Customer Onboarding at a Currency Exchange (Practical KYC) — Which Documents, Which Checks

In the AML and KYC article we said that KYC means "know your customer" and that it happens the moment a relationship begins. But that article was about why; this one is about how — exactly which document, which check, which question, and how to record all of it so that it still defends you three years later.

The goal is not to stall the customer or turn them away. The goal is to know, with the least friction possible, who you are dealing with — and to be able to prove that you knew.

The minimum file: four pillars

Every customer file, no matter how much business they do, stands on four pillars:

1. Identity. Full name, a valid dated identity document (national ID card, birth certificate, passport), date of birth, and nationality. For a foreign customer, a residence document as well.

2. Contact. A number that actually works — not just written down, but verified. A simple call or message is enough to be sure the number is correct.

3. Source of income and occupation. The most important pillar, and the one everyone skips. "Businessman" means nothing. "Imports car parts from China, USD 30,000 to 50,000 a month" means something you can later measure the customer's behavior against.

4. Purpose of the relationship. Why did they come to you, and what volume and type of transaction do we expect? This is the "baseline" — without it you cannot tell whether future behavior is normal or not.

For legal entities, a fifth pillar: who is the beneficial owner (UBO)? A company with an unclear party behind it is precisely the tool used for concealment.

Tiering: not everyone is checked to the same depth

The common mistake is to check everyone strictly (and scare off the good customer) or check everyone carelessly (and miss the risk). The right way is risk-based tiering:

The logic is simple: depth of review rises with risk. A customer who changes a hundred dollars once a month does not need a heavy file. A customer who moves a hundred thousand dollars a week does.

The role of checks

A document is a claim of identity; a check is its confirmation. Three checks commonly used in verifying an exchange customer:

• Identity check (national ID card / national number): matching the name to the national number — whether this name really belongs to this number. The simplest and most basic check.
• National ID and mobile number match check: is the SIM card the customer gives really in their name? A SIM in someone else's name is a flag.
• IBAN check: at the time of transfer, it retrieves the name of the destination account holder. If the IBAN is in someone else's name, you need a question answered.

The key point: a check does not replace judgment, it feeds it data. If the SIM is in the customer's spouse's name, that is not necessarily a problem — but you need to know, to ask, and to record it.

The questions to ask (and write the answer down)

The unwritten part of KYC is the conversation. A few simple questions that fit into ordinary talk:

• "What's your line of work?" — and if the answer is vague, one step deeper.
• "What volume do you usually move?" — to build the baseline.
• "What is this money for?" — for large or unusual transactions.
• If a third party is involved: "What is your relationship with them?"

And the most important rule: write the answer down. An operator who asked, was satisfied, and wrote nothing down — from any inspector's point of view, that conversation never happened. A private note on the account, stamped with time and user, is exactly what defends you three years later.

Updating: KYC is not a one-time event

The big mistake: doing KYC only for a new customer. A ten-year customer whose document has expired, whose occupation has changed, and whose volume has grown tenfold has an incomplete file — and those are exactly the ones with the most volume and risk.

The practical rule:

• Expired document = a reminder to update.
• Noticeable change in pattern (volume, corridor, transaction type) = a review of the file.
• Periodic review for high-volume customers, even if nothing has changed.

A system that reminds you of a document's expiry date and a change in pattern turns this from "something always forgotten" into "something that happens automatically."

پروندهٔ مشتریان در نکستو

Why this should live in the customer file, not in a separate folder

The worst version of KYC is this: copies of documents in a folder, separate from transactions, that are never connected. That is paperwork, not compliance.

KYC works when it lives next to the customer itself — documents, numbers, notes, and the results of checks, all in that customer's file, accessible at the moment of recording a transaction. That is when the operator can see, in the moment, "Has this customer stated their source of income? Is their document valid? Is today's pattern normal?"

In Nexto, each customer's file keeps these side by side: identity information, a private note with a full audit trail, and checks (identity, IBAN) run inside the workflow itself, whose results stay in the file — not in a separate tab that gets closed afterward.

Getting-started checklist

If you don't have an organized file today, start with these three steps:

1. Make the "source of income" field mandatory for every new customer. Just that, starting tomorrow.
2. Complete your twenty biggest customers. The most volume and risk is there, not in the 2,000 small files.
3. Build the note-taking habit. Whatever question you asked, write its answer on the account.

Summary

Practical KYC means four pillars (identity, contact, source of income, purpose of the relationship), tiered by risk, confirmed by checks, and recorded in a way that can be proven later. The document is the claim, the check is the confirmation, and the note is the memory. All three are needed.

Want to see how the customer file and in-workflow checks work in practice? Build a dedicated demo and follow a new customer from identity verification to their first transaction.