KYC Requirements for Banks 2026: CH, EU, US

Last updated: 3 November 2026 · Originally published 5 May 2025

What changed in 2025-26

Switzerland: the revised Anti-Money Laundering Act (GwG/AMLA) and the new law on the transparency of legal entities entered into force on 1 October 2026.

Switzerland: FINMA’s revised circular 2016/7 “Video and online identification” applies from 1 November 2026, including liveness detection in the online-identification routes.

Switzerland: FINMA consulted on a partial revision of its anti-money laundering ordinance (AMLO-FINMA) from 12 May to 9 June 2026; see the final ordinance for the entry-into-force date.

EU: the Anti-Money Laundering Regulation (AMLR) applies from 10 July 2027 (a later date, 10 July 2029, applies to some obliged entities) and member states must transpose Directive (EU) 2024/1640 by the same date. The EU’s AML authority (AMLA) plans to begin direct supervision in 2028.

EU: the European Digital Identity Wallet is an identification and authentication tool, not a replacement for KYC.

KYC for a bank is the set of controls it applies to identify a customer, verify that identity, understand the purpose of the relationship and monitor it over time. The rules differ by jurisdiction and are changing in Switzerland and the EU between 2026 and 2028. This guide explains what KYC requires, which rules apply in Switzerland, the EU and the US, how remote onboarding and AI agents fit in, and what to check before you change a process.

What is KYC in banking?

KYC (“know your customer”) is the part of a bank’s anti-money-laundering programme that answers one question before and during every relationship: who is this customer, and does their activity make sense? In practice it covers identification, verification, beneficial-owner checks, a risk profile and ongoing monitoring. The US FinCEN customer due diligence rule lists four elements of its own, described below; the Swiss and EU rules are covered in the next sections.

KYC is a process owned by compliance, not a tool. A platform or an AI agent can support it; accountability for the decision stays with the bank.

Michael Barskyi

Business Development Lead and Fintech Expert

Do you have project idea?

Contact Michael to develop your project with our team of fintech engineers.

Get in touch

What are the components of a KYC process?

A bank’s KYC process has five components, whichever country applies.

Customer identification and verification. Collect identity data and check it against a reliable document or electronic means.
Beneficial-owner identification. For companies and other legal entities, find and verify the natural persons who own or control the customer. The FinCEN rule names this at account opening; the Swiss AMLO-FINMA consultation points to understanding the ownership and control structure of the customer.
Purpose and nature of the relationship. Record why the customer is opening the account and what activity to expect.
Customer risk profile. Use the information from steps 1 to 3 to assign a risk level, which drives how much evidence and monitoring the customer needs.
Ongoing monitoring. Watch transactions, report suspicious ones and keep customer information up to date on a risk basis.

Who counts as a customer under KYC?

The customer is not only the account holder. Rules also reach beneficial owners, controlling persons and, in some situations, the clients of a customer. The AMLO-FINMA consultation of May 2026, for example, covers correspondent and transitory accounts and the declaration of beneficial owners for sub-accounts. Check your own scope against the rule that applies to you, not against a generic definition.

What are the KYC rules in Switzerland, the EU and the US?

Each jurisdiction has its own legal instrument, and they must not be mixed. The table summarises the points that matter for 2026 to 2028; sources are listed at the end. For the wider picture of digital-banking regulation, see our overview of regulatory compliance in digital banking.

Jurisdiction	Instrument	Status as published
Switzerland	Revised Anti-Money Laundering Act (GwG) and law on transparency of legal entities	In force since 1 October 2026 (Federal Council decision of 12 June 2026), except provisions on public notaries’ offices
Switzerland	FINMA circular 2016/7 “Video and online identification” (supervisory circular)	Revision adopted 23 September 2026, applies from 1 November 2026
Switzerland	AMLO-FINMA, partial revision	Consultation 12 May to 9 June 2026; entry into force: see the final ordinance
EU	Regulation (EU) 2024/1624 (AMLR)	Applies from 10 July 2027; a later date, 10 July 2029, applies to obliged entities listed in Art. 3(3)(n) and (o)
EU	Directive (EU) 2024/1640 (AML Directive)	Member states transpose by 10 July 2027
EU	AMLA, the EU anti-money-laundering authority	Per AMLA’s planned timeline: about 40 obliged entities selected for direct supervision in 2027, direct supervision begins in 2028
US	FinCEN customer due diligence (CDD) rule	In force; four elements, see below

Switzerland. The Federal Council put the revised GwG and the new transparency law into force on 1 October 2026, except provisions on public notaries’ offices, which the cantons must adapt. The press release gives no further detail that this article relies on. FINMA’s anti-money-laundering ordinance is in revision: the consultation named four points, namely understanding the ownership and control structure of the customer, measures under the Embargo Act, correspondent and transitory accounts, and the declaration of beneficial owners for sub-accounts. Do not plan against a date until the final ordinance is published.

EU. Article 19 of the AMLR requires customer due diligence when a business relationship is established, for an occasional transaction of at least EUR 10,000, when money laundering or terrorist financing is suspected regardless of any threshold, and when there are doubts about previously obtained identification data. Credit and financial institutions also apply it to an occasional transfer of funds of at least EUR 1,000 (Art. 19(1) and (2)). Member states must transpose Directive (EU) 2024/1640 by 10 July 2027; it is not Directive 2018/1673, the criminal-law directive.

US. The FinCEN CDD rule requires covered institutions to keep written policies to identify and verify customers; to identify and verify the beneficial owners of legal-entity customers at account opening; to understand the nature and purpose of customer relationships to build a customer risk profile; and to monitor on an ongoing basis, reporting suspicious transactions and, on a risk basis, keeping customer information current. FinCEN has also issued a ruling titled Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening (FIN-2026-R001); this article does not summarise it, so read it before changing a US process.

What changes for online identification in Switzerland from 1 November 2026?

FINMA’s revised circular 2016/7 applies from 1 November 2026 and introduces liveness detection as an additional security measure for online identification. FINMA explains the change by the growing risks of new technologies, in particular artificial intelligence. The circular is Swiss supervisory guidance; it is not a statute and it does not apply in the EU.

What the revision covers, in paraphrase:

Liveness detection is anchored in three online-identification routes: the electronic ID copy with an authenticity check by the financial intermediary (margin no. 32), identification by qualified electronic signature (no. 39) and the e-ID (no. 44.3). It is not a rule for every channel and it does not guarantee protection against AI-generated fraud.
Transition: one year from entry into force for technical adjustments to residence verification and liveness detection under the qualified e-signature route (no. 54).
E-ID: it can be used to identify digitally onboarded clients under the AMLA.
QR-code IDs: identity documents with a QR code, for example the Swiss driving licence, are treated like documents with a machine-readable zone.
Residence: digital processes that reliably link the contracting party to a place of residence may be used to verify residence.

If you run video or online onboarding in Switzerland, map each of your onboarding routes to these margin numbers and confirm with your compliance and legal teams what applies to you.

How does remote onboarding (eKYC) work?

Remote onboarding is a risk-based KYC process delivered digitally, not a tool. It usually combines document capture and authenticity checks, a check that the person is present (liveness) and a link to the data held in the KYC platform. The FATF published guidance on digital ID in March 2020: it helps governments, financial institutions and other regulated entities decide whether a digital ID is appropriate for customer due diligence, and it is technology-neutral. The bank still decides, on its own risk assessment, which routes are acceptable for which customers.

Design questions for any remote route: what happens when the check fails, who reviews edge cases, how long evidence is retained, and how the process is tested when attack methods change.

Does the EU Digital Identity Wallet replace KYC?

No. The European Digital Identity Wallet, introduced by Regulation (EU) 2024/1183 (eIDAS 2.0), is an identification and authentication tool. Each member state must provide at least one wallet within 24 months of the entry into force of the implementing acts. Private relying parties that must use strong user authentication under law or contract, including in banking and financial services, must accept wallets no later than 36 months after those implementing acts, and only at the user’s voluntary request. The legal text gives no calendar date for either deadline.

Whether a wallet can satisfy a given customer-due-diligence step is a question for the AMLR and national law, not for eIDAS alone. Plan the wallet as one more identification input to your KYC platform, not as a substitute for the KYC process.

How do AI agents fit into KYC?

AI agents belong around the KYC platform, not in place of it. The KYC platform stays the system of record. An agent gathers client data from permitted sources, drafts the KYC narrative, flags gaps in the source-of-wealth evidence and hands the file to a compliance officer, who decides. Every step is logged so it can be reviewed later.

Three points to settle before you build:

Decision rights. Define which steps an agent may only draft and which a person must approve. For onboarding and periodic reviews, keep the approval with a person.
Auditability. Log inputs, outputs and the human decision for each file.
Regulatory classification. Check how your use case is classified; see our guide to EU AI Act-compliant AI agents for banks.

S-PRO builds this kind of agent layer on its own agentic platform, S-PRO Agents, with ISO 27001 and ISO 27701 as the security and privacy baseline. If you are choosing a partner for KYC onboarding agents, see KYC onboarding AI agents for banks and our KYC service. For ongoing monitoring, see AML compliance automation with AI agents for banks.

Planning a KYC change? If you are deciding how an agent should sit next to your KYC platform, talk to our engineers about your onboarding or periodic-review process.

What goes wrong in KYC programmes?

Mixing jurisdictions. A Swiss circular, an EU regulation and a US rule are different instruments. A group operating in several markets needs a mapping, not one policy copied across.
Treating a date as a plan. The AMLO-FINMA revision has no published entry-into-force date in the consultation. Build the change plan against the final text.
Treating technology as compliance. A liveness check, a wallet or an AI agent supports the process; none of them makes it compliant by itself.
Ownership and control structures. Legal-entity customers remain the hardest files, and the Swiss and US texts above both emphasise beneficial owners.
Stale customer data. Ongoing monitoring includes keeping customer information current on a risk basis.

Checklist: KYC review for 2026-2028

Map every onboarding route (branch, video, online, e-ID) to the Swiss circular 2016/7 margin numbers that apply to it.
Confirm with legal how the revised GwG, in force since 1 October 2026, affects your customer files.
Track the AMLO-FINMA final ordinance and set the plan date only once it is published.
For EU business, map your CDD triggers to the AMLR before it applies on 10 July 2027 (check whether the 2029 date applies to you), and track national transposition of Directive (EU) 2024/1640.
Decide which KYC steps an AI agent may draft and which need human approval, and log both.
Define how identification inputs such as the EU wallet or the Swiss e-ID enter the KYC platform.
Test each route against the failure case: what the customer sees, who reviews, what is kept.

FAQ

What are the KYC requirements for banks in 2026?

A bank must identify and verify each customer, identify beneficial owners of legal entities, understand the purpose of the relationship, assign a risk profile and monitor the relationship. The legal source depends on the jurisdiction: the Swiss GwG and FINMA rules, the EU AMLR from 10 July 2027, or the US FinCEN CDD rule.

What changes in Swiss online identification on 1 November 2026?

FINMA’s revised circular 2016/7 applies from 1 November 2026. It introduces liveness detection in the online-identification routes for the electronic ID copy, the qualified e-signature and the E-ID, accepts the e-ID for digital onboarding under the AMLA, and treats QR-code IDs like documents with a machine-readable zone. It is Swiss supervisory guidance, not a statute.

When does the EU Anti-Money Laundering Regulation apply?

The AMLR, Regulation (EU) 2024/1624, applies from 10 July 2027, with a later date of 10 July 2029 for obliged entities listed in Art. 3(3)(n) and (o). Member states must transpose Directive (EU) 2024/1640 by 10 July 2027. AMLA plans to begin direct supervision in 2028.

Does the EU Digital Identity Wallet replace KYC?

No. The wallet is an identification and authentication tool under eIDAS 2.0. Whether it can satisfy a specific customer-due-diligence step is determined by the AMLR and national law. Banks and financial services that must use strong authentication have to accept wallets only at the user’s voluntary request, after the deadline set in the regulation.

Can AI agents do KYC at a bank?

AI agents can support KYC by gathering client data, drafting the KYC narrative and flagging gaps in the source-of-wealth evidence. The KYC platform stays the system of record and a compliance officer decides, with every step logged. An agent does not make a process compliant by itself; the bank remains accountable.

Talk to S-PRO about your KYC process

If you are changing onboarding, periodic reviews or the KYC platform around an agent layer, describe your process and we will respond with a view on where agents can sit next to your system of record. Contact us.