The Promise of Continuous KYC
For years, financial institutions have treated KYC (Know Your Customer) as a one-off onboarding ritual. Collect documents, verify identity, assess risk — and move on. But in an era of real-time payments, crypto exchanges, and global sanctions volatility, a one-time check is no longer enough.
Enter Continuous KYC (cKYC) — the idea that customer due diligence should be a dynamic, ongoing process, constantly updated with fresh data. In India, the cKYC registry (centralized by CERSAI) and similar initiatives in Singapore (MyInfo) and the EU (eIDAS 2.0 digital ID wallets) promise to revolutionize compliance.
The dream is compelling:
✅ Customers verified once, reused across banks/insurers.
✅ Institutions reduce duplicate onboarding costs.
✅ Regulators gain unified oversight.
✅ Consumers enjoy “frictionless” banking.
But as every compliance professional knows — what looks like efficiency can also look like a honeypot to criminals.
Why Centralized KYC Sounds Like a Dream
From an efficiency standpoint, cKYC solves multiple headaches:
- Cost Savings
Global banks spend billions on KYC remediation. India’s cKYC cuts duplication — one verification reused across FIs. - Speed & Inclusion
Faster onboarding supports financial inclusion — crucial in emerging markets where many customers lack multiple ID proofs. - Regulatory Confidence
Central registries create a single version of truth, reducing disputes over identity and improving audit trails. - Cross-Sector Use
A verified cKYC profile can be reused for banking, insurance, investments, even government services.
No wonder regulators and banks are leaning into the idea.
The Data Honeypot Problem
But here’s the uncomfortable truth: centralizing KYC also centralizes risk.
- Single Point of Failure
A national cKYC registry becomes a prime cyberattack target. Breach it once, and criminals access millions of identities.
📌 India’s Aadhaar leaks showed how even the largest digital ID systems can be compromised. - Outdated Data Risk
If a customer’s risk profile changes (e.g., becomes a PEP, sanctioned, or engages in suspicious activity), does the cKYC registry update in real time? If not, banks may be relying on stale information. - Jurisdictional Fragmentation
Different countries run different registries. What happens when cross-border transactions occur? Can a Singapore bank rely on India’s cKYC data without liability? - Privacy Concerns
Who owns the data? Customers? Banks? Regulators? Centralized repositories raise questions of consent and surveillance. - Operational Dependency
What happens if the cKYC platform goes down? Entire industries could face onboarding paralysis.
The Global Landscape: Lessons Emerging
- India’s cKYC Registry: Holds 500+ million KYC records. Adoption is growing but patchy — many smaller institutions still default to paper-based KYC due to system integration challenges.
- Singapore’s MyInfo: Government-backed, API-driven system allowing banks to pull verified data directly. Adoption is smoother, but critics argue it makes citizens overly dependent on one system.
- EU’s eIDAS 2.0: Digital wallets planned for 2026, enabling EU citizens to reuse IDs across borders. Debate continues on data sovereignty vs. efficiency.
- Nordics KYC Utility (Invidem): Shared KYC utility by major banks collapsed in 2022 after struggling to balance data privacy, liability, and standardization.
📌 The takeaway? While the dream is alive, execution hurdles are massive.
The Risk-Based CDD Reality
Continuous KYC cannot just mean “plug into a central registry and relax.” It must be layered with risk-based due diligence:
- Dynamic Risk Scoring: Integrating sanctions updates, adverse media, transaction behavior, and geography.
- Behavioral Triggers: A dormant account suddenly moving large sums should trigger a fresh CDD review.
- Multi-Source Verification: cKYC data should be a baseline, not the sole source. Banks must layer additional intelligence (PEP databases, adverse media, blockchain analytics).
- Auditability: Institutions must document when they refreshed data, from which source, and why they trusted it.
Emerging Risks cKYC Must Address
- Crypto & VASPs: FATF reports 70% of jurisdictions inadequately assess crypto providers. How will cKYC capture wallet ownership and blockchain-linked risks?
- Trade-Based Laundering: Invoices can be manipulated even if IDs are verified. cKYC doesn’t address transactional complexity.
- Synthetic Identities: Criminals can stitch together real + fake data to pass initial verification. Continuous monitoring is the only safeguard.
A Balanced Future: Hybrid cKYC
The most effective model isn’t centralized-only or institution-only — it’s hybrid:
- Central Registry for Baseline Identity
(→ speeds up onboarding, reduces duplication). - Institutional Ongoing Monitoring
(→ ensures continuous risk profiling using AI/ML, adverse media, sanctions screening). - Privacy-Enhancing Technologies
(→ zero-knowledge proofs, federated learning to reduce over-centralization of sensitive data). - Cross-Border Interoperability Standards
(→ FATF, G20, or BIS could mandate APIs between registries, not fragmented silos).
Why This Debate Matters for Professionals
For compliance professionals, cKYC isn’t just a technical upgrade — it reshapes how careers and responsibilities evolve:
- Analysts shift from document collectors → risk interpreters.
- Data science, API integration, and regtech literacy become essential FCC skills.
- Certifications (NISM-CALM, IIBF, CFCA) increasingly emphasize continuous monitoring instead of static onboarding.
Conclusion: Dream or Honeypot?
Continuous KYC is both.
- Done right, it’s a dream: faster onboarding, stronger inclusion, lower costs.
- Done wrong, it’s a data honeypot: vulnerable, privacy-eroding, and reliant on stale checks.
The real test is whether regulators, banks, and technology providers can balance efficiency with resilience.
👉 Should FATF push for global cKYC interoperability, or should countries maintain decentralized, risk-based systems?
The debate isn’t academic — it’s about the future of trust in the financial system.