Table of Contents
A KYC audit checklist is the set of controls an auditor tests to decide whether your customer due diligence actually works. It covers policy, onboarding files, risk rating, screening, ongoing review, records and reporting. The auditor pulls a sample of real customer files and traces each one back to evidence. Anything you cannot evidence is treated as a failure.
That last point catches most teams out. Auditors are not grading your intentions. They test whether a control was designed properly and whether it operated on every day of the review period.
What follows is written for the person who has to prepare, rather than for the auditor.
What a KYC audit is, and what it is not
A KYC audit reviews the programme. It asks whether the policy matches the law, whether procedures match the policy, and whether staff follow the procedures.
A periodic review, sometimes called re-KYC or refresh, is different work. That is operations staff updating one customer record on a risk-based cycle. The audit checks whether those refreshes happened on time. It does not perform them.
Three groups may knock on your door. Internal audit sits in the third line and reports to the board or the audit committee. An external auditor or consultant does the same work under contract, usually because a regulator asked for an independent review. A supervisory examiner is not an auditor at all, but the file testing looks almost identical, so preparing for one prepares you for the others.
Independence is tested before anything else
The reviewer cannot have designed, run or signed off the controls being tested. If the head of compliance also writes the audit report, the whole report loses weight.
Small firms struggle here. Three people and no separate audit function is a common position. The workable answer is a named external reviewer, engaged annually, with a scope letter and a direct reporting line to the owner or the board. Write down why the arrangement is independent. That note is itself a piece of audit evidence.
Quality assurance checks run by the compliance team are useful, but they are not audit. Keep the two labelled separately in your records so nobody claims credit for coverage you do not have.
The document request list, and how to prepare it
Most audits open with a request list sent one to three weeks before fieldwork. If you can answer it in full on day one, the audit gets shorter and calmer. Have these ready as dated files, not as promises to export something later.
- The current KYC and AML policy, with its approval date and the minutes that approved it.
- The procedure documents staff actually use, including screenshots of the workflow if the procedure lives in a system.
- The enterprise risk assessment that justifies your risk tiers.
- A full customer list for the period, with risk rating, onboarding date, last review date and country fields.
- The screening configuration: which lists are loaded, match thresholds, refresh frequency and who can change them.
- A complete alert log for the period showing every hit, who cleared it, when, and the stated reason.
- Training records by named individual, with dates and pass marks.
- Change logs for the customer system and the screening system.
- Any suspicious activity reports filed, with the internal escalation paper behind each one.
Export the customer list and the alert log on the same day and note the extraction time. Auditors reconcile the two. If the alert log contains a customer who is missing from the customer list, you have just handed over a finding.
How the sample is chosen
Nobody reads every file. Sampling is where audits are won or lost, and it is the part most checklists skip.
Stratified selection
The population gets split into strata before selection. High-risk customers, politically exposed persons, customers in higher-risk jurisdictions, trusts and layered corporate structures, new onboardings, and customers who had a screening alert. Each stratum gets its own sample. High-risk files are deliberately oversampled, so a book with forty high-risk customers may see fifteen of them tested while ten thousand low-risk retail files yield twenty-five.
Attribute testing and error rates
Each sampled file is tested against a fixed list of attributes, pass or fail per attribute. The auditor is measuring a failure rate, not collecting anecdotes. A common working rule is that one failure in a small sample triggers an expanded sample rather than an immediate finding. Two or more, and the auditor stops testing and reports the control as ineffective.
Targeted and judgemental picks
On top of the statistical sample, expect judgemental picks. Files approved as exceptions. Customers onboarded in the last week of a quarter. Alerts cleared in under thirty seconds. Accounts where the relationship manager also approved the risk rating. These are chosen because they are where control breakdowns live.
What gets checked inside a customer file
File testing follows the record from first contact to current state. For a natural person, the auditor looks for a verified legal name, date of birth, residential address and an identity document with an expiry date that had not passed on the day it was accepted. Copies of expired passports used at onboarding are a frequent hit.
For a company, the list is longer. Certificate of incorporation, current registered address, directors, shareholder register, and the beneficial owners behind it. The auditor traces ownership upward until it reaches natural persons or a listed company. Stopping at an intermediate holding company is one of the most reliable findings there is.
Beneficial ownership thresholds are set by each regime. The United States uses a 25 percent equity test plus a separate control prong, and FATF Recommendation 24 sets the international baseline for company ownership transparency. Whatever threshold applies to you, the auditor checks that your file shows the calculation, not just a name. Indirect chains matter here, and the arithmetic behind aggregated stakes is worth understanding before an auditor asks. The same logic drives the 50 percent rule in sanctions screening, where ownership arithmetic decides whether an unlisted entity is effectively blocked.
Risk rating gets tested twice. First, did the rating follow the documented methodology given the customer’s country, industry, product and structure. Second, does the file show any behaviour that should have moved the rating and did not.
Testing the screening control
Screening is the control that draws the sharpest testing, because it is measurable. A good auditor goes well past asking whether you run denied party screening at all.
List coverage and version control
Which lists are loaded, and when was each one last refreshed. Sanctions and restricted party lists are amended without warning, so the auditor wants a dated log of list updates, not a vendor brochure. If you screen against the OFAC SDN list but not the wider consolidated lists that trade-facing businesses need, say so in your risk assessment and justify it. The distinctions between restricted and denied parties matter when you set scope.
Match thresholds and tuning evidence
Fuzzy matching runs on a score threshold. Somebody set that number. The auditor asks who, when, on what basis, and what testing supported it. Loosening a threshold to cut alert volume, without documented testing, is a finding every time.
Replay testing
This is the test few firms anticipate. The auditor takes a batch of customers onboarded eight months ago and re-runs them against the list version that was in force on the day they were onboarded. If a name that should have hit did not hit, the control failed retrospectively. Keep list snapshots so you can run this yourself before anyone else does.
Alert disposition quality
Every cleared hit needs a written reason that a stranger can follow. “Not a match” is not a reason. A usable disposition names the discriminating fact: different date of birth, different country of residence, different middle name confirmed against the passport. Weak dispositions are the single most common screening finding, and the fix is a structured form rather than a free-text box. Our guidance on resolving false positives sets out what a defensible clearance note contains.
The KYC audit checklist by control area
| Control area | Evidence requested | Sample basis | Failure that usually appears |
|---|---|---|---|
| Policy and governance | Approved policy, board minutes, version history | Whole population, no sampling | Policy not reapproved after a rule change |
| Customer identification | ID documents, verification records | Stratified by risk tier and onboarding month | Document expired on the acceptance date |
| Beneficial ownership | Shareholder register, ownership chart | All layered or offshore structures | Chain stops at a holding company |
| Risk rating | Scoring model, rating rationale per file | Oversample of high risk and PEPs | Manual downgrade with no rationale |
| Screening | List refresh log, threshold settings | Replay batch plus configuration review | Undated list updates, untuned thresholds |
| Alert handling | Alert log with dispositions | Fastest and oldest clearances | Clearance reason is a single word |
| Periodic review | Due-date report, completion dates | All overdue records | Reviews closed without new evidence |
| Records and logs | System audit trail, retention settings | Targeted, tied to sampled files | Records editable without a trace |
| Training | Attendance and assessment records | Whole staff list, joiners checked | New joiners trained months late |
Record keeping and the audit trail
Retention rules differ by regime, and five years after the relationship ends is a common statutory baseline. Check the rule that applies to you rather than assuming.
What the auditor wants beyond the documents is immutability. Who changed a risk rating, when, and what it was before. If your system lets an operations user overwrite a field with no history, the control is not testable. Practical guidance on what an audit trail must capture and on record keeping for screening will tell you what to configure before fieldwork starts.
Store the screening result, not just the screening date. A line saying “screened, no hits” is thin. A stored result showing the name submitted, the lists queried, the list version, the score and the outcome is evidence.
Common findings and their root causes
- Overdue periodic reviews. Root cause is usually no automated due-date report, so nobody sees the queue until it is months deep.
- Weak enhanced due diligence write-ups. Root cause is a free-text field with no required headings for source of funds and source of wealth.
- Screening not repeated after a customer changed name or address. Root cause is that the update event does not trigger a re-screen.
- Missing evidence for exceptions. Root cause is approval by email rather than in the workflow.
- Training gaps for new joiners and contractors. Root cause is that the training list comes from payroll, which omits contractors.
- Suppliers and intermediaries never screened at all. Root cause is scope defined as customers only.
That last one is worth dwelling on. Many programmes screen customers well and freight forwarders, agents and vendors not at all. If you move goods, the question of who needs screening covers more counterparties than the customer table.
Ratings and closing the corrective action plan
Findings usually carry a severity rating, a named owner and a target date. Ratings differ by firm, but the practical divide is between a design gap, where the control never existed, and an operating gap, where it existed and was skipped. Design gaps need a procedure change. Operating gaps need supervision.
Closure needs evidence, not a status update. For an overdue review finding, closure means the backlog is cleared and a report shows the queue at zero for a sustained period. Auditors re-test closed findings in the next cycle, so a premature closure becomes a repeat finding, and repeat findings attract far more attention than new ones.
Run your own dry run first. Pull twenty files, test them against the table above, and fix what you find before an independent reviewer does. You can start with a free check against current restricted party lists using Globalior’s free screening tool.
Key takeaways
- A KYC audit tests the programme, while a periodic review updates one customer record, and auditors check that reviews happened on schedule.
- The reviewer must be independent of the people who designed and operated the controls, and small firms should document how that independence is achieved.
- Samples are stratified, with high-risk customers, PEPs and layered structures deliberately oversampled.
- Replay testing re-runs historical customers against the list version in force at the time, so keep dated snapshots of every list you screen against.
- A cleared screening alert needs a written discriminating fact, such as a different date of birth confirmed against a document.
- Records must show who changed what and when, because a field that can be overwritten without history cannot be audited.
- Repeat findings carry more weight than new ones, so close corrective actions with evidence rather than a status report.
Frequently asked questions
How often should a KYC audit be carried out?
Annual is the usual expectation for regulated firms, and many supervisors treat it as the floor. The frequency should follow risk. A business that changes products, enters new markets or grows quickly may need a targeted review sooner. Smaller firms with a stable customer base sometimes run a full audit every two years with lighter interim testing in between.
Who can perform a KYC audit?
Internal audit, if it exists and is independent of compliance. Otherwise an external firm or consultant engaged under a written scope. The person cannot have designed, operated or approved the controls under test. In a small business, the owner can commission the review, but should not conduct it themselves if they also approve customer onboarding.
What is the difference between a KYC audit and a regulatory examination?
An audit is commissioned by your own board or by contract, and the report goes to you. An examination is conducted by a supervisor with statutory powers, and the outcome can include formal action. The file testing is very similar, which is why a serious internal audit is the best preparation for an examination.
How many customer files will the auditor look at?
It depends on population size and risk mix rather than a fixed number. Expect a modest sample from a large low-risk population and a much heavier proportion of the high-risk book. If early testing finds errors, the auditor expands the sample instead of extrapolating from a handful of failures.
Does a KYC audit cover sanctions screening?
Yes, and usually in detail. The auditor tests which lists you screen against, how often they refresh, how match thresholds were set, and whether alerts were cleared with a documented reason. For trading businesses, the scope should extend past customers to suppliers, agents and freight forwarders.
What evidence should I keep to prove a control operated?
Dated system output beats a memo. Keep the screening result with list version and score, the due-date report showing review completion, the training attendance record with names, and the approval recorded inside the workflow rather than in an inbox. Anything stored only in email is hard to prove and easy to lose.
How do I prepare for a KYC audit in a small team?
Run a self-test on twenty files using the control table in this article. Fix the gaps you find, write down what you fixed, and keep the working papers. Then make sure your screening runs on a schedule you can prove. You can run a denied party screening check without a procurement cycle and keep the output as evidence.
If you want a second opinion on your screening scope or your evidence pack before fieldwork begins, get in touch with the Globalior team.