Know Your Customer's Customer is understanding the customers of your customer, so you can gauge risk that sits one layer beyond your direct relationship. It matters most when your customer is itself a business that moves money for others, like a marketplace, a payments firm, or another financial institution.
What is KYCC?
Standard Know Your Customer tells you who your direct customer is. But when that customer is a business that itself serves other customers, your real risk often lives one step further out, in the people and entities your customer transacts for. Know Your Customer's Customer is the practice of looking through your customer to understand who they, in turn, are doing business with.
It becomes essential wherever a customer acts as a conduit: a payment facilitator or payment service provider onboarding sub-merchants, a marketplace paying out to sellers, a correspondent bank serving a respondent's clients, or a money service business handling third-party transfers. In each case, the money flowing through your customer originates from or lands with parties you never onboarded, and their risk becomes your risk.
For an AML team, KYCC is about seeing through intermediaries. You are not expected to fully onboard every downstream party, but you do need enough visibility to judge whether your customer's customer base is consistent with what they told you, and whether it hides sanctioned, illicit, or high-risk activity riding on your rails.
How KYCC extends the view
KYCC builds on ordinary due diligence by reaching one layer deeper:
- OnboardAssess the direct customer Standard KYC establishes who your customer is and the business they say they run.
- ClassifySpot the conduit Identify whether the customer moves money for others, such as sub-merchants, sellers, or respondents.
- Look throughUnderstand their customers Gather enough on the downstream base, its makeup, sectors, and geographies, to judge the real risk.
- MonitorWatch for mismatch Compare actual flows against the declared customer base and flag activity that does not fit.
Who is involved?
Who | Their role |
Your institution | Carries the AML risk of the flows on its rails and must see beyond the direct customer. |
Your customer | A conduit business, such as a payment facilitator, marketplace, or respondent bank. |
Their customers | Sub-merchants, sellers, or account holders you never onboarded but whose risk flows through. |
Regulators | Expect you to understand and monitor the risk your customer's customers introduce. |
What it looks like in practice
An acquiring bank onboards a payment facilitator that plans to serve small online retailers. During onboarding, the facilitator describes a portfolio of low-risk apparel and homeware merchants. On that basis the bank sets its expectations for volume and transaction types.
Months later, transaction monitoring shows a growing share of payments with hallmarks of high-risk sectors the facilitator never mentioned, including offshore gaming and adult content. The mismatch between the declared sub-merchant base and the actual flows is the KYCC red flag. The bank asks the facilitator for its sub-merchant list and onboarding controls, and discovers it has been signing up merchants well outside the agreed risk profile.
Why it matters to operators
When your customer is a conduit, onboarding them alone leaves a blind spot exactly where the risk concentrates. Transaction laundering, sanctions evasion, and illicit merchant activity all rely on hiding behind a legitimate intermediary that you did onboard. If you never form a view of the downstream base, you are effectively guaranteeing access to parties you cannot see, which is how banks end up processing for sanctioned or prohibited businesses without realizing it.
KYCC does not mean fully onboarding every downstream party, which is often impractical. It means calibrating your controls to the conduit's real customer base: understanding its composition, contractually requiring your customer to run proper onboarding on its own customers, and monitoring for activity that contradicts what was declared. It is closely tied to Know Your Business and to managing correspondent and payment-facilitator relationships.
What to watch in the data
- Profile mismatch. Actual transaction types, sectors, or geographies that do not match the customer's declared downstream base.
- Sector drift. Growth in high-risk merchant categories the customer never disclosed at onboarding.
- Transaction laundering signs. Payments that appear to route through a benign front while the real merchant is something else.
- Opaque sub-merchants. A conduit that cannot or will not share its customer list or its own onboarding controls.
- Geographic spread. Downstream activity reaching sanctioned or high-risk jurisdictions inconsistent with the stated business.
Quick questions
How is KYCC different from KYC?
KYC identifies and assesses your direct customer. KYCC extends that view one layer further, to the customers your customer serves, which matters when your customer is a conduit moving money for others you never onboarded.
Do I have to fully onboard my customer's customers?
Usually not. KYCC is about gaining enough visibility to judge and monitor the downstream risk, and requiring your customer to run proper onboarding on its own customers, rather than performing full KYC on every party yourself.
When does KYCC apply most?
Whenever a customer acts as an intermediary: payment facilitators with sub-merchants, marketplaces paying sellers, correspondent banks serving respondents' clients, and money service businesses handling third-party transfers.
What is the link to transaction laundering?
Transaction laundering hides a prohibited merchant behind a legitimate one your customer onboarded. Without KYCC, you only see the front, so understanding and monitoring the downstream base is a key defense against it.
How does KYCC relate to correspondent banking?
Correspondent banking is a classic KYCC scenario. The correspondent serves a respondent whose underlying customers it never onboarded, so it must understand enough about that customer base, and watch for nesting, to manage the risk.
Know Your Customer's Customer (KYCC)と併せて知っておきたい用語
2026年 不正・AMLレポート
予測は不要です。このレポートは、不正・AMLチームが実際に直面していることと、その対応方法を分解して解説します。