KYC-only checks versus a full AML assessment
Overview. IdentityCheck can do two different things with a client, and it helps to be clear which you are asking for. A KYC-only check verifies the person's identity (a government ID plus a live selfie) and returns a clear outcome. A full AML assessment is the Tranche 2 flow that adds consent, an intake form, screening, and a defensible High, Medium or Low risk rating recorded against the client. If a client only needs their identity confirmed, run a KYC check. If your service requires a risk rating, run the assessment. This article explains the difference and how to start each.
The five workflows, and where each check sits
IdentityCheck is built around five workflows. Collect and Verify apply to every client you onboard. Screen, Assess and Monitor are added on when AML applies. You can take one, or all.
- A KYC-only check covers Collect and Verify (confirming identity), and can include Screen (PEP, sanctions and adverse-media screening runs automatically on a passed verification when screening is switched on).
- A full AML assessment adds Assess (a High, Medium or Low risk rating) and feeds Monitor (ongoing monitoring, periodic reviews and escalation to Enhanced Due Diligence).
So the practical question is whether the client needs a risk rating and the ongoing AML workflow, or just identity confirmation.
What a KYC-only check does
A KYC-only check is the core identity verification. Your client photographs a government ID and takes a live selfie; the platform confirms the document is genuine, matches the selfie to the photo, checks a real person is present, and returns a clear outcome. You get the identity details, the document details and the captured images against the verification. For the full detail of what the client experiences, see How identity verification works.
A KYC-only check does not open an AML risk assessment. There is no consent step, no intake form and no risk rating unless you run the assessment flow.
What a full AML assessment adds
A full assessment is the Tranche 2 flow. On top of the identity check, it captures the client's consent, collects an intake form, runs screening, and then one of your designated staff assessors completes the risk-assessment form so the platform records a defensible High, Medium or Low rating. That rating is what drives EDD, periodic reviews and ongoing monitoring. The mechanics, including how the score is worked out, are covered in Running an AML risk assessment.
The word assessment in IdentityCheck refers to this risk-rating flow specifically. A verification is not an assessment: a verification tells you the person is who they say they are; an assessment tells you how much money-laundering risk they carry.
When is a KYC-only check enough?
A KYC-only check is the right choice when you need to confirm a client's identity but a full AML risk assessment is not required for the service you provide. For example, a client that is out of scope for Tranche 2 may still warrant identity verification (accountants and tax agents have client-verification duties under their ATO and TPB obligations regardless of Tranche 2), without needing a risk rating.
Whether a given service is a "designated service" that pulls you into the AML regime is a legal question for your firm. See Designated services under Tranche 2: am I in scope? and confirm your own situation against AUSTRAC guidance. IdentityCheck helps you carry out and evidence these checks; it does not decide your obligations for you.
How to start each
- To run a KYC-only check, send a Direct Verification to the client, verify people in bulk, or publish a self-serve link. All of these start an identity check without an AML assessment. See Sending checks: one-by-one, in bulk, or self-serve. From a connected practice system, the KYC Command starts a plain identity check.
- To run a full AML assessment, use the Tranche 2 flow. The account-level Tranche 2 flow must be switched on first (see Setting up your Tranche 2 compliance flow). From a connected system, the AML Command starts the full assessment rather than a KYC check.
[VERIFY: exact in-app path for starting a standalone AML assessment from the dashboard (as opposed to via an integration AML Command), and whether Direct Verification offers a choice of check type or is always KYC-only.]
Frequently asked
Can I verify a client's ID without running an AML assessment? Yes. A KYC-only check verifies the person's identity with a government ID and a live selfie and returns a clear outcome. It does not open an AML risk assessment. This is the right check for a client where you need to confirm identity but a full Tranche 2 assessment is not required.
What is the difference between a KYC check and an assessment? A KYC check confirms who the person is (identity verification, and optional screening). An assessment is the full Tranche 2 flow that also gathers consent and intake, runs screening, and produces a defensible High, Medium or Low AML risk rating recorded against the client.
When is a KYC-only check enough? When you need to confirm a client's identity but the service you provide does not require an AML risk assessment, for example a client that is out of scope for Tranche 2. Whether a service is captured is a legal question for your firm; see the designated-services guidance.
Does a KYC-only check still screen for PEP and sanctions? Screening (PEP, sanctions and adverse media) runs automatically on a passed verification when you have it switched on, so a KYC-only check can include screening without being a full risk assessment. The risk rating is only produced by the assessment flow.