API-first will enable these workflows much sooner, and that’s where treasurers will see the benefit first.
So I don’t expect anything like Silicon Valley Bank, where more than $40bn left in a single day. What seems more likely is a gradual shift. As more of the analysis gets automated, some of the inertia disappears. Banks then come under steady pressure on deposit margins and either pay more for corporate balances or find other ways to hold on to them.
If you ask an agent to find the highest rate, it will do exactly that, and that’s not a good enough objective for corporate cash.
An unsecured deposit is effectively a loan to the bank. At the end of 2022, around 94% of SVB’s deposits were uninsured. A well-designed agent should be weighing up the same things a good treasurer does. How likely is this counterparty to default? What would we recover if it did? Are we being paid enough for that risk? And does putting more money there leave us too concentrated?
At TreasurySpring, we look at every product on a risk-adjusted basis for this reason, rather than treating the headline yield as the only thing that matters.
This is where I think we are well placed. A single onboarding gives you access to more than 120 counterparties and 1,100+ Fixed-Term Funds (FTFs), so you aren’t limited to the banks you already have accounts with. Many of those FTFs are secured by collateral through repo.
More importantly in the context of agents, that information is increasingly machine-readable. Our MCP server lets AI assistants see available FTFs, current yields and your portfolio, while our API allows other systems to connect directly to the platform. This lets clients either plug that data into their own agent or, over time, use an intelligence layer built natively into the TreasurySpring Portal, with the products, the risk analysis, and their treasury policy all in one place.
For the time being, I’d still want a person signing off on anything material, with the agent doing the analysis and the treasurer making the decision.
But that alone could change quite a lot. If an agent can continuously look at a company’s cash, its treasury policy, its existing bank relationships, counterparty risk, and the alternatives available, it removes a lot of the work that means this analysis doesn’t happen as often as it could today.
I don’t think the corporate version of an agentic bank run will look much like a bank run. It’ll probably be much slower. But if AI gradually makes it easier for treasury teams to work out how much cash genuinely needs to stay with their relationship banks, where the rest could go, and what they’re giving up by leaving it there, the end result could still be significant.
*TreasurySpring’s blogs and commentaries are provided for general information purposes only, and do not constitute legal, investment or other advice.
Treasury Masterminds is a community of professionals working in treasury management or those interested in learning more about various topics related to treasury management, including cash management, foreign exchange management, and payments. To register and connect with Treasury professionals, click the button below.
