KYC vs AML: what is the difference?

KYC is one part of AML. KYC answers who the customer is, who owns and controls it and what the account is for. AML asks whether the money that later moves through the account fits that picture, and it sets what the bank does when it does not.

KYC in banking checks the items that Article 20 of the AMLR lists as customer due diligence measures. The bank identifies the customer and verifies the identity. It identifies the beneficial owners and understands the ownership and control structure. It learns the purpose and intended nature of the business relationship, checks the customer and the owners against targeted financial sanctions and finds out whether they are politically exposed persons. Then it monitors the relationship.

For KYC verification of a natural person, Article 22 names the minimum data: all names and surnames, place and full date of birth, nationalities and the usual place of residence. KYC and CDD mean the same checks: KYC is the industry term, customer due diligence the legal one. The German GwG lists the same general duties in § 10, from identification of the contracting party to ongoing monitoring. KYC requirements rise with risk, from simplified measures (Article 33) to the stricter measures for higher risk (Article 34).

AML in banking is the program that keeps criminal money out of the bank and reports it when it gets in. Anti-money laundering regulations require a bank to report to the FIU on its own initiative when it knows, suspects or has reasonable grounds to suspect that funds are proceeds of criminal activity, "regardless of the amount involved" (AMLR Article 69).

Monitoring runs on software. Section 25h(2) of the German Kreditwesengesetz requires credit institutions to operate data processing systems that detect transactions which are unusually complex or large, or which have no apparent economic purpose. So AML and KYC in banking work as a pair: KYC builds the customer profile, and AML monitoring compares every payment with it.

From July 10, 2027, the KYC and AML duties of banks stand in one EU regulation. The AMLR is "directly applicable in all Member States" (Article 90), so banks in Germany and Austria will read their duties in the regulation itself. It also caps cash payments for goods or services at EUR 10,000 (Article 80).

AMLA, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, sits in Frankfurt am Main. It assesses credit and financial institutions that operate in at least six Member States (Article 12). Those with a high residual risk become selected obliged entities under its direct supervision (Article 13). Recital 86 says direct supervision "should commence as of 2028".

KYC in crypto is the same customer due diligence, applied by crypto-asset service providers such as exchanges and custodians. Regulation (EU) 2023/1113 added crypto-asset service providers to the financial institutions covered by Directive (EU) 2015/849 (Article 38). Under the AMLR, a crypto firm applies customer due diligence to an occasional transaction from EUR 1,000, while the general threshold is EUR 10,000 (Article 19).

Crypto KYC also feeds the travel rule. With every transfer, the crypto-asset service provider of the originator sends the name and the distributed ledger address of the originator, plus the postal address, official document number and customer number, or the date and place of birth (Regulation (EU) 2023/1113, Article 14). A crypto exchange without KYC data cannot fill in those fields.

In Germany the Geldwäschegesetz sets the KYC duties (§ 10). BaFin supervises credit institutions, payment institutions and crypto-asset service providers under it (§ 50). In Austria the FM-GwG applies, and the FMA supervises compliance with it and with Regulation (EU) 2023/1113 (§ 25). Both countries move to the AMLR on July 10, 2027.

AMLA, the new EU AML authority, works from the MesseTurm in Frankfurt am Main. It was established on June 26, 2024 and started operations in summer 2025. Its timeline names 40 obliged entities to be selected for direct supervision during 2027, with direct supervision from 2028 (AMLA).

Switzerland is not in the EU, so the AMLR and AMLA do not apply there. The Swiss Anti-Money Laundering Act requires financial intermediaries to verify the identity of the contracting partner and identify the beneficial owner. FINMA supervises banks, securities firms and insurers under it; banks also follow the Agreement on the Swiss banks' code of conduct with regard to the exercise of due diligence (CDB 20). This page gives no legal advice.