How is Customer Due Diligence Crucial for KYC/AML in Crypto?

Customer Due Diligence (CDD) is the process to establish the identity and risk profile of your customers. Crypto, DeFi and Web 3.0 companies often deal with international funds transfers on the blockchain as a core part of their business. Hence, they must have a robust framework for running CDD checks on their private and corporate clients. The purpose of doing customer due diligence is to reduce the instances of fraud, money laundering and other risky misuses of your products and services by malicious customers. It keeps the reputation of your business clean and the revenue stream of your operations profitable. Failure to have appropriate customer due diligence processes can result in unexpected and potentially massive setbacks to your business. It can affect the reputation of your brand in the long-term, creating even more potential losses in the future in terms of opportunity costs.

What are the different types of Customer Due Diligence (CDD) measures and their best practices?

Crypto companies must perform CDD checks on their customers throughout their lifecycle. Regular checks from multiple sources helps the companies to build robust and verified risk profiles of their client base. The quality of your customers is crucial to the health of your business. But often companies ignore quality and focus mainly on quantity. As they say, prevention is better than cure. Companies that fail to maintain a regular Customer Due Diligence checks are inviting unexpected shocks and losses. Here are the various CDD measures that companies must undertake:

Know Your Customer (KYC)

All the basic identity and background information of the customers, to establish that they are real persons who can be easily contacted if required. KYC information includes name, nationality, address, and date of birth. It can also include any other relevant basic ID verification (IDV) and contact details like crypto wallet addresses. This can be challenging for crypto and blockchain companies with an international client base over 200 countries and territories. So it is imperative to have a streamlined and well-researched process, with automations for frictionless completions and compliances with regulations in different countries.

Typically, KYC checks are best performed in the beginning while onboarding customers to your product/service. This ensures that you establish the trustworthiness of your customers from the start. Requiring KYC checks while registering new customers prevents future hassles and reduces costs for you. It also provides a clean and friendly user experience for your verified customers. They do not need to be bothered unnecessarily afterwards. After the initial KYC checks, having periodic KYC checks every quarter or six months is great to keep the customer details updated.

Transaction Monitoring and Wallet Screening

Blockchains are open by their nature, allowing anyone to transfer assets from wallet to wallet. While this can bring people together and foster commerce and collaboration, it also creates bridges for bad actors. The history of Bitcoin itself is tainted by usage for criminal and illegal activities. This is exactly why Customer Due Diligence is so important for crypto companies. Hence, in addition to the basic KYC information, companies need to keep a live and updated monitoring of the transactions being performed by their customers. Deposits, withdrawals, transfers and other DeFi transactions like trading and staking must be documented and stored securely.

This type of monitoring involves having a blacklist of crypto wallets associated with past criminal or fraud events. Watching and ensuring that your customers do not use your products to transact with such questionable wallets can help you thwart any illegal uses of your services. You might have triggers in place for interactions with blacklisted blockchain addresses. The triggers will automatically block such transactions and suggest manual intervention of your moderation teams. Other rules that set limits to usage of your services and transfers will also reduce fraudulent misuse of your infrastructure. This kind of monitoring and screening ensures Anti Money Laundering (AML).

Risk Based Analysis (RBA)

Risk Based Analysis is not any particular measure, but rather an optimization strategy to reduce both the costs and risks of your CDD operations simultaneously. To understand it, first let's imagine that you don't have RBA in place. In that case, you would perform all the different CDD checks thoroughly and regularly equally on all your customers. While this is great to reduce the risks to your business, it will be very expensive and therefore problematic to your bottomline. It is like your immune system is always at full alert even when there is no infection affecting you. It is simply not sustainable over time, and overkill for your purposes.

Hence, you use the power of algorithms and predictive analytics to create risk profiles of your customers using easily automated processes that are cost-friendly. This will provide you with estimates of trustworthiness and riskiness of all your customers. And only for the higher risk customers, you can include the more costlier, detailed and manual CDD checks - hence "risk-based analysis". RBA cannot be 100% accurate, and there can always be some malicious entities that slip through. However, on the whole it allows you to balance the costs and benefits without overexerting your business resources.

Enhanced Due Diligence (EDD)

As discussed in Risk Based Analysis, you can cover most of your customer base with fast and low cost CDD measures. However, there will be a few clients that pose a higher risk for you. It can be because they are Politically Exposed Personalities (PEP) or other high-level personalities that are famous. They could be your corporate clients with large accounts and large transactions. And there can be some suspicious pseudonymous or less known entities using your services as well. Thus, for various reasons, some of your accounts will pose disproportionately large risks for your business. The common KYC and CDD measures will not suffice for such clients. You must allocate more resources and collect more information about such customers to build detailed risk profiles. We call this Enhanced Due Diligence (EDD).

It is justified that you invest more time and money for monitoring such high risk profile clients. EDD measures will include demanding more identity and background details, such as bank and tax statements, client and investors lists. You can even send your monitoring teams in person to visit such clients to conduct audits. Origin and ownership of financial assets can also be checked under EDD. For the famous or public personalities or corporate clients, you also need to analyze their reputation in press and other media. This can give you timely clues so that you can proactively deal with any potential crises or scandals before they cause severe damage. For example, if you find red flags that one of your high profile clients is going bankrupt or is involved in some Ponzi Scheme, they you can reduce your own risks by limiting them access to your products, resources and funds.

National and International Regulations Compliance

Even as crypto and blockchain create a new layer for international transactions, your business is still subject to local rules and regulations. So, you need to respect international sanctions in cases of wars or other diplomatic conflicts. Certain countries or certain individuals might have been blacklisted by the authorities in your jurisdisction. Your business must comply with these restrictions and not allow access to services to such customers. This requires your company to have a team that is well versed and updated with circulars and announcements from various financial and security organizations. These can include the guidelines from the US Securities and Exchange Commission (SEC), Financial Crimes Enforcement Network (FinCen), Financial Action Task Force (FATF), Reserve Bank of India (RBI), and other national and international institutions.

Summary

When you run a crypto business, you must safeguard it from risks like fraud, defaults and criminal activities. It is like having an intelligent immune system or an anti-virus system. It monitors the health of your customer base and the transactions they perform using your services. By adopting a Risk Based Analysis (RBA) approach, you can conduct CDD in a cost-effective manner without overexerting your business resources. With careful customer segmentation, you can employ Enhanced Due Diligence (EDD) for only the high risk profile clients, and use automated solutions for a majority of your client base.

By instituting streamlined processes for Know Your Customer (KYC) information collection and automated ID verification (IDV), you capture the essential background information for all your clients during onboarding. And then you monitor and screen their wallets and transactions as an ongoing process, to ensure Anti-Money Laundering (AML) compliance. For politically exposed personalities (PEP) and other public or high profile clients, you will adopt EDD measures that are costly but justified. And you ensure that your company operates in compliance with sanctions and regulations imposed by the national and international governing bodies.

Thus, having a robust Customer Due Diligence program ensures that you reduce the risks and harms to the finances of your business and the reputation of your brand in advance. CDD supports the longevity and profitability of your crypto business through proactive risk management practices involving the information about your customer base.