KYC, KYB, and AML/CFT: compliance for payment companies. 6 chapters and a final quiz.

Chapter 1. AML/CFT overview: framework, players, and what is at stake.

AML/CFT (anti-money laundering and countering the financing of terrorism) targets two mirror-image phenomena. Money laundering gives money of criminal origin the appearance of legitimacy. Terrorist financing channels funds, sometimes perfectly legal at the outset, toward terrorist activity. Payment companies are on the front line, since every transaction they process is a potential channel.

In France, the list of obliged entities is set out in Article L. 561-2 of the Monetary and Financial Code: banks, but also payment institutions, e-money institutions, crypto-asset service providers, currency exchange offices, and others. A licensed PSP therefore has exactly the same obligations as a bank. It must identify its customers, monitor their transactions, and report its suspicions, under the supervision of the ACPR (Autorité de contrôle prudentiel et de résolution, France’s banking supervisor), with TRACFIN as the financial intelligence unit.

Chapter 2. KYC: identifying and verifying an individual.

KYC (Know Your Customer) rests on two separate steps that Article L. 561-5 of the Monetary and Financial Code requires before the business relationship begins. First, identify the customer by collecting their identity details. Then, verify that identity against a reliable document. A payment account cannot be opened “in the meantime.” No completed verification, no relationship.

For remote onboarding, which is a PSP’s daily business, French law requires enhanced safeguards under Articles R. 561-5-1 and R. 561-5-2 of the CMF. Three main routes are available. The first is to use a remote identity verification provider (PVID) certified under the ANSSI framework. The second relies on a digital identity or a qualified eIDAS electronic signature. The third combines two complementary measures, for example a first transfer sent from an account in the customer’s name at a bank in the EEA, plus a copy of an additional ID document.

• Collect only what is necessary for the level of risk: KYC is not a data vacuum (see the GDPR course).
• Record who verified what, when, and against which document: in an ACPR inspection, an undocumented file is a file that does not exist.
• Plan for remediation: older, incomplete files must be brought up to date, starting with high-risk customers.

Chapter 3. KYB: entities, beneficial owners, complex structures.

KYB (Know Your Business) applies the same logic to legal entities (merchants, marketplaces, nonprofits). It adds one difficulty: behind a company there may be an ownership chain designed to hide who really controls the funds. At a PSP, KYB is the core of merchant onboarding, because you cannot collect payments for a merchant you do not know.

Article R. 561-1 of the CMF defines the beneficial owner as any individual who holds, directly or indirectly, more than 25% of the capital or voting rights. The article also covers anyone who exercises control by any other means, such as through a shareholders’ agreement or the right to appoint management. Failing that, the senior managing official is designated. This fallback must remain a documented exception, not the easy way out. The calculation runs through the ownership chain, multiplying the stakes at each level.

Public registers are not enough. Since the CJEU judgment of November 22, 2022 (Case C-37/20), public access to beneficial ownership registers has been restricted on privacy grounds. Obliged entities can still consult them, and the AMLD6 reopens access to journalists and NGOs that can show a legitimate interest. Above all, the register remains self-declared, so the obliged entity must report to the registry any discrepancy between what it finds and what has been filed.

Chapter 4. PEPs, sanctions, and asset freezes.

A politically exposed person (PEP) holds, or has held within the past 12 months, a prominent public function: head of state, minister, member of parliament, supreme court justice, ambassador, general officer, head of a state-owned company, and so on. PEP status extends to immediate family members and close associates. Being a PEP is not an offense. The exposure signals a corruption risk, and it automatically triggers enhanced due diligence.

• Approval from a member of senior management (or an authorized body) to establish or continue the business relationship.
• Establishing the source of wealth and source of funds involved in the relationship.
• Enhanced, ongoing monitoring of transactions, with lower alert thresholds.

Financial sanctions follow a different logic. You are no longer assessing a risk; you are applying a prohibition. The lists come from the UN, the European Union (directly applicable regulations), and individual countries. In France, the Treasury (Direction générale du Trésor) keeps the national register of persons and entities subject to an asset freeze. An asset freeze is a strict obligation that applies without delay: from the moment of publication, no funds or economic resources may be made available to the designated person.

Regulation (EU) 2024/886 on instant payments (the IPR) changed how screening works. For SEPA instant credit transfers, transaction-by-transaction filtering generated mass rejections and false positives that were incompatible with ten-second processing. It has been replaced by an obligation to screen your own customers against EU asset-freeze lists immediately after each new designation and at least once a day. This requirement has applied since January 9, 2025. Daily screening of the customer base (“IPR screening”) has therefore become an industrial process, with proof of execution to be retained.

{
  "batch_id": "screening-2026-07-10",
  "customers_screened": 412876,
  "lists": ["EU - restrictive measures", "National asset-freeze register", "UN"],
  "new_designations_since_last_run": 14,
  "hits": [
    {
      "customer_id": "c-58421",
      "name_matched": "IVANOV Sergei",
      "list": "National asset-freeze register",
      "match_score": 0.92,
      "discriminants": ["similar date of birth", "same country"],
      "action": "precautionary freeze + escalation to level 2 analyst"
    }
  ],
  "false_positive_rate_7d": "98.6%"
}

Day to day, screening comes down to managing false positives: namesakes, transliterations (Cyrillic, Arabic, Chinese), partial dates of birth. A mature setup calibrates its fuzzy matching (similarity score, secondary identifiers), logs every alert-clearing decision, and tracks its false positive rate. Conversely, a false negative (a sanctioned person who slips through) exposes the firm to criminal and disciplinary penalties: violating an asset freeze can carry up to five years in prison.

Chapter 5. Ongoing monitoring and TRACFIN reporting.

KYC continues long after onboarding. Article L. 561-6 of the CMF requires ongoing monitoring throughout the business relationship: transactions must remain consistent with up-to-date knowledge of the customer, their business, and their risk profile. In practice, that means transaction monitoring, periodic file reviews (at a frequency proportionate to risk), and updated documents.

• Structuring (smurfing): repeated deposits or payments just below reporting or alert thresholds.
• Pass-through account: funds received and then transferred out almost in full within a very short time, with no economic rationale.
• Money mules: individuals recruited (often through social media) to move fraudulent funds in exchange for a commission.
• Profile mismatch: a student receiving large business transfers, a local shop receiving payments from countries unrelated to its business.
• Product misuse: prepaid cards loaded with cash and then drained abroad, diverted crowdfunding pots, back-and-forth refunds between related merchants.

A transaction that is particularly complex or unusually large, with no apparent economic rationale or lawful purpose, triggers the enhanced review required by Article L. 561-10-2. The firm must inquire into the source and destination of the funds, the purpose of the transaction, and the identity of the beneficiary, and record everything in writing. The review ends either with a documented decision to close the alert or with a suspicious activity report.

A suspicious activity report (Article L. 561-15) follows precise rules. There is no minimum amount, since suspicion is enough, and it must be filed before the transaction is executed whenever possible. A reporter acting in good faith enjoys civil, criminal, and professional immunity. Do not confuse it with COSI (systematic information reports), automatic filings made without any suspicion. They cover money remittance transactions from €1,000 per transaction in cash or e-money (€2,000 cumulative per customer over a month). They also cover cash deposits or withdrawals above €10,000 per month on an account.

Chapter 6. Risk-based approach and compliance governance.

The risk-based approach focuses resources where risk is highest. It takes the form of a formal risk classification, reviewed at least once a year, that combines four dimensions and feeds each customer’s risk score. That score in turn sets the due diligence level, review frequency, and alert thresholds.

The geographic dimension relies on FATF lists. The blacklist (countermeasures) covers Iran, North Korea, and Myanmar. The gray list (increased monitoring) changes at every plenary, and the listing of Monaco in June 2024 was a reminder that no financial center is immune. On top of that comes the EU list of high-risk third countries, which automatically triggers enhanced due diligence.

The governance the ACPR expects rests on named roles: a person responsible for running the AML/CFT program, plus a designated TRACFIN reporting officer and liaison officer. Then come regular, documented training for all exposed staff and a two-tier internal control system. Permanent control covers first- and second-level checks on an ongoing basis; periodic control is internal audit. Outsourcing a task (screening, KYC) never outsources the responsibility.