Financial Institutions, Data Minimization and KYC.
(The Utility Bill Case Study)
Background
You walk into a bank to open an account and are handed a long form. NIN, BVN, utility bill, and more. Most of us hand it all over without asking why. But there’s a second question we rarely ask: does the bank need all of it, or everything printed on it? This article looks at where the duty to know your customer meets the duty to collect only what’s necessary, using a utility bill as the test case.
Key words
KYC (Know-Your-Customer) — A process used to identify and verify a customer’s identity, typically by collecting information such as a government-issued ID, name, date of birth, and address.
Data Minimization — A data privacy principle requiring organizations to collect and process only the personal data necessary for a specific purpose.
Financial Institutions and KYC
Financial Institutions (FIs) and even Designated Non-Financial Businesses and Professions (DNFBPs) play a crucial role in combating money laundering and terrorist financing & proliferation financing. They act as the second line of defence between the regulators and the ‘customer’. As such, there are stringent obligations on them to identify their customers and verify their identities to confirm that customers are who they say they are.
This responsibility stems ultimately from Section 4 of the Money Laundering (Prevention and Prohibition) Act, 2022 which requires FIs and DNFBPs to identify a customer (whether individual, corporate or other legal arrangement) using documents specified in the relevant industry regulation and verify that identity using reliable independent sources.
Regulators have issued further guidance. In banking, these include the Central Bank of Nigeria’s AML/CFT/CPF Regulations, 2022 and the Customer Due Diligence Regulations, 2023. In insurance, there are NAICOM’s AML/CFT/CPF Regulations, 2022.
Typical identification information for individuals includes name, phone number, BVN, NIN, residential address, and date of birth. These are verified using valid official documents such as a government-issued means of identification, a birth certificate, a physical visit to the customer’s residential address, utility bills etc.
However, the obligation to identify and verify customers’ identities does not, in itself, resolve the question of how much information should be collected in the process. While an FI must satisfy the applicable regulatory requirements, it must also consider whether the personal data it collects is necessary for the particular purpose for which it is requested. This is where the principle of data minimization becomes relevant.
Data Minimization
Section 24(1) of the Nigeria Data Protection Act (NDPA), 2023 mandates data controllers and processors alike to ensure that personal data is adequate, relevant, and limited to the minimum necessary for the purposes for which the personal data was collected or further processed.
Get Ginika Ikechukwu’s stories in your inbox
Join Medium for free to get updates from this writer.
The NDPA General Application and Implementation Directive (GAID) 2025, breaks this requirement down by providing definitions for the following key words used:
“Adequate” meaning appropriate quantity and quality of personal data.
“Relevant” meaning materially useful and indispensable in the fulfilment of the specified, explicit, and legitimate purposes.
“Minimum necessary” meaning the least possible data which is essential to the fulfilment of the specified, explicit, and legitimate purposes should be collected.
Essentially, the exact amount of data needed for a specific purpose should be what is collected; nothing more and nothing less.
This is not to say that where an organisation can show the existence of another legitimate purpose for the collection of additional information, it would be precluded from doing so. The key consideration is whether the information collected is necessary and proportionate to the purpose for which it is being processed, rather than whether the information happens to appear on a document presented by the customer.
The Utility Bill Case Study
· Customer A visits Bank XYZ to open an individual account and is asked to provide several documents including a utility bill to verify their residential address.
· Customer A retrieves an internet bill showing their full name, address, UserID, masked password, internet subscription plan and amount payable.
· Customer A then proceeds to redact sections showing their UserID & pseudonymized password, subscription plan and amount payable, leaving their full name, residential address and billing period visible.
· Bank XYZ rejects the bill, saying all fields must be visible.
· Customer A asks why, and the customer service representative confirms that it is required for residential address verification.
As shown above, extant regulations allow utility bills to be used to verify residential addresses, and data protection laws requires that personal data collected be adequate, relevant, and limited to what is necessary for the intended purpose. Consequently, where a utility bill is requested solely for address verification, the bank should ordinarily need only the customer’s full name, residential address, and, where necessary, the name of the person or entity issuing the bill to establish its authenticity.
Requiring Customer A to disclose their UserID (an online identifier), their subscription plan and amount payable, (which may reveal information about their economic circumstances) appears to go beyond what is necessary. Unless Bank XYZ can demonstrate a separate, lawful basis for requiring this additional information, a redacted bill containing sufficient information to verify the customer’s residential address ought to suffice.
Worthy of consideration, however, is whether Bank XYZ has a legitimate reason for requiring the bill in its entirety. For instance, the bank may argue that access to all the fields on the bill is necessary to assess its authenticity or satisfy an applicable regulatory requirement. While these arguments may be relevant, the mere presence of additional information on a document does not establish that such information must be collected or retained. The relevant question is whether the unredacted fields are necessary for the stated purpose or another identifiable and legitimate purpose.
Conclusion
This case study highlights the need for FIs to strike a balance between their KYC requirements and their obligations under applicable data protection laws. While FIs are required to identify and verify their customers, these obligations should not be interpreted as an unrestricted licence to collect every piece of information contained in a document presented for verification.
Ultimately, KYC procedures and data minimization are not mutually exclusive. FIs can fulfil their regulatory obligations while respecting customers’ privacy. The real question, therefore, is not whether a financial institution can collect a piece of information, but whether it needs that information for the purpose at hand.
