Free KYC Form Template & Checklist (Know Your Customer / Know Your Client)

Every business that deals with money (banks, law firms, accountants, real estate agencies, fintech companies) is required to verify who their customers are before doing business with them. That process is called KYC: Know Your Customer. Accountants, law firms, and other professional services usually call it Know Your Client. Same acronym, same checks, same paperwork.

This guide gives you a practical KYC checklist for both individuals and businesses, a ready-to-use form template, and advice on collecting KYC documents without turning client onboarding into a months-long ordeal.

What Is a KYC Check?

A KYC check is the process of verifying a customer's identity and assessing their risk profile before establishing a business relationship. It's a legal requirement under Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) regulations in most jurisdictions worldwide.

KYC checks serve three purposes:

• Confirm identity — Verify that the person or business is who they claim to be.
• Assess risk — Determine whether the customer poses a higher risk for money laundering, fraud, or terrorist financing.
• Maintain compliance — Meet regulatory obligations and avoid fines that can reach into the millions.

Who needs KYC? Any regulated business. This includes banks, insurance companies, investment firms, accountants, estate agents, law firms, trust and company service providers, and an increasing number of fintech and crypto platforms. If your industry requires AML compliance, you need a KYC process.

Getting KYC right matters beyond avoiding fines. A smooth, well-organized process builds trust with clients from day one. A slow, confusing one sends them looking elsewhere.

The Five KYC Checks Every Business Runs

"KYC check" is an umbrella term. In practice, a complete Know Your Customer process runs five separate checks, and regulators expect evidence of each one:

• 1. Identity verification. Confirm the customer exists and is who they say they are. For individuals, that means a government-issued photo ID matched against the name, date of birth and address they gave you. For companies, registration documents checked against the official company registry.
• 2. Document verification. Confirm the documents themselves are genuine. Check expiry dates, security features and whether the documents agree with each other. A passport that expired two years ago proves nothing.
• 3. Sanctions and watchlist screening. Screen the customer against sanctions lists (OFAC in the US, HM Treasury in the UK, the EU consolidated list) and law enforcement watchlists. Doing business with a sanctioned person or entity is illegal, however thorough the rest of your KYC was.
• 4. PEP screening. Check whether the customer is a Politically Exposed Person: someone who holds a prominent public position, or is closely connected to someone who does. PEPs are not banned customers, but they do automatically require Enhanced Due Diligence.
• 5. Adverse media screening. Search for negative news about the customer: fraud convictions, money laundering investigations, regulatory penalties. Someone who passes the first four checks but turned up in last year's bribery scandal coverage still needs a closer look.

Small firms often run checks 1 and 2 by hand and pay a screening service to handle 3 through 5. However you split the work, record what you checked and when. That record is what proves compliance when an auditor asks for it.

KYC Checklist at a Glance

Every KYC check, whatever the industry, comes down to the same core steps:

1. Confirm the client's full legal name, date of birth, and residential address.
2. Verify identity with a government-issued photo ID.
3. Verify the address with a recent utility bill, bank statement, or official letter.
4. For business clients: confirm registration details and collect formation documents.
5. Identify directors and beneficial owners (anyone holding 25% or more).
6. Screen against sanctions and PEP (politically exposed person) lists.
7. Assign a risk rating and apply the matching level of due diligence.
8. Record everything and set a review date.

The rest of this guide breaks each step down, with a full form template you can copy.

KYC Requirements: What the Regulations Actually Demand

KYC requirements come from anti-money laundering law. The details vary by country, but the core obligations are the same everywhere: identify your customer, verify that identity with reliable documents, work out who ultimately owns or controls business customers, and keep records. Miss one and the penalty lands on your firm, not your client.

• United States. The Bank Secrecy Act and FinCEN's Customer Identification Program (CIP) rules require financial institutions to collect and verify name, date of birth, address and an identification number before opening an account. The CDD Rule adds beneficial ownership: for business customers, you have to identify anyone who owns 25% or more.
• European Union. The Anti-Money Laundering Directives (and the new AML Regulation that takes over from 2027) set customer due diligence rules for banks, accountants, lawyers, estate agents and crypto providers. A new EU-level authority, AMLA, supervises enforcement.
• United Kingdom. The Money Laundering Regulations 2017 require risk-based due diligence, with HMRC, the FCA and professional bodies supervising different sectors. Accountancy and legal firms answer to their professional supervisors.
• Everywhere else. Most jurisdictions follow the FATF Recommendations, the global standard national AML laws are built on. If your country has AML law at all, its KYC requirements almost certainly trace back to FATF.

In practice this means you need a documented, risk-based process rather than one form for everyone. Low-risk customers get standard checks. Higher-risk customers, such as PEPs or companies with complicated ownership, get Enhanced Due Diligence. And every check needs a record you can produce on demand: most jurisdictions make you keep KYC records for five years or more.

KYC Checklist for Individuals

When onboarding an individual customer, you need to collect enough information and documentation to confirm their identity and address. Here is a working checklist.

Personal information

• Full legal name (including any former names)
• Date of birth
• Nationality
• Residential address
• Contact details (phone number, email address)
• Occupation and employer
• Source of funds (where their money comes from)
• Purpose of the business relationship

Proof of identity (at least one)

• Valid passport
• National identity card
• Driving license (photo card)

The document must be current, government-issued, and include a photograph. Expired documents are not acceptable. If you need a reusable workflow for this step, see our document verification form template.

Proof of address (at least one, dated within the last 3 months)

• Utility bill (gas, electricity, water, landline phone)
• Bank statement or building society statement
• Council tax bill
• Mortgage statement
• Government-issued correspondence (tax notice, benefits letter)

Mobile phone bills and credit card statements are generally not accepted as proof of address. The document must show the customer's name and current residential address.

Additional checks

• Politically Exposed Person (PEP) screening — Check whether the individual holds or has held a prominent public function, or is a close family member or associate of such a person. PEPs require Enhanced Due Diligence.
• Sanctions screening — Check the individual against relevant sanctions lists (UN, EU, OFAC, HMT).
• Adverse media screening — Search for any negative news coverage related to financial crime.

KYC Checklist for Businesses

Business-to-business KYC (sometimes called KYB, Know Your Business) is more involved. You need to verify the company itself, its ownership structure, and the individuals who control it. Verifying a company and its owners is sometimes called Know Your Business (KYB), but it is the same KYC obligation applied to corporate customers.

Company information

• Registered company name
• Trading name (if different)
• Registered address
• Principal place of business
• Company registration number
• VAT/GST number
• Company type and legal status (limited company, partnership, sole trader, etc.)
• Date of incorporation
• Nature of business and industry sector
• Website URL

Ownership and control

• Names and details of all directors and partners
• Details of all beneficial owners (individuals who hold 25% or more of the shares or voting rights)
• Ownership structure chart (for complex structures with multiple layers)
• Share register
• Details of any parent company or group structure

For each beneficial owner and director, you must complete the same individual KYC checks listed above: proof of identity, proof of address, PEP screening, and sanctions screening.

Company documents

• Certificate of incorporation
• Memorandum and articles of association (or equivalent constitutional documents)
• Latest audited accounts or financial statements
• Bank details and bank reference letter
• Proof of registered address
• Board resolution authorizing the business relationship (where applicable)

Additional checks

• Company registry search to confirm active status
• Sanctions screening of the company
• Adverse media check on the company and its principals
• Source of funds and source of wealth verification (for higher-risk relationships)

KYC Documents: The Complete List

The checklists above tell you what to collect for each client type. Here is the consolidated list of KYC documents, grouped by what each one proves:

Proof of identity (individuals)

• Passport, accepted in every jurisdiction, so ask for this first
• National identity card
• Driving licence with photo
• Residence permit

Proof of address (individuals)

• Utility bill (gas, electricity, water) dated within the last 3 months
• Bank or credit card statement
• Council tax bill or property tax statement
• Tenancy agreement or mortgage statement

Company documents (business customers)

• Certificate of incorporation
• Articles of association or equivalent constitutional documents
• Company registry extract showing directors and registered office
• Shareholder register or ownership structure chart
• Proof of identity and address for each beneficial owner (25%+ ownership)
• Board resolution or authority document for the person acting on the company's behalf

Supporting documents (risk-dependent)

• Source of funds evidence: payslips, sale contracts, inheritance documents
• Source of wealth evidence, for Enhanced Due Diligence cases
• Regulatory licences, where the customer operates in a regulated sector

Two rules save the most back-and-forth. Tell clients which documents you accept before they send anything, and reject expired or cropped documents the moment they arrive, not weeks later at review time. A structured upload form with one labelled slot per document enforces both for you.

Know Your Customer Form Template

A KYC form is the document you send to clients to collect their identity information and supporting documents. Some firms label it a know your client form or a client verification form; the fields are the same. A well-designed form reduces back-and-forth, minimizes errors, and speeds up onboarding.

Here is a detailed KYC form template you can adapt for your business.

Section 1: Client type

Use this field to trigger conditional logic. Individual clients see a shorter form, while business clients see additional fields for company details, directors, and beneficial owners.

Section 2: Personal / contact details

Section 3: Company details (business clients only)

Section 4: Beneficial ownership (business clients only)

Section 5: Identity documents (file uploads)

Section 6: Declarations

Below is an example of what a KYC form looks like when built as an online form rather than a PDF or Word document. This format lets clients fill in their details and upload documents in one step.

A digital form beats a paper or PDF template on every front: clients complete it on any device, files upload directly (no scanning and emailing), and you receive everything in one structured submission instead of scattered attachments across multiple email threads.

KYC Questions to Ask New Clients

Documents tell you who someone is. They tell you very little about why they want your services or how risky the relationship will be. That part comes from asking. These are the know your customer questions worth building into your intake process:

• Nature of business. What does the client actually do, and does it match the documents? An import business with no trade paperwork is a flag.
• Purpose of the relationship. What service do they want, and does it make sense for them? A local bakery asking you to structure offshore holdings deserves some questions.
• Expected activity. Ask what volume and frequency of transactions to expect. All your future monitoring gets compared against this baseline, so record it now.
• Source of funds. Where does the money for this engagement come from? Salary, business income, a property sale, an inheritance?
• Ownership and control. For companies, find out who owns 25% or more and who actually makes the decisions. Those are not always the same person.
• Geographic exposure. Where does the client operate, bank and pay tax? Links to high-risk jurisdictions push the due diligence level up.
• PEP status. Ask directly whether the client, or anyone close to them, holds a prominent public position. Screening tools confirm the answer.

Put these questions in the intake form itself rather than saving them for a meeting. Written answers give you the audit trail regulators want, and clients answer more accurately when they can check the details at their own pace.

The Three Levels of Customer Due Diligence

Not every client requires the same level of scrutiny. AML regulations define three tiers of due diligence, and applying the right level is a core part of KYC compliance.

Simplified Due Diligence (SDD)

SDD applies when the risk of money laundering or terrorist financing is low. This might include a publicly listed company with transparent ownership, a government body, or a long-standing customer with a clean track record.

With SDD, you can reduce the extent of your checks, for example verifying identity from fewer documents or relying on public registry information. You still need to monitor the relationship, but the initial onboarding is lighter.

When SDD applies:

• Low-risk products or services (small-value, one-off transactions)
• Customers regulated by their own AML authority (e.g., another bank)
• Government or public sector bodies

Customer Due Diligence (CDD)

CDD is the standard level that applies to most business relationships. It is the baseline requirement: verify the customer's identity, understand the nature of the relationship, and conduct ongoing monitoring.

The checklists earlier in this article represent CDD requirements. This is what you should apply to the majority of your clients.

When CDD applies:

• Establishing a new business relationship
• Carrying out occasional transactions above the applicable threshold
• When you suspect money laundering or terrorist financing
• When you have doubts about previously obtained customer identification data

Enhanced Due Diligence (EDD)

EDD is required when a customer presents a higher risk. It means going beyond standard checks to gather additional information and apply closer scrutiny.

When EDD applies:

• The customer is a Politically Exposed Person (PEP) or a close associate of one
• The customer is based in or connected to a high-risk country identified by FATF, the EU, or your local regulator
• Complex or unusually large transactions with no clear economic purpose
• Non-face-to-face business relationships
• Businesses with complex or opaque ownership structures

What EDD involves:

• Obtaining additional identity documents
• Verifying source of funds and source of wealth
• Senior management approval for the business relationship
• More frequent and detailed ongoing monitoring
• Independent verification of ownership structure

Applying the wrong level of due diligence is a compliance failure in itself. If a client should have received EDD but only got standard CDD, your firm is exposed, even if that specific client never commits any wrongdoing.

Know Your Client Checklist for Accountants and Professional Services

Accountants, bookkeepers, solicitors, and estate agents tend to say "know your client" rather than "know your customer". Regulators treat the two identically: if your firm falls under AML rules, you need the same identity checks, the same documents, and the same records either way.

That said, a know your client checklist for an accounting or law firm differs from a bank's in a few practical ways:

• Identity gets verified at engagement, before any work starts, and the check is tied to the engagement letter.
• Source of funds matters for specific engagements: conveyancing, company formation, and large one-off transactions.
• Most business clients are small companies, so beneficial ownership checks (who owns 25% or more) come up constantly.
• Your professional body typically supervises your AML compliance and can ask to see KYC records during a practice review.
• Checks need refreshing periodically, not just at onboarding. Annually for higher-risk clients is a common rule of thumb.

The form template above works unchanged as a know your client form: send it at engagement alongside your client onboarding process and intake form, and keep the completed form with the client's file.

KYC Best Practices

Having a checklist is a starting point. How you run KYC in practice determines whether it works smoothly or becomes a bottleneck that delays onboarding and frustrates clients.

Use digital forms instead of paper or PDF

Paper KYC forms are slow to complete, hard to read, and impossible to validate before submission. PDF forms are better but still require clients to download, fill in, save, and email back, with identity documents sent as separate attachments.

Online forms solve all three problems. They are responsive (clients can complete them on a phone or tablet), can include validation rules that prevent incomplete submissions, and let clients upload documents directly within the form.

Build multi-page forms with conditional logic

A KYC form with 30+ fields on a single page is overwhelming. Break it into logical sections (personal details, company details, document uploads, declarations) across multiple pages. Use conditional logic so business clients see the company section while individual clients skip it entirely.

Enable drag-and-drop file uploads

Asking clients to "scan and email" their passport or utility bill is a guaranteed way to slow things down. Let them take a photo on their phone and drag it into the form. Support common formats: JPEG, PNG, and PDF.

Auto-save progress

Clients rarely have every document ready when they start the form. Auto-saving lets them fill in what they can, step away to find a utility bill, and come back to finish without losing progress. Without this, you get abandoned forms and have to start over.

Send automated reminders

The biggest bottleneck in KYC is chasing clients who started the form but never finished, or who never started at all. Automated reminders sent at set intervals (3 days, 7 days, 14 days) cut the time it takes to collect completed forms.

Store documents securely

KYC documents contain sensitive personal data: passports, bank statements, home addresses. Store them in an encrypted, access-controlled environment. If you are using cloud storage, make sure it meets your regulatory requirements for data handling and retention.

Keep records for the required period

Most jurisdictions require you to retain KYC records for at least five years after the business relationship ends. Set up a retention policy and make sure documents are accessible for audit or regulatory review.

Retention only helps if you can also show what happened to each record. Pairing your retention policy with a log of every action taken on a KYC document, from the moment a client uploads it, gives you the evidence an auditor or regulator will ask for during a review.

Review and update periodically

KYC is not a one-time task. Customer circumstances change: they move, change jobs, become a PEP, or restructure their business. Conduct periodic reviews (annually for standard risk, more frequently for higher-risk clients) and re-collect documents as needed.

How to Collect KYC Documents from Clients

The weakest link in most KYC processes is not the checklist itself. It is the collection. Firms know exactly what they need, but getting clients to provide it on time, in the right format, and without repeated follow-ups is where things fall apart.

Common problems with email-based KYC collection:

• Scattered submissions — Documents arrive across multiple emails, sometimes weeks apart. Tracking what's been received and what's missing requires spreadsheets and manual checking.
• Wrong formats — Clients send blurry photos, password-protected PDFs, or Word documents instead of scanned originals.
• No reminders — Your team sends follow-up emails manually, hoping clients eventually respond. Some do. Many don't.
• Security concerns — Passports and bank statements sent as email attachments sit in inboxes without encryption or access controls.

A better approach is to use a dedicated file collection tool that combines the KYC form and document uploads into a single, shareable link.

File Request Pro lets you build branded KYC forms that collect client information and identity documents in one submission. Here is how it works:

• Custom upload pages — Build a multi-page form with your company's branding, specifying exactly which documents you need and in what format. Clients see a clear, guided experience instead of a vague email request.
• No client login — Clients click the link and start uploading. They do not need to create an account, download an app, or remember a password.
• Automatic file organization — Uploaded documents go directly to your cloud storage (Google Drive, OneDrive, SharePoint, or Dropbox) and are organized into folders by client name, date, or any custom structure you define.
• Automated reminders — Set up reminder emails that go out automatically to clients who have not submitted their documents. No more manual follow-ups.
• Conditional logic — Show different form fields and document requests depending on whether the client is an individual or a business, or based on their risk profile.

Automated reminders handle the follow-up for you. Instead of manually tracking who has responded, the system sends polite nudges until the client completes their submission.

All documents are routed to your cloud storage automatically, organized into client folders so nothing gets lost in email threads.

You onboard clients faster, collect fewer incomplete submissions, spend less time chasing, and present a more professional experience from the first interaction.

KYC FAQ

What does KYC stand for?

KYC stands for Know Your Customer (sometimes Know Your Client). It is the process of verifying a customer's identity and assessing their risk level before entering into a business relationship.

What is the difference between Know Your Customer and Know Your Client?

Nothing, in practice. Banks and fintechs say "customer"; accountants, law firms, and wealth managers say "client". Both refer to the same identity verification and due diligence process, and regulators use the terms interchangeably. The checklist above covers both.

Who is required to perform KYC checks?

Any business regulated under AML (Anti-Money Laundering) laws. This typically includes banks, financial institutions, insurance companies, investment firms, accountants, law firms, estate agents, and companies dealing in high-value goods. The specific requirements vary by jurisdiction.

What documents are needed for KYC?

For individuals: a government-issued photo ID (passport, driving license, or national ID card) and proof of address (utility bill or bank statement dated within the last three months). For businesses: certificate of incorporation, proof of registered address, details of directors and beneficial owners, and audited financial statements.

How long does KYC verification take?

It depends on your process. With paper forms and manual document collection via email, KYC can take weeks. With digital forms that collect information and documents in one step, most clients can complete their submission in under 15 minutes. The internal review and verification then takes additional time depending on the level of due diligence required.

What is the difference between KYC and AML?

AML (Anti-Money Laundering) is the overall regulatory framework designed to prevent money laundering and terrorist financing. KYC is one component of AML compliance, specifically the part that deals with identifying and verifying customers. AML also includes transaction monitoring, suspicious activity reporting, and staff training.

What is a Politically Exposed Person (PEP)?

A PEP is someone who holds or has held a prominent public function: heads of state, senior politicians, senior government officials, judicial or military officials, and senior executives of state-owned corporations. Close family members and known close associates of PEPs are also treated as PEPs. They require Enhanced Due Diligence because their position makes them potentially more susceptible to corruption.

How often should KYC be updated?

There is no single rule; it depends on the client's risk profile. Standard-risk clients should be reviewed at least annually. High-risk clients should be reviewed more frequently, typically every 6 to 12 months. You should also trigger a review whenever there is a significant change in the client's circumstances, such as a change of address, ownership, or business activity.

Can KYC forms be completed online?

Yes. Online KYC forms are increasingly the standard approach. They allow clients to enter their details and upload identity documents from any device, without needing to print, scan, or post anything. Digital forms also reduce errors through input validation and make it easier to track which clients have completed their submissions.

What happens if a business does not perform KYC?

Failing to conduct adequate KYC can result in regulatory fines, criminal prosecution of responsible individuals, loss of operating licenses, and reputational damage. Penalties vary by jurisdiction, but fines in the hundreds of thousands or even millions are common for serious non-compliance.