KYC verifies a customer's identity; AML is the wider framework that prevents money laundering. See how KYC and AML relate, and why KYC sits inside AML.
Table of contents
- KYC and AML are related but not the same: AML is the whole framework for preventing money laundering, and KYC is one part of it.
- KYC, Know Your Customer, verifies who a customer is and assesses their risk. AML, anti-money laundering, is the wider set of laws and controls that KYC feeds into.
- KYC is the identity foundation; without it, the other AML controls, monitoring, screening, reporting, have nothing reliable to build on.
- So the question is rarely KYC or AML: a firm performs KYC as part of meeting its AML obligations.
- Beyond KYC, an AML programme includes risk assessment, transaction monitoring, sanctions screening, suspicious activity reporting and governance.
- Treating KYC as the whole of AML is a common and costly mistake; it is the start, not the finish.
KYC and AML are complementary but distinct: AML is the entire framework of laws and controls aimed at preventing money laundering, while KYC is the part concerned with verifying a customer's identity and assessing their risk. KYC sits inside AML as its identity foundation, the layer monitoring, screening and reporting depend on.
TL;DR
The two are often used interchangeably, but they operate at different levels. AML, anti-money laundering, is the whole framework of laws and controls aimed at preventing money laundering. KYC, Know Your Customer, is one part of it: verifying who a customer is and assessing their risk. KYC is the identity foundation the other AML controls, monitoring, screening, reporting, all build on. So a firm does not choose between them; it performs KYC as part of meeting its AML obligations. Treating KYC as the entirety of AML is a common mistake: it is the essential first step, not the whole programme.
What is the difference between KYC and AML?
The core difference is one of scope. AML, anti-money laundering, is the entire framework of laws, regulations and controls that exists to stop criminals disguising illicit funds as legitimate money. KYC, Know Your Customer, is a single component of that framework: the process of verifying a customer's identity and assessing their risk. In one line, AML is the whole, and KYC is a part.
The confusion arises because KYC is the most visible part of AML, the check a customer actually experiences at onboarding, so it is easy to mistake the part for the whole. But behind that identity check sits a much larger apparatus: risk assessment, ongoing monitoring, sanctions screening, suspicious activity reporting and governance. KYC and AML are therefore not competing options or interchangeable terms; they describe different levels of the same effort. Understanding how they relate, rather than treating them as synonyms, is what lets a firm build controls that actually work, starting from a clear grasp of both what KYC is and what anti-money laundering is.
What is KYC?
KYC, Know Your Customer, is the process of verifying an individual's identity and assessing their risk before and during a business relationship. It confirms that a person is who they claim to be, historically by checking documents and increasingly by reading the chip in a modern passport or ID plus a liveness check, and it screens the customer against sanctions and politically exposed person data.
KYC is the entry point to nearly every regulated relationship, and the foundation the rest of compliance depends on: you cannot monitor, screen or report meaningfully if you do not reliably know who your customer is. It is delivered in most modern products through KYC software, and its business-side counterpart, verifying a company and its owners, is KYB. Within the AML framework, KYC is specifically the identity and risk-assessment layer, the thing that has to be right before anything else can be.
What is AML?
AML, anti-money laundering, is the whole framework of laws, regulations and internal controls designed to detect and prevent money laundering. It obliges regulated firms to act as gatekeepers of the financial system, knowing their customers, monitoring activity, and reporting suspicion, so that illicit funds are harder to move and hide. The global standard is set by the FATF and implemented through national regimes such as the US Bank Secrecy Act, the EU AML package and the UK Money Laundering Regulations.
AML is broad by design, because laundering can be attempted in many ways and at many points. It spans everything from the identity check at onboarding to the monitoring of transactions years into a relationship, to the formal reporting of suspicion to the authorities. KYC is one control within this framework; others include transaction monitoring, sanctions screening, and the reporting and governance that a designated officer oversees. All of them serve the single AML objective of keeping illicit money out of the system, and all of them, as the next sections explain, depend on KYC being done well.
How do KYC and AML work together?
The two work together as foundation and structure. AML sets the objective and prescribes the controls; KYC delivers the identity foundation those controls stand on. When a firm onboards a customer, KYC establishes who they are and what risk they pose. Every subsequent AML control then builds on that: monitoring judges a customer's transactions against the profile KYC established, screening checks the identity KYC verified against sanctions and PEP lists, and any suspicious activity report describes a customer KYC has already identified.
This is why the relationship is best understood as sequence and dependency rather than choice. Do KYC badly, and everything downstream inherits the weakness: you monitor a customer you cannot really identify, screen a name you have not verified, and report activity you cannot attribute with confidence. Do KYC well, and the whole AML programme has a reliable base. The strongest programmes treat the two as one connected flow, with clean, continuous identity data feeding monitoring and screening, rather than as separate boxes to tick, the same integrated logic behind an audit-ready compliance stack.
Is KYC part of AML?
Yes. KYC is a part of AML, not a separate discipline alongside it. Anti-money-laundering law imposes a set of obligations on regulated firms, and identifying and verifying customers, the essence of KYC, is one of them. Specifically, KYC and its formal counterpart, customer due diligence, are the identity and risk-assessment obligations within the broader AML framework.
Saying KYC is part of AML is not merely a semantic point; it shapes how firms should think about both. A firm that treats KYC as the whole of its AML duty, verifying customers at onboarding and doing little else, is exposed, because it has satisfied one obligation while neglecting the monitoring, screening and reporting that the framework also requires. Conversely, a firm that invests in monitoring and reporting but does KYC poorly has built its programme on an unreliable foundation. Recognising KYC as one essential part of a larger whole is what leads to a balanced programme, the kind that a serious AML compliance effort requires.
What does an AML programme include beyond KYC?
Beyond KYC, a complete AML programme includes several further controls. A risk assessment identifies the money-laundering risks the firm actually faces, so effort is focused where it matters. Ongoing transaction monitoring watches customer activity over time for the signs of laundering, the layering and structuring that KYC alone cannot catch. Sanctions and adverse-media screening checks customers and their activity against prohibited-party and negative-news data, both at onboarding and continuously.
Suspicious activity reporting escalates genuine suspicion to the authorities through a suspicious activity report, the point at which the whole apparatus produces intelligence for law enforcement. And governance ties it together: a designated officer, usually the MLRO, plus policies, training, independent testing and record-keeping. Higher-risk customers trigger enhanced due diligence on top of standard checks. Each of these controls extends what KYC begins, which is why KYC and AML are best seen as layers of one programme rather than two separate things.
How does Zyphe support KYC and AML?
Zyphe strengthens the foundation that both depend on: reliably establishing who you are dealing with. It delivers chip-based identity verification for individuals, business verification with recursive ownership resolution for companies, and screening of customers and their owners against sanctions, PEP and adverse-media data, through a single API that integrates in around fifteen minutes.
That clean identity layer feeds the rest of the AML programme. Monitoring, screening and reporting are only as good as the data beneath them, and reliable KYC makes anomalies easier to spot, screening more accurate, and suspicion easier to evidence. Because the platform is decentralised, the sensitive data gathered for the two is sharded rather than pooled into a central store, so stronger controls never create a bigger breach target, and verified users can carry a reusable credential across services. Zyphe does not replace transaction monitoring or a firm's own judgement; it makes the identity foundation beneath the whole of KYC and anti-money-laundering compliance far more reliable. Book a demo to see how it fits your programme.
The bottom line
KYC vs AML is really a question of part versus whole. AML, anti-money laundering, is the entire framework for keeping illicit money out of the financial system; KYC, Know Your Customer, is the identity component within it. They are not alternatives, and treating KYC as the whole of AML is a costly mistake, because it leaves the monitoring, screening and reporting that the framework also demands underdone. The right way to hold them is as layers of one programme: KYC establishes who the customer is, and the rest of the AML controls build on that foundation. Get the foundation right, keep it current, and the whole programme stands.
Related resources
- What is KYC (Know Your Customer)?
- What is anti-money laundering (AML)?
- KYC Software: 2026 Buyer's Guide
- What is an MLRO?
- Building an audit-ready compliance stack
Cited sources
Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.