What KYC requires in Argentina
The Unidad de Información Financiera is the enforcement authority for Argentina's anti-money laundering and counter-terrorist financing regime. It is the body that defines the specific obligations of each type of obligated party and oversees them.
Its requirements for customer onboarding are organized into three linked duties.
- Identify and know — obtain and verify the customer's identity before they transact, and understand the profile that justifies the transactions they are going to make.
- Document — keep the customer file with the evidence of how that identification was done, available to the supervisor for the period the law sets.
- Maintain and report — update that information throughout the relationship and report the suspicious transactions that arise from later monitoring.
The obligation is defined by activity, not size
Obligated-party status is set by Law 25,246 (article 20) according to the activity carried out. The list covers financial and foreign exchange institutions, insurers, capital market participants, virtual asset service providers, notaries and several non-financial activities, each with its own set of obligations. The UIF does not ask the same of a bank as of a notary: each sector's obligations are in their own resolutions, such as Resolution 14/2023 for financial and foreign exchange institutions or Resolution 49/2024 for virtual asset service providers.
Two consequences that determine whether this applies:
- A company can be covered by just one of its business lines. The declared line of business decides nothing.
- If it is also a financial institution, the BCRA adds its own rules on how it operates, including customer onboarding through non-face-to-face channels. It answers to both bodies, and the requirements add up rather than replace each other.
Diligence is scaled by risk, and the scaling has to be explainable
The regime is built on a risk-based approach: the depth of due diligence is not the same for every customer, product, channel and jurisdiction. A low-risk customer can be handled with simplified measures and a high-risk one requires enhanced measures.
That sounds like flexibility and in practice it is the opposite: the obligated party has to be able to explain, customer by customer, why it applied the level it applied. And that explanation rests on the evidence of the process, not on the written policy.
Customers who qualify as a politically exposed person trigger enhanced diligence: identifying the status during onboarding, approval from a higher level of seniority, understanding the source of funds and more intensive monitoring. What is verified at sign-up does not change. What changes is how much additional evidence goes with the customer file and who signs off on acceptance.
What VU automates in KYC
VU covers the identification link, which is the one that produces the evidence on which the rest of the duty rests.
- Identity verification at sign-up — reading of the Argentine document, biometric matching of the face against the document and liveness detection at capture.
- Process orchestration — the order of the steps, retries, timeouts and what happens when a step does not complete.
- Trail of each step — what ran, with what result and when. It is what gets shown later when the supervisor asks how that customer came to be known.
- Reuse of the verified identity — the same identity checked at sign-up later serves to authenticate that person, without repeating the process or fragmenting the evidence.
And what VU does not do, which in KYC is half the work:
- It does not build the customer's transactional profile. Understanding which transactions are consistent with that person is the obligated party's analysis of its own business data.
- It does not classify the customer's risk or decide on their acceptance. The risk matrix and the decision to onboard are internal policy, and the law requires them of the obligated party, not of its provider.
- It does not assemble the regulatory customer file or define retention periods. VU produces evidence; what is retained, in what format and for how long is decided by compliance.
- It does not interpret whether a company is an obligated party. That reading is a legal one and comes before any product decision.
- It does not monitor later transactions. KYC does not end at sign-up, and that second half is AML.
Use cases in Argentina
Where this problem shows up in the real operation of the Argentine market.
Banks and wallets that onboard through digital channels. Identification went from an employee looking at a document to a process that has to prove itself, and the customer file stopped being a folder and became a record of events.
Virtual asset service providers. It is the newest category of obligated party and the one that arrives with no legacy process, so it builds its KYC from scratch while it grows.
Companies covered by a single business line. They discover they are an obligated party because of one specific activity and have to set up a full regime with no prior compliance team.
Customers onboarded years ago, with incomplete files. The obligation to keep information up to date collides with portfolios signed up when the standard of evidence was different.
Notaries, insurers and capital market participants. They share the obligation with banks but not their scale or their budget, so the question is not what to buy but how much process is proportionate.
Frequently asked questions
KYC is the set of checks that establish who a customer is before onboarding them, and the obligation to keep them current throughout the relationship. In Argentina it is not a voluntary practice: the UIF, as the enforcement authority for the anti-money laundering and counter-terrorist financing regime, requires each obligated party to identify and know the customer before they transact, document how it did so, keep that information up to date and report suspicious transactions. What turns those checks into compliance is not running them, but being able to show afterwards that they were run.
The status is defined by the law by activity, not by size or by the declared line of business. The list includes financial and foreign exchange institutions, insurers, capital market participants, virtual asset service providers, notaries and several non-financial activities. The practical consequence is that a company can be covered by just one of its business lines, even if the rest of its operation has nothing to do with the financial system. The reading is a legal one and is best done before designing any process, because the specific obligations that apply depend on it.
It means that the depth of due diligence is scaled according to the risk of each customer, product, channel and jurisdiction, instead of applying the same procedure to everyone. A low-risk customer can be handled with simplified measures and a high-risk one requires enhanced measures. The operational consequence is demanding: the obligated party has to be able to explain, customer by customer, why it applied the level it applied, and that explanation rests on the evidence of the process and not on the written policy.
Enhanced due diligence applies. In operational terms, that means identifying the status during onboarding, escalating the acceptance decision to a higher level of seniority, understanding the source of funds and subjecting the relationship to more intensive monitoring. Identity verification does not change method: what changes is how much additional evidence goes with the customer file and who signs off on acceptance. That is why the process has to be ready to route a sign-up to review without breaking the experience for the rest of the customers.
The identification standard is the same. What changes is how it is proven. In an in-person onboarding the evidence is an employee and a document; in a digital one, the evidence is the record of the process itself. That is why, in digital, the traceability of each step stops being a technical detail and becomes the requirement: a process that verifies well but does not record how it verified meets half of what is asked of it.
Sources
- Law 25,246 · concealment and money laundering (InfoLEG)
- UIF Resolution 14/2023 · financial and FX institutions (Boletín Oficial)
- UIF Resolution 49/2024 · virtual asset service providers
- UIF · Unidad de Información Financiera (Argentina's FIU)
- BCRA · Banco Central de la República Argentina
- RENAPER · Registro Nacional de las Personas
- Law 25,326 · personal data protection (InfoLEG)