KYC checklist for small lenders: what to collect and verify

Knowing your customer serves two goals. The first is protecting yourself: fraud, impersonation and borrowers who vanish are among the most avoidable losses in lending. The second is meeting legal duties: in many countries, lenders must verify identity and keep records under anti-money-laundering and consumer-protection rules. This checklist is a practical starting point for a small lender. It is not legal advice, and the requirements vary by country, so confirm what applies to you with the regulator or a lawyer.

The KYC checklist

1. Identity

• Full legal name exactly as on the identity document.
• Government-issued photo ID: national ID, passport or driver's licence. Check that it is valid and not expired.
• ID number, recorded on the borrower's file.
• Date of birth, and confirmation that the borrower is of legal age to contract.
• A photo of the borrower, if your process allows.
• A copy of the ID kept on file.

2. Address and contact

• Residential address, with a way to verify it: a utility bill, tenancy agreement, local leader's letter or a visit.
• Phone number, verified by calling it.
• Alternative contacts, such as a family member or workplace.

3. Income or business

• For employed borrowers: employer's name and contact, payslips or a letter, bank or mobile-money statements.
• For self-employed borrowers: the nature and location of the business, how long it has operated, stock, receipts, statements, and a visit if practical.
• Other income and household obligations.

4. Existing debts

• Other loans and obligations the borrower has, and their payments.
• Credit reference or bureau report, where available.
• History with you, if a returning borrower.

5. Purpose of the loan

• What the money is for. A clear productive purpose (stock, equipment, school fees) is easier to assess than a vague one.
• Consistency: does the purpose fit the amount and the borrower's circumstances?

6. References

• At least one or two references who know the borrower, contacted and recorded.
• Character and standing: is the borrower known locally, and what do others say?

7. Security and guarantors

• Guarantor's identity documents, contact details and signed guarantee.
• Collateral: proof of ownership, valuation and details.

See collateral vs guarantor.

8. Consent and disclosure

• Written consent to process personal data and to contact references and guarantors.
• Confirmation that the borrower has received and understood the terms.
• Signed application and agreement.

9. Risk screening

• Sanctions and watch-list checks, where required.
• Politically exposed persons (PEP), if your regulator requires it.
• Red flags: inconsistent documents, pressure to hurry, refusal to give contact details, third parties handling everything.

Verifying, not just collecting

Collecting documents is not KYC. Verification means checking that they are genuine and consistent:

• Compare the ID photo and details with the person in front of you.
• Check names, dates and numbers match across documents.
• Call the phone numbers and references.
• Visit the home or business for larger or riskier loans.
• Look for signs of tampering, such as different fonts or poor copies.
• Check against your own records for duplicate borrowers.

Risk-based KYC

Not every loan needs the same depth. Apply more checks as risk rises: larger loans, first-time borrowers, unusual patterns, borrowers referred by third parties. A common approach is simplified KYC for small first loans and enhanced KYC above a set threshold. Write the levels into your policy.

Records to keep

Keep KYC records for the period the law requires, often several years after the loan closes. Store them securely, limit who can see them, and be able to retrieve them quickly for an auditor or regulator. Personal data is protected by law in many countries, so keep only what you need and delete it when the time comes.

Anti-money-laundering basics

Lenders can be used to launder money, for example through unusually large repayments in cash, third-party payments or early repayments that do not fit the borrower's profile. Where AML rules apply, you typically must identify customers, monitor for unusual transactions and report suspicious activity to the authority. Ask your regulator what applies to you.

Common mistakes

• Collecting documents without checking them.
• Accepting expired or unclear IDs.
• No proof of address or income.
• Skipping references because the borrower seems trustworthy.
• Different standards for different officers. Use one checklist.
• Not keeping copies, or keeping them in a drawer nobody can find.
• Ignoring duplicate borrowers, who may be borrowing repeatedly from you.
• Keeping personal data insecurely.

Digital KYC and online applications

Some lenders now verify identity remotely, with photo capture, liveness checks and database lookups. Doing this well needs a specialist verification service and careful attention to data protection. Whether you verify in person or online, the principle is the same: confirm that the person is who they say they are and can repay. See online loan applications guide.

KYC records in LoanTabs

LoanTabs holds the borrower's ID number, contact details, custom fields you define, and document attachments (up to 10 files of up to 10 MB each per record, or links), plus guarantors and collateral, all linked to the loan. There is a credit score field on the borrower record. LoanTabs does not verify identity automatically or connect to a KYC provider or credit bureau: you carry out the checks and record the outcome and the evidence. See borrower management.

FAQ

What does KYC mean?

Know your customer: verifying a borrower's identity, and whether they can repay, before you lend.

What documents do I need to verify a borrower?

At minimum a government photo ID, proof of address, and evidence of income or business. Requirements vary by country and loan size.

Is KYC legally required for small lenders?

In many countries, yes, under anti-money-laundering and consumer-protection rules. Check with your regulator or a lawyer.

How long should I keep KYC records?

For the period the law requires, often several years after the loan is closed. Confirm locally.

Can software do KYC for me?

Some services verify identity automatically. LoanTabs stores the details and documents but does not perform verification itself.