KYC and AML: What Verification Actually Involves

Know Your Customer (KYC) explained

Know Your Customer rules require financial institutions to confirm that a customer is who they say they are before doing business with them. For an individual, that means verifying identity: name, date of birth, address, and a government identification number, checked against documents. For an entity, it means verifying the entity exists and identifying the people who own and control it.

KYC is the front door. Nothing else in the compliance process happens until identity is established.

Anti-Money Laundering (AML) explained

Anti-money laundering rules sit one layer deeper. Where KYC asks who are you, AML asks where did this money come from, and is there any reason it shouldn't move. Under the Bank Secrecy Act, broker-dealers and other covered financial institutions must maintain programs designed to detect and report suspicious activity, screen customers against government sanctions lists, and understand the source of funds behind large or unusual transactions.

The two overlap in practice. A platform's KYC process feeds its AML program: you can't screen a customer against a watchlist until you know their legal name.

Regulatory obligations for platforms

A platform that facilitates trades in private company shares through a registered broker-dealer is a financial institution under federal law. That status carries obligations it cannot waive: a written AML program, customer identification procedures, beneficial ownership rules for entity customers, sanctions screening, and suspicious activity reporting. FINRA examines its member firms on these programs. The SEC rules that govern private company transactions add their own layer, including the requirement that buyers in most private offerings be accredited.

Private markets also have a structural feature public markets don't: transactions are negotiated between identified parties, and the issuing company often has approval rights over who joins its cap table. That makes identity more consequential, not less.

Protecting investors and the marketplace

Verification is easy to experience as friction and hard to experience as protection, but it is both. A marketplace where every participant has been identified and screened is one where the seller on the other side of your trade is a real person or legal entity, the buyer's funds haven't been flagged for illicit activity, and the issuer can approve the transaction without a separate investigation. Fraud in private secondaries usually depends on someone not being who they claim to be. KYC is the control that targets exactly that.

Identity documentation

For individual investors, the standard request is a government-issued photo ID (passport, driver's license, or national ID card), a government identification number (a social security number for US persons), and proof of address, usually a recent utility bill, bank statement, or lease. Platforms may also collect a Social Security number or tax identification number and run it against public and commercial databases. Many use automated document verification that reads the ID, checks its security features, and matches it to a live selfie.

Entity verification

Investing through an LLC, trust, or other entity adds a step. The platform needs to confirm the entity exists and is in good standing, which typically means formation documents (articles of organization, trust agreement, partnership agreement) and an EIN. It also needs to identify the entity's beneficial owners.

Under FinCEN's Customer Due Diligence rule, covered institutions must identify and verify any individual who owns 25% or more of a legal entity customer, plus one individual with significant control over it. In practice, each of those people goes through individual identity verification. An entity with a single owner is quick; a family LLC with five members and a manager takes longer.

Accredited investor verification

Accredited investor verification is a separate question from identity, but it runs through the same process. Most private secondary transactions are conducted under Regulation D, which limits participation to accredited investors, and under Rule 506(c) the issuer or platform must take reasonable steps to verify that status rather than accept a self-certification. The accredited investor requirements come down to income, net worth, or professional credentials, and the documentation follows from whichever test you're using:

• Income test. Tax returns, W-2s, or 1099s for the prior two years, plus a representation that you expect to meet the threshold in the current year.
• Net worth test. Recent account statements, appraisals, or credit reports showing assets and liabilities, excluding the value of your primary residence.
• Professional criteria. Evidence of a qualifying license (Series 7, 65, or 82) or status as a knowledgeable employee of a private fund.
• Third-party confirmation. A letter from a licensed attorney, CPA, registered investment adviser, or broker-dealer confirming they have verified your status within the past three months.

The accredited investor checklist walks through what to assemble under each route. Some investors will also encounter the higher qualified client and qualified purchaser thresholds for certain fund structures.

In March 2025, the SEC's Division of Corporation Finance issued a no-action letter indicating that, in 506(c) offerings with minimum investments of at least $200,000 for individuals or $1 million for entities, an issuer may rely on written representations from the investor rather than documentary evidence, provided the investor confirms the minimum isn't being financed by a third party and the issuer has no contrary knowledge. Whether a given platform uses that approach depends on its offerings and its own compliance policies.

Source-of-funds review

For larger transactions, or where something about the profile doesn't fit, a platform may ask where the invested capital came from: a bank statement showing the funds, documentation of a liquidity event or property sale, or a description of the business that generated them. This is not an accusation. It's a standard control, and answering it directly is the fastest way through.

Sanctions and watchlist screening

Every customer is screened against the Treasury Department's Office of Foreign Assets Control (OFAC) sanctions lists and related watchlists, including lists of politically exposed persons. Screening usually happens automatically at onboarding. A match, or a near-match on a common name, triggers manual review, which is one reason two people with identical documents can have different verification timelines.

Ongoing monitoring

Verification is not a one-time event. Platforms monitor transaction patterns for activity that doesn't fit a customer's stated profile, re-screen against sanctions lists as they're updated, and periodically ask customers to refresh expired documents or reconfirm accreditation. Accredited investor status in particular is time-sensitive: third-party verification letters are generally considered current for only 90 days.

Account creation and information submission

You create an account, provide basic identifying information, and answer questions about your investor profile and how you qualify as accredited. Entity investors identify the entity type and its beneficial owners.

Document review and confirmation

You upload the required documents. Automated systems check IDs and match data against databases; compliance staff review anything the automation flags, along with accreditation documentation and entity paperwork. If something is missing or doesn't match, you'll get a request for more.

Approval and account activation

Once identity, accreditation, and screening are all cleared, the account activates and you can transact. Some platforms allow browsing before verification is complete but hold order submission or funding until it clears.

Incomplete or mismatched documentation

The most common holdup is mundane: a proof-of-address document that shows a different address from the ID, a name that appears with a middle initial on one document and without it on another, a bank statement with the account number cropped out. Automated systems reject mismatches; humans then have to reconcile them.

Additional review for entities

Every beneficial owner has to clear individual verification, and entity documents have to show who those owners are. A trust with a long amendment history, or an LLC whose operating agreement doesn't clearly state ownership percentages, will take extra review.

Expired identification

An expired passport or driver's license won't pass. Neither will accreditation evidence that's aged out: tax returns older than two years, or a verification letter more than three months old.

Augment's private marketplace operates through a FINRA-registered broker-dealer, which means the KYC, AML, and accreditation checks described above are built into onboarding rather than layered on afterward. The platform guides investors through each required step, supports secure upload of identity, entity, and accreditation documents, and screens participants before they can transact. Verification is a precondition for participating in the pre-IPO investment platform, and for buying or selling shares in pre-IPO companies through the marketplace.

Because accreditation rules confuse many first-time private market investors, Augment also invests in helping them understand which test they qualify under and what documentation supports it, so the review starts with the right materials the first time. For a deeper explanation of who qualifies and why, see the guide to Regulation D and accredited investors.