Know Your Customer in Insurance: The Frontline Guide

Know your customer in insurance means this: before you take the premium or pay the claim, you know who the person is, who really stands behind the policy, and why they want it. You prove it with documents and questions, and you write down what you found. This guide walks through every step of that work, in the order you meet it on the job.

If you start on Monday as an agent, a broker's assistant, an onboarding clerk or a service adviser, this is the page to keep open. Your employer's procedure always comes first. The national rules where you work set the exact documents, limits and time frames. This guide gives you the method, so the procedure makes sense when you read it.

What know-your-customer means when the product is a policy

Banks made "know your customer" famous, but insurers need it too. A policy is a store of value and a way to move money. A person can pay in, wait, cancel and take money out. A person can also claim and receive a large payment. Anyone who wants to hide where money came from can use that path.

So the check is not paperwork for its own sake. It does three jobs.

It protects the insurer. You do not want to sell cover to a person who is using a false name.
It protects honest customers. When criminals use a false name, they can claim on cover that belongs to someone else, and the honest customer suffers.
It protects the wider market. Insurers that skip checks become the easy door for crime, and regulators punish the whole sector for that.

Customer due diligence is the formal name for the work. It has four parts. You identify the customer. You verify the identity with reliable evidence. You understand the purpose of the relationship. You keep the information fresh while the relationship lasts. Everything below is one of those four parts.

Who counts as the customer: policyholder, payer, insured life, beneficiary

This is where beginners make the first mistake. They check the person in front of them and stop. But one policy can have four different people on it.

The policyholder owns the contract and can change or cancel it.
The payer is whoever sends the premium. It may be the same person, or a parent, an employer, a company or a stranger.
The insured life is the person whose life, health or property is covered.
The beneficiary is the person who receives the money when a claim is paid.

Say a man buys a life policy on his own life. He pays from his own account. He names his wife as beneficiary. That is simple: one person to check now, and the wife is checked when she claims.

Now change one thing. The payer is a company the policyholder has never mentioned, and the beneficiary is a person in another country. The same policy is now a different risk. You need to know who the payer is and why they pay. Our article on what to check when a third party pays the premium goes through that case step by step.

A good rule: the person who controls the policy and the person who gets the money are always checked. The person who pays is checked or at least understood. Ask your employer's procedure which roles need full verification and which need lighter checks.

The trigger points across the life of a policy

Many people think the check happens once, at the start. It does not. There are several moments when you must look again.

Quote and application. You collect the details and decide whether the customer is within your normal risk.
Inception. Before cover starts or the first payment is taken, identity is verified, or it is verified within the time your rules allow.
Changes. A change of policyholder, beneficiary, address, bank account or payer is a trigger. So is a sudden request to raise cover or add a payment.
Payments in and out. A large extra payment, an early cancellation, a refund or a surrender is a trigger.
Renewal. A renewal is a chance to check that the picture still matches the customer.
Claim. Before you pay, you confirm that the person receiving the money is the person entitled to it.

A useful habit is to ask, at each of these moments: "Is there anything here that does not fit what I already know?" If the answer is yes, slow down.

Checking an individual's identity documents

For a person, the basic idea is the same everywhere. You collect the name, the date of birth and the address. Then you check them against evidence from a source you can trust, usually an official identity document. Your employer's procedure lists which documents it accepts.

At the desk, check the document itself with your own eyes and hands:

Is it the real type of document, and is it still valid?
Does the photo look like the person in front of you?
Does the name match the application exactly, including the spelling?
Is the document damaged, altered or oddly printed? Do the dates make sense?
Does the date of birth match the age the person appears to be, and the age on the application?

Then record what you saw. Write the document type, the number if your rules say so, the date you checked it and your name. If you only wrote "ID seen", an auditor cannot tell what you actually looked at, and neither can you in six months.

Our longer article on how to check identity documents in insurance covers the detail of reading a document and what to do when something looks wrong.

Verifying a customer you never meet

Much insurance is sold by phone, by web form or through a broker. You never see the customer. This is normal, but the risk is higher, because a criminal can hide behind a screen.

The aim stays the same: reliable evidence that this person exists and that this applicant is that person. With no face in front of you, you use other layers.

A copy or a photo of the document, checked for signs of editing.
A match between the document and a trusted record, if your employer uses an electronic check.
A live step, such as a video call where the person shows the document and their face together.
A payment from an account in the customer's own name at a regulated bank.
A sense check: does the email, phone number, device and address pattern fit the story?

No single layer is perfect. Together they are strong. We explain how to choose and combine them in verifying a customer's identity remotely.

When a customer has no standard documents

Not everyone has a passport or a driving licence. Some people are young, some are elderly, some have fled their country, some have lost everything in a fire or a flood. Refusing them all is unfair and often unnecessary.

The right approach is not to lower the standard but to use the alternatives that your employer's procedure allows. These might be other official letters, a reference from a trusted body, or a lower-risk product with limits. The key points:

Never invent your own rule. Ask your team lead or the compliance officer.
Write down why the usual documents were not available.
Be extra careful if the reason sounds convenient. "I left my ID at home" on the day of a large payment is a different story from an elderly customer who has never had a passport.

Read more in what to do when a customer cannot provide ID documents.

Companies and the people behind them

A company is a legal shell. It cannot walk into your office. Real people own it and control it. If you check only the company name and registration, you do not know who benefits.

For a company customer you collect and verify:

the legal name, registration number and registered address;
who is allowed to act for the company;
the beneficial owners, meaning the people who ultimately own or control it, even through other companies.

Follow the chain upward. If Company A is owned by Company B, and B is owned by Company C, you keep going until you reach people. Stop and ask for help if the chain is long, goes through several countries, or ends in an arrangement you cannot explain.

A common signal is a structure that is more complicated than the business needs. A small shop with a three-layer ownership chain across different countries deserves a second look. The article on beneficial owner checks for a corporate customer shows the method.

Rating the risk of a relationship

Not every customer needs the same depth of checks. A salaried person buying a basic term policy with a monthly debit is low risk. A foreign company paying a large single premium from a third party is higher risk.

Most employers give you a risk rating method. It usually looks at:

The customer. Who are they, what do they do, and is there anything unusual in their background?
The product. Can money go in and out easily? Is there a savings or investment part?
The channel. Did you meet them, or did they come through a third party?
The geography. Where does the customer live, where does the money come from, and where does it go?

Higher risk means more evidence, more approval and closer watching afterward. Lower risk means simpler checks, but never zero checks. The reasoning behind a rating is worth writing in two lines. See how to rate customer risk in insurance.

Source of funds and source of wealth

These two ideas sound alike, and people confuse them.

Source of funds answers: where does the money for this payment come from? For example, "from my savings account at this bank" or "from the sale of my flat last month".

Source of wealth answers: how did this person come to have this much money overall? For example, "I ran a business for twenty years and sold it".

You ask about funds on almost every large payment. You ask about wealth when the amount or the customer's risk is high. A plain, friendly question works best: "To complete this, I need to note where the payment is coming from. Is it from your own account?" Do not accept an answer that sounds rehearsed and has no detail. Ask for a document where your rules say so, such as a bank statement or a sale contract.

The difference, with examples of the questions to ask, is in source of funds versus source of wealth.

Keeping the picture up to date after onboarding

A customer who was low risk at the start may not be low risk three years later. They may move country, change jobs, start paying from other accounts, or become a public figure. Documents expire. Companies change owners.

Keeping the picture up to date is partly a system task, with scheduled reviews that your employer runs. But it is also your daily job. When you speak to a customer and learn something that changes the picture, record it and pass it on. A change of country, a different payer, a different job title, a large unexplained payment: all are worth a note.

Explaining the checks without losing the sale

Customers do not like questions about their money. Some feel accused. The way you explain the check changes how they react.

Try this order:

Say why: "Insurers are required to confirm identity before we start cover. We do this for every customer."
Say what you need: "I need one photo document and one proof of address."
Say what happens to it: "It stays on your file and we keep it safe."
Offer help: "If you don't have that one, tell me what you do have and I'll check what works."

Do not apologise for the check, and do not say "it's just a formality". It is not. It is a control, and honest customers understand a control when it is explained calmly.

A short example. A woman is buying a policy for her small shop. She says, "My broker never asked for all this." You answer: "I understand. The rule applies to every customer, and it also protects your policy, because it means nobody else can claim on it. Which of these documents is easiest for you to send today?" She sends them that afternoon.

Common mistakes at the onboarding desk

Checking only the person in front of you. The payer and beneficiary matter too.
Accepting a copy that has been edited. Look at edges, fonts and shadows.
Writing "ID seen" and nothing else. Record what, when and by whom.
Letting pressure win. A customer who says "I'm in a rush, skip it" is not a reason to skip it.
Treating a refusal as normal. A person who refuses all questions about the source of funds is telling you something.
Forgetting the check after inception. Changes and claims are trigger points too.
Keeping a worry to yourself. If something feels wrong, tell the compliance officer. You do not need proof, only a reason.

Quick reference: the order of work

Identify every person on the policy and what role each plays.
Collect the details and verify them with reliable evidence.
For a company, find the people behind it.
Rate the risk and note why.
Ask where the money comes from, as far as your rules require.
Write down what you did, with dates and your name.
Watch for trigger points and update the file.

Learn this in five minutes

The track "Why Customer Identity Is the First Control" in InsureSkills covers what know-your-customer means in an insurance business, why weak checks expose an insurer, the trigger points across the life of a policy, who counts as the customer, and how to explain the checks without losing the sale. Each lesson takes five minutes, so you can finish one before your next call.

Questions people ask

Is know your customer the same as anti-money-laundering?

Not exactly. Know your customer is one part of anti-money-laundering. It stops criminals from using false names. Anti-money-laundering also includes watching payments, spotting red flags and reporting suspicion. You can read about the wider picture in our guide on how money laundering works through insurance.

Do I have to check the customer for every kind of insurance?

It depends on the rules where you work and on your employer's procedure. Some products carry little risk of laundering and need lighter checks. Others, such as savings and life products, need more. Do not decide this yourself. Follow the procedure, and ask your compliance officer if the case does not fit it.

What if a customer refuses to give the documents?

Do not complete the sale and do not make an exception on your own. Explain once, calmly, why the check is needed. If they still refuse, tell your team lead or compliance officer. A refusal with no good reason can itself be a sign worth reporting.

Who sets the exact documents and time limits?

Law and the financial regulator where you work set the rules, and your employer turns them into a procedure. This guide does not give limits or deadlines because they differ between countries and change over time. Your procedure is the authority for your desk.

What do I do if I think the customer is not who they say they are?

Stop the process and do not tell the customer what you suspect. Report it to the person your procedure names, usually the compliance officer, using the internal report form. Our article on tipping off explains what not to say.