Verifying a customer’s identity is expensive and creates friction. When that process is repeated unnecessarily — because the customer already went through it at another entity in the same group, or because the flow is poorly designed — the cost doubles without adding any real compliance value. This phenomenon is called duplicate KYC.
The problem with duplicate KYC
Duplicate KYC occurs when the same person is subjected to identity verification more than once within the same business ecosystem, without a regulatory or risk-based reason to justify it. The consequences are concrete:
- Friction and drop-off: every additional verification step increases the abandonment rate during the onboarding process. Industry studies estimate that between 20% and 40% of users abandon before completing a lengthy KYC.
- Operational cost: every verification has a unit cost (OCR, biometrics, AML screening). Duplicating it unnecessarily is wasted money.
- Duplicate data risk: storing the same identity information in two separate systems multiplies the exposure surface in the event of a security breach.
- Degraded customer experience: asking someone to upload their documents twice signals disorganization, not trust.
What is Shared KYC
Shared KYC is the model by which a completed and approved identity verification in one entity can be reused by other entities in the same group or network, with the customer’s consent and under the same regulatory framework.
Instead of repeating the verification process from scratch, the new entity consumes the existing result: the verified documents, the AML screening result, the risk classification. The customer sees a shorter — or even transparent — flow, and the company maintains the same level of control.
Benefits
Higher onboarding conversion
A flow that recognizes an already-verified customer can be reduced to consent confirmation and data update, rather than requesting documents again. This can reduce the onboarding time from minutes to seconds.
Lower cost per customer
By reusing verifications, the marginal cost of onboarding a customer already verified elsewhere in the group approaches zero. Savings are especially significant for financial groups with multiple subsidiaries or platforms with various regulated products.
Smaller data risk surface
Centralizing verified identity information — rather than duplicating it across multiple systems — reduces the number of points where that data can be compromised. Fewer copies of an identity document means lower risk.
Consistent risk profile
When KYC is centralized or coordinated, all entities in the group work with the same customer risk profile. This eliminates inconsistencies where a customer is classified as low risk at one entity and high risk at another due to a lack of communication.
How it works
Shared KYC rests on three technical and regulatory pillars:
- Explicit customer consent: the customer must authorize their identity information to be shared with other entities in the group. This must be recorded in an auditable way.
- No duplicating PII: verified identity data is stored once and referenced, not copied. This reduces data risk and simplifies compliance with data protection regulations like GDPR or LGPD.
- Complete traceability: the system must record which entity performed the original verification, when, with which documents, and what the result was. Any entity consuming that KYC can justify to the regulator why it trusts it.
From a flow perspective, when a customer arrives at a new entity in the group, the system checks whether they already have a current verification. If they do, the onboarding flow is simplified. If they do not — or if the verification is outdated — the full process runs normally.
Frequently asked questions
Is Shared KYC regulatorily accepted?
In most jurisdictions, regulation allows an entity to rely on the due diligence of a third party or another group entity, provided there are documented agreements and that the final responsibility rests with the entity consuming the KYC. FATF Recommendation 17 and its local equivalents contemplate this scheme. The key is documentation and traceability.
What if the original KYC is of poor quality?
Shared KYC does not eliminate the responsibility to validate the quality of the original KYC. An entity that consumes a low-quality verification assumes that risk. This is why it is critical that the system producing the KYC has high standards: high-resolution documentation, biometrics with liveness detection, screening against multiple lists.
Can the customer refuse to share their KYC?
Yes. Consent is a requirement, not an option. If the customer does not authorize sharing, each entity must run its own verification process. A well-designed flow should clearly communicate the benefit of consent — a faster onboarding — to maximize the acceptance rate.