KYC for small lenders and advisers in Nigeria and Kenya
What customer identification, due diligence and enhanced due diligence mean for a small Nigerian or Kenyan lender or adviser, and how to file the proof.
By Achekam · · 5 min read · For Financial services businesses in Nigeria, Kenya
A small lender in Ibadan or a two-person investment advisory in Mombasa does not have a compliance department. It has a founder, an operations person and a stack of customer files, some on paper, some in e-mail, some on a phone. Yet the questions it must answer about each customer are the same ones a bank asks: who is this person, who really owns this company, why do they want this loan or this investment, and is anything about them a warning sign?
Those questions are what "know your customer" (KYC) means. This article sets out the three parts of KYC as a widely used reference explains them, why the actual requirements for a Nigerian or Kenyan business come from local rules, and how to keep a customer file that shows what was checked.
KYC is part of fighting financial crime
Investopedia defines Know Your Client (KYC) as a process by which financial institutions verify customer identities to comply with legal requirements and prevent financial crimes. In banking, it explains, KYC requires identifying customers, the beneficial owners of businesses and the nature and purpose of customer relationships, and reviewing accounts for suspicious and illegal activity.
For a small lender or adviser, the point is practical as well as legal. A borrower who gives a false identity is a borrower you cannot pursue. A client whose money comes from somewhere they will not explain can draw your business into a criminal investigation. KYC is the routine that keeps both out of the door.
The three parts: CIP, CDD and EDD
Investopedia breaks KYC into three main components:
- A Customer Identification Program (CIP), which establishes who the customer is.
- Customer Due Diligence (CDD), which looks at who stands behind the customer and what the relationship is for.
- Enhanced Due Diligence (EDD), for customers who present a higher risk.
Identification
Investopedia states that a Customer Identification Program requires financial firms to obtain four key pieces of client information: name, date of birth, address and ID number. It notes that account owners generally must provide a government-issued ID as proof of identity, that some institutions require two forms of ID, and that the address must also be confirmed, either from the ID itself or from an accompanying document.
Due diligence
For a business customer, identification of the company is not enough. The question is who owns and controls it: the beneficial owners. Ask, too, what the customer intends to do with the loan or the investment, and whether that fits what you know of them. A trader borrowing against invoices for stock is a different relationship from an individual who wants to invest a large cash sum with no clear source.
Enhanced due diligence
Investopedia explains that enhanced due diligence applies to customers at high risk of infiltration, terrorism financing or money laundering, and requires collecting extra information. For a small business that might mean asking for proof of the source of funds, looking more closely at the people behind a company, approving the customer at a more senior level, and reviewing the relationship more often.
Why Nigerian and Kenyan rules decide the detail
The Investopedia guide to Know Your Client is a clear introduction to the concepts, the three components and the documents usually asked for. But it describes the United States framework. Local KYC rules in Nigeria and Kenya set their own requirements, including what counts as acceptable identification, which businesses must carry out due diligence, what must be reported and how long records are kept.
So use the three-part structure to organise your process, and fill in the content from the rules that apply to your licence. Your regulator, your industry association or a lawyer who works with lenders and advisers in your country is the right source for that detail. Tax identifiers are part of the picture too; Nigeria Tax ID and KRA PIN: what is checked explains what those numbers are and how to confirm them officially.
One folder per customer, filed before anything is signed
KYC fails most often not because nobody checked, but because nobody can show what was checked. A business on Achekam can keep each customer's KYC evidence in its own folder in the Document Centre, a folder-based store where files or whole folders are uploaded, previewed, tagged, searched and archived.
A workable layout for each customer folder:
- Identity: the ID document or documents, and proof of address.
- Ownership: for a company, the documents showing who owns and controls it.
- Purpose: the application, and your note of what the relationship is for.
- Risk: your risk rating, and for a higher-risk customer the extra information gathered and who approved the customer.
- Reviews: dated notes of each periodic review.
When a customer provides an updated ID or a new proof of address, upload it as a new version; the earlier ones are kept, so the file shows what you held at each point. Every stored file gets a SHA-256 fingerprint, and every upload passes a malware check. If you are ever asked to show that a document in the file is the one you received at onboarding, the fingerprint supports that; showing a filed document has not changed explains how.
One more control helps keep KYC ahead of the paperwork. In Achekam, an e-signature envelope with a signer from outside the business must be linked to a client or a CRM lead before it is sent. Make it a rule that the customer's KYC folder is complete before that link is made, and a loan agreement or investment mandate cannot go out to someone you have not yet identified.
Achekam does not verify identities, screen customers against any list, or rate their risk. Those checks are done by your staff against the rules that apply to you; Achekam holds the evidence of what they did.
Where to start
Take your ten most recent customers and open their files. For each, can you show the identity document, proof of address, who owns the business if it is a company, what the relationship is for, and a risk rating? Where the answer is no, complete the file now, and write the gaps into a one-page KYC procedure so the next customer is checked the same way.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
