How to Run a KYC Remediation Project Without It Stalling

A KYC remediation project brings an existing customer book back up to current standards. You scope the population, work out which files are incomplete or stale, chase the missing information, rescreen everyone, and either fix the file or exit the relationship. The work is unglamorous and mostly operational. It is also where most compliance programmes fail.

Remediation is different from onboarding. At onboarding you hold the upper hand, because the customer wants something from you. In remediation you are asking an existing customer to do unpaid administrative work for no obvious benefit. Response rates reflect that. Plan for the majority of your first outreach wave to go unanswered.

This is a project management problem wrapped in a compliance problem. The compliance standard is usually settled within a week. Everything after that is data, contact, throughput and decisions.

What triggers a remediation

Knowing the trigger shapes the scope, the deadline and how much discretion you have. Five causes cover most projects.

A regulator finding. An inspection, a section 166 style skilled person review or a supervisory letter names specific defects. The scope and the deadline are set for you.
A rule change. New beneficial ownership thresholds, a new source of wealth expectation or a change in the treatment of a customer category.
An acquisition or migration. You inherit a book built to someone else’s standard, or fields get lost moving between systems.
Internal audit or quality assurance results. Sampling shows a failure rate that cannot be explained away.
Backlog on periodic review. Reviews slipped, and the overdue queue grew past the point where business as usual can absorb it.

Write the trigger down in the project charter. When someone later asks why a particular cohort was included, the answer should come from the charter rather than from memory.

Step one: define what a complete file looks like

Do this before you touch the data. A remediation without a written target standard turns into an argument that runs for months.

Build a field level standard per customer type. For an individual, that usually means full legal name, date of birth, residential address, nationality, an identity document with number and expiry, tax identifier where required, occupation, expected activity, PEP status and screening result. For a company, add legal form, registration number, registered address, ownership structure to the beneficial owner threshold, directors, authorised signatories, business activity, countries of operation and the screening result for each named party.

For every field, record three things. What is acceptable evidence. How old the evidence may be. Who signs it off. That third column is the one people forget, and it is what stops files bouncing between teams.

Decide your position on grandfathering explicitly. If a customer was onboarded correctly under the old standard, do you apply the new standard retrospectively? Sometimes the regulator has answered that. Where it has not, write your answer down and apply it consistently.

Step two: profile the data before you promise a date

Run an automated gap analysis across every system that holds customer records. The core banking or CRM system is rarely the only one. Document management, the onboarding tool, scanned mail, shared drives and the sanctions screening system all hold fragments.

Produce a matrix of customers against required fields, with each cell marked present, present but expired, missing, or contradicted by another system. The contradiction category matters more than teams expect. Two different addresses for the same customer in two systems is a data problem you must resolve before outreach, because writing to the wrong address burns a contact attempt.

Only after the matrix exists should anyone commit to a completion date. Estimate from measured throughput. Take a sample of one hundred files, work them properly, and time the work. That gives you a defensible cases per analyst per day number for each cohort. Multiply out. Do not accept a date set by working backwards from when the regulator wants it finished.

Step three: segment the population

Segmentation is what makes a large remediation finishable. Cut the book on two axes. Risk rating on one, and gap severity on the other. That gives you a grid, and the grid tells you the order of work and the treatment each cohort gets.

Cohort	Typical gap	Treatment	Owner
High risk, material gaps	No source of wealth, unmapped ownership, stale screening	Full refresh, analyst led, relationship manager makes contact, senior sign off	Senior analyst plus named approver
High risk, minor gaps	Expired identity document, missing tax identifier	Targeted request for the single missing item, rescreen, refresh risk rating	Analyst
Low or medium risk, material gaps	No verified identity evidence on file at all	Digital self service outreach, escalate to manual chase on non-response	Operations team
Low or medium risk, minor gaps	Stale address, missing occupation field	Bulk digital request, fill from reliable internal data where policy permits	Operations team, automated
Dormant or zero balance	Everything stale, no recent contact	Decide closure policy first, remediate only what survives that decision	Project lead plus legal

Add a do not touch list. Customers already in an open investigation, subject to a reported suspicion, in litigation with you, or flagged by the financial crime team should be routed to that team rather than sent a standard letter. A bulk mailshot that reaches a customer under active investigation is a serious problem.

Step four: rescreen before you write

Screening comes before outreach, not after. It is cheap, it needs no customer cooperation, and it can change the whole treatment of a file. Run every named party through sanctions and restricted party lists, then PEP and adverse media.

Screen the full cast, not the account name. That means the legal entity, its beneficial owners above your threshold, directors, authorised signatories and, for trade customers, the freight forwarders and intermediaries in the chain. You can pull a baseline quickly by running the counterparty list through a free denied party screening tool before the analyst work starts.

Expect a spike in false positives. A book that has not been screened for years will match against list entries added since. Tune the matching threshold on a sample first, and use date of birth, country and registration number to discard the noise. Set the frequency for the future as part of the project, using the same logic as any decision about how often to screen suppliers and customers.

Step five: design the outreach properly

Outreach is the slowest part and the one most often designed badly. Three rules make the difference.

Ask once, ask for everything

Build the full list of missing items per customer before the first contact. A customer who supplies a passport, then gets asked for proof of address two weeks later, then for a source of funds statement after that, will stop responding. One consolidated request, with a named contact and a deadline, outperforms a sequence of small ones.

Run waves, not a single mailout

Send in batches sized to the capacity of the team that handles the replies. If you mail the whole book on day one, the replies arrive faster than you can process them, and the customers who did cooperate get ignored. A wave size tied to daily processing capacity keeps the queue flat.

Write a contact ladder and follow it

First request through the customer’s preferred channel, with a clear deadline and a self service upload link.
Reminder after the deadline, through a second channel.
Relationship manager or account owner calls, where one exists.
Formal written notice setting out what happens if there is no response.
Restriction on the account or relationship, applied under your contractual terms.
Exit, following the notice period in the contract.

Log every attempt with the date, the channel, the address used and the outcome. That log is the evidence that the exit decision was fair, and it is the first thing a complaints team or an ombudsman will ask to see.

Step six: exit decisions

Non-response is not the same as suspicion, and the two need different handling. A customer who has moved abroad and ignores post is a service problem. A customer who refuses to explain an ownership structure is something else.

Before any exit, check three things. Whether the contract lets you terminate and on what notice. Whether the facts require a suspicious activity report to the financial intelligence unit. Whether any account is subject to a restriction that survives closure.

Where a report is filed, tipping off rules apply. You cannot tell the customer that a report has been made, and the wording of any exit letter has to respect that. Get the template reviewed by legal once, then reuse it. Never let analysts improvise exit wording.

Set a threshold for exit at which the decision leaves the analyst. Something like a two person rule, with a committee for anything above a defined revenue or exposure level. Blanket exits of whole customer categories draw regulatory criticism, so decisions should be individual and documented.

Step seven: quality assurance, reporting and prevention

Sample completed files continuously rather than at the end. A fixed percentage of each analyst’s output, reviewed against the field standard, with results fed back weekly. Errors found in week two cost far less than errors found in month six, because the same error is usually sitting in several hundred other files.

Report on a small number of measures. Files closed against plan. Open queue by cohort. Outreach response rate by wave. Exit decisions taken. Screening alerts open and aged. Plot the burn-down against the committed date every week, because a flat week is visible immediately on a chart and invisible in a paragraph.

Keep the evidence trail intact. Every file should show the gap identified, the request sent, the response received, the verification performed, the screening result with list version and date, the risk rating and the approver. Good screening record keeping and a clean audit trail are what turn a finished project into a defensible one.

Stopping the next remediation

A remediation is a symptom. Fix the cause during the project, while you have the budget and the attention.

Move from calendar based periodic review to event driven review. Trigger on a change of ownership, a new country of operation, a document expiry, a screening alert or a sharp change in activity.
Make the onboarding form collect the fields the standard requires, so new customers never enter the book incomplete.
Store document expiry dates as structured data, not as scanned images, so the next gap analysis takes hours rather than weeks.
Run continuous screening instead of point in time checks, and fold the results into the customer risk rating automatically.
Tighten the sanctions screening you do at customer onboarding so the same defects stop entering the book.

A short checklist helps the team apply the standard consistently. The structure of a denied party screening checklist works well as a model for the screening portion of the file.

Key takeaways

Write the target file standard field by field, with acceptable evidence, age limits and named approvers, before you touch any data.
Profile the data and measure throughput on a sample of one hundred files before committing to a completion date.
Segment on risk rating and gap severity, and give each cohort a defined treatment and owner.
Rescreen every named party before outreach, because screening needs no customer cooperation and can change the treatment of a file.
Consolidate requests into a single ask per customer and run outreach in waves matched to processing capacity.
Document every contact attempt, because that log is what justifies a later restriction or exit.
Fix the cause during the project by moving to event driven review and continuous screening.

Frequently asked questions

How long does a KYC remediation project take?

It depends on population size, gap severity and how much of the work can be automated. The reliable method is to time a sample of one hundred files, derive a cases per analyst per day figure for each cohort, and multiply. Outreach response time, not analyst capacity, is usually the binding constraint on large retail books.

What is the difference between remediation and periodic review?

Periodic review is business as usual. Each customer is refreshed on a cycle set by their risk rating, absorbed into normal operational capacity. Remediation is a one off project that fixes a defect across a defined population, usually with its own budget, governance and deadline. A remediation that never ends is a periodic review process that is not working.

Can we close accounts if customers do not respond?

Usually yes, if your contractual terms allow it and you have followed a documented contact ladder with reasonable notice. Check the consumer protection and account access rules in each jurisdiction first, since some restrict closure of basic accounts. Record the attempts made and the reason for the decision on the file before the closure letter goes out.

Should we use automation or more analysts?

Both, for different parts. Automation handles gap detection, document data extraction, screening, matching and status reporting well. Judgement work stays human. That means source of wealth assessment, ownership structure analysis, alert disposition and exit decisions. Automating the detection layer usually shortens the project more than adding analysts to the review layer.

Do we have to tell customers why we are asking?

Give a plain explanation that you are required to keep customer records current under anti money laundering rules. That improves response rates. You must not disclose that a suspicious activity report has been made or is contemplated, because tipping off rules prohibit it. Keep the standard outreach template and any exit wording clearly separate.

Does remediation apply outside banking?

Yes. Lawyers, accountants, trust and company service providers, real estate agents and payment firms all face the same obligation. Exporters and trading companies run the equivalent exercise on counterparty records, refreshing end user information and rescreening the customer and supplier file. The mechanics of scoping, outreach and evidence are the same.

Start with the part you can do without asking anyone for anything. Run your customer and supplier list through Globalior’s free screening tool to see where the restricted party exposure sits, then talk to the Globalior team about scoping the rest. You can also read more about how a denied party screening programme fits alongside a KYC refresh.