KYC vs KYCC: In Which Cases Financial Companies Can Require Information About Your Clients

Best Practice by Bilderlings

By Dmitry Kuvshinov , Bilderlings Executive Officer

If you haven't yet encountered the term KYCC from your bank, read this article to be prepared when the question arises. Here we will explain how financial organizations protect themselves (and you!) from toxic partners.

KYC or Know Your Customer guidelines and regulations in financial services require professionals to verify the identity, suitability, and risks involved with maintaining a business relationship with a customer. The procedures fit within the broader scope of anti-money laundering (AML) and counter terrorism financing (CTF) regulations. 

KYCC or Know Your Customer's Customer is a process that identifies a customer's customer activities and nature. This includes the identification of the customer's customers and assessing the risk levels associated with their activities.

The events of the past two years have significantly expanded the volume of international sanctions that financial institutions must comply with. This, in turn, has affected the way businesses and transactions are scrutinized, imposing additional obligations on the businesses themselves. Today, every company must ensure that its operations and operations of its partners do not violate any international sanctions.

What does this mean in practice? It means that every entrepreneur must thoroughly verify the information about their partners, including details about the ultimate beneficiary (an owner or a person who benefits from an asset, regardless of whether they officially own it). This is particularly relevant for those engaged in international trade, but even when trading within the EU, you must ensure that the beneficiary is not a sanctioned entity.

Therefore, business partners have started requesting the beneficiary's passport before finalizing a deal.

Banks and payment institutions apply KYCC practices when, for example, our client purchases goods from another company. We want to ensure that this company is not owned by sanctioned individuals or, for instance, is not a subsidiary of a business involved in the arms trade.

Technically, it’s not so much “client’s client” as it is “client’s partner” — the relationship structure is slightly different, but the essence remains the same: we don’t just want to know that our client is a freight forwarding company registered in Germany; we want to know who they are transporting goods for and to be assured that those entities are not owned by sanctioned individuals.

If the company is public, then, of course, we don’t have any questions: we verify this information ourselves. However, if data is located in closed registers, and we have reasonable suspicions, we can ask our client to request these documents from their partner.

Case Study: A European company wants to purchase a non-sanctioned product from a Belarusian company. They googled the company and found that it is not on any sanctions lists, so everything seems fine. However, it’s not that simple, because this Belarusian company is owned by a Russian holding, which is under sanctions. The problem is that Belarus has a closed register, and simple googling is not enough: to find out the ownership of the company, one needs to request this information from them.

Of course, we do not accuse the client (the European company) of intending to violate sanctions. However, the company lost time on an unsuccessful deal. Therefore, we recommend businesses ask their partners for a bit more information than what Google can provide.

A company should take "reasonable measures to avoid sanctions restrictions." The minimum action you can take is to request information about the owner / beneficiary of your partner's company. They will provide you with a name, and you can then check this name against public sanctions lists.

Apart from sanctions risks, there are other concerns. For example, if it concerns working with a company owned by a politically exposed person. Be prepared that in such a case, transactions with such a company will attract much more attention from compliance. Or in the case of affiliate marketing, we examine who the company provides advertising promotion services to, as this involves issues related to prohibited content.

For financial organizations opening an account with us, we review their client portfolio as a standard practice.

Sometimes KYCC is applied when a company's activities don't align with public information. For example, your firm is purchasing bolts from them, but publicly they are listed as a marketing company. This discrepancy can raise questions about whether the company has employees with appropriate competence or experience to provide such a service.

Overall, the logic is simple: the riskier the company, the more documents will be requested when opening an account and processing a payment. It's important to understand that almost any company is considered high-risk today if the supply geography is related to CIS countries.

For certain types of products, it is crucial to know the ultimate user. If a company is selling a product that is prohibited from being imported into sanctioned countries, we need to verify the real ultimate buyer. This buyer cannot be a company that recently operated in a sanctioned country but is now registered in the EU, nor can it be an unknown company that has suddenly appeared. Products that are banned from being imported into sanctioned countries can only be purchased by companies that clearly need the product for their legitimate activities and whose operations are entirely based within the EU. If there are any doubts and the client making the payment cannot provide an end-user certificate, the payment will be declined

It is important to understand that all these measures are not intended to complicate business operations (although we acknowledge that this bureaucratic burden can be frustrating). They are designed to ensure the transparency of financial transactions and to protect the business itself from legal violations. It is crucial for corporate clients to collaborate closely with their personal managers, who essentially perform the role of private bankers, assisting businesses in completing these processes quickly and correctly.