AML/KYC compliance for fintechs: a program that passes audits

AML, anti-money laundering, is the whole program of controls a firm runs to detect and prevent money laundering and terrorist financing. KYC, know your customer, is the identity-and-due-diligence component of that program: verifying who the customer is and who ultimately owns or controls them. KYC is a part of AML, not a synonym.

The distinction matters in an audit. A regulator does not only ask whether you verify identities; it asks whether identity verification sits inside a documented, risk-based system with governance, monitoring, reporting and testing around it. A firm that confuses good onboarding with a complete AML program is the firm that fails the inspection.

In 2024 the EU adopted a single, harmonised AML package that materially changes the compliance baseline. Knowing which instrument does what, and when it applies, is essential for dating a program correctly.

The practical framing is this: firms comply today under the AML directives in force, and move to the directly-applicable AMLR rulebook from 10 July 2027. A program built now should already anticipate the AMLR rather than be rebuilt for it later.

AML obligations fall on what EU law calls obliged entities. Credit and financial institutions are squarely in scope, and for the fintech sector that expressly includes payment institutions, electronic money institutions, neobanks and crypto-asset service providers.

In other words, if you hold a payments, e-money or MiCA licence, a full AML/CFT program is not optional and not a nice-to-have. It is a licensing condition, and supervisors increasingly treat AML weakness as a reason to delay or refuse authorisation in the first place.

Customer due diligence (CDD) is the set of checks a firm runs to know and risk-rate its customers. CDD is always required when establishing a business relationship, when there is a suspicion of money laundering or terrorist financing, or when there are doubts about previously obtained identification data. For one-off dealings, fixed monetary thresholds also trigger CDD.

The thresholds are changing, so state the current and future figures together. For occasional transactions, the EU threshold moves from EUR 15,000 today to EUR 10,000 under the AMLR from 10 July 2027. Crypto is treated more tightly: CASPs must apply due diligence to occasional crypto transfers above EUR 1,000. The AMLR also introduces an EU-wide cash payment cap of EUR 10,000, though lower national caps may remain in place.

Enhanced due diligence (EDD) applies to higher-risk situations and means more information, senior sign-off and closer ongoing monitoring. It is required for politically exposed persons (PEPs), customers connected to high-risk third countries, and complex or unusually large transactions without an obvious economic purpose. Under the AMLR, very high-value relationships, such as wealthy clients above defined asset thresholds, are also brought into the EDD net.

Beneficial ownership is the other pillar auditors probe hard. A beneficial owner (UBO) is the natural person who ultimately owns or controls the customer. AMLD6 lowers the identification threshold from more than 25% to 25% or more of shares or voting rights, and requires more detailed, EU-interconnected central registers, including for non-EU entities with EU links. A program that still applies the old above-25% test is already out of step with the new standard.

Knowing a customer at onboarding is not enough; a firm must keep watching the relationship. Ongoing and transaction monitoring screens activity against the customer's expected profile and against sanctions, PEP and adverse-media lists, and flags anomalies for review. This is the engine that turns static KYC data into live risk management.

For crypto firms there is an additional, specific obligation known as the travel rule. Under the Transfer of Funds Regulation, Regulation (EU) 2023/1113, originator and beneficiary information must accompany crypto-asset transfers between providers regardless of amount. Transfers to or from self-hosted wallets above EUR 1,000 trigger additional verification that the customer controls the wallet.

Regulators inspect documents and decisions, not good intentions. A program passes an audit when each of the following building blocks exists, is written down, is proportionate to the firm's risk and is demonstrably operating in practice. Averium advises on the program and its legal sufficiency on a vendor-neutral basis, so the framework is built to withstand the supervisor rather than to fit a particular tool.