The KYC Analyst Role Explained, From Queue to Escalation

A KYC analyst verifies who a customer is, works out how much risk that customer carries, and writes down the evidence for both. The job runs on queues. Alerts arrive overnight, new customer files arrive during the day, and existing customers come up for periodic review on a schedule.

Most descriptions of the KYC analyst role stop at a list of duties. That misses what the work feels like and what actually separates a good analyst from a slow one. The skill is not collecting documents. It is deciding when the evidence is enough, and writing that decision so someone reading it in three years can follow the reasoning.

This covers the daily shape of the job, the decisions an analyst owns, the cases that go wrong, and how the career usually progresses.

Where KYC analysts sit

Banks, payment firms, crypto exchanges, insurers, brokers, lenders and increasingly law firms, accountants and real estate agents all employ them. In a large bank the work is split across specialised teams: one for onboarding, one for periodic review, one for sanctions alerts, one for quality control. In a smaller firm one person does all of it and also drafts the policy.

The reporting line usually runs to a team leader, then to a compliance manager, then to the money laundering reporting officer or equivalent named officer. That named officer is the only person who can file a suspicious activity report. An analyst never files one directly. The analyst gathers evidence and escalates.

A typical day

Morning: clearing the alert queue

Screening runs overnight against updated sanctions, PEP and adverse media data. Whatever it flags is waiting when you log in. Most of those flags are wrong. A customer shares a surname with a listed person, or a company name contains a common word that appears on a list.

The analyst compares the customer record against the list record field by field. Date of birth, place of birth, nationality, address, identification numbers. One clear mismatch on a reliable field usually closes it. The discipline is writing down which field ruled it out, rather than simply marking it cleared. The method behind that is set out in our guide to resolving a false positive in screening.

Middle of the day: new customer files

New files come from the front office or straight from an onboarding portal. For an individual, the analyst checks the identity document, the address evidence, and whether the stated occupation and expected activity hang together. For a company, the work is longer. Certificate of incorporation, register extract, articles, director list, shareholder register, and then the chain upward to the beneficial owners.

Corporate files are where time disappears. A structure with three layers and a trust in the middle can take a full day. The analyst also checks the business rationale. Why does a small consultancy registered six weeks ago need accounts in four currencies? That question is part of the file, and the answer goes in writing.

Afternoon: periodic reviews and chasing

Existing customers are re-examined on a cycle set by their risk rating. The analyst pulls the file, checks whether anything has changed, rescreens, and either confirms the rating or moves it. Much of the afternoon is chasing customers for expired passports and updated ownership information. Customers ignore these requests. Following up is a real part of the job and it is often the least popular one.

End of day: writing

Every decision needs a record. Escalations need a narrative: what was found, what was checked, what remains unexplained, and what the analyst recommends. Weak narratives get bounced back, which costs more time than writing them properly. This is also where the audit trail is built, because the system record is what an examiner will read.

What the analyst actually decides

Four decisions sit with the analyst, and each has a defensible answer rather than a right one.

1. Is the identity evidence sufficient, or is a further document needed?
2. Is this screening hit the same person or entity, or a different one with a similar name?
3. Does the customer’s risk rating match what the file now shows?
4. Is there something here that needs to go to the compliance officer?

The fourth is the one that matters most and the one juniors get wrong in both directions. Escalate everything and you become noise. Escalate nothing and something serious sits unreported in a queue. The working rule is straightforward. If you cannot write a sentence explaining the activity that you would be comfortable defending, escalate it.

Risk tiers and what each one demands

Risk rating drives everything: what you collect, how deep you go, how often you revisit, and who signs off. The exact thresholds are set by each firm’s own policy, but the shape is consistent across the industry.

Risk tier	What the analyst collects	Depth of checking	Review cycle	Who approves
Low	Identity document, address evidence, purpose of the relationship	Standard checks, screening at onboarding plus ongoing monitoring	Longest cycle in the policy	Analyst, sampled by quality control
Medium	The above plus ownership structure and expected activity detail	Standard checks with corroboration of ownership from an independent source	Middle cycle	Analyst with senior review
High	All of the above plus source of funds and source of wealth evidence	Enhanced due diligence, adverse media, corroboration of stated wealth	Shortest cycle in the policy	Senior analyst or compliance officer
Politically exposed	High risk pack plus the public role, its dates, and close associates	Enhanced due diligence with wealth corroborated against the stated role	Shortest cycle, plus event driven review	Senior management sign off
Sanctions match	Full evidence pack for the match decision itself	Immediate hold, no further processing until resolved	Not applicable, handled as an incident	Compliance officer or reporting officer

Two rules juniors learn the hard way

You cannot tell the customer why

In most jurisdictions it is an offence to tip off a customer that they are being investigated for money laundering or that a report may be made. This constrains what an analyst may say. You can ask for a document. You can ask about the purpose of a payment. You cannot say the request came from an alert, or that a report is being considered. New analysts breach this by being helpful, usually in an email trying to explain a delay.

Commercial pressure is part of the job

A relationship manager with a revenue target will push to get a file approved. The answer is never to argue verbally and then give way. Record the request, record your assessment, and escalate the disagreement. Firms operate a four eyes principle for exactly this reason: a second person reviews high risk approvals. If you are overruled, that is legitimate, but the override belongs in the file with a name against it.

The cases that are genuinely hard

• Nominee shareholders. The register names a service company, not a person. You need the nominee agreement or a declaration identifying who stands behind it.
• Trusts. Settlor, trustees, protector and beneficiaries all matter, and a discretionary class of beneficiaries may not be named at all.
• Circular ownership. Company A owns B, B owns C, C owns A. No natural person emerges, so the policy falls back to senior managing official.
• Jurisdictions with no public register. Nothing is verifiable independently, and you decide what alternative evidence will do.
• Customers who stop responding mid review. The file expires. Policy usually requires restriction or exit, and analysts delay this because it upsets the front office.
• Ownership below the threshold but control above it. A person holds a small stake yet appoints the board. Control matters as much as percentage.

Behavioural signals sit alongside the structural ones. Reluctance to identify an owner, sudden changes in shipping routes, or a customer who insists on speed are all worth noting. The patterns in our note on red flags of sanctions evasion come up regularly in corporate files.

Skills, tools and qualifications

Degrees in finance, law, accounting or economics are common, but no regulator prescribes a specific qualification for the KYC analyst role. Firms hire on judgement and attention to detail. Language skills are genuinely valuable, because reading a register extract or a company document in its original language removes a dependency and a delay.

Analysts work across three system types daily: a case management platform holding the queue and the decision record, a screening tool covering sanctions, PEP and adverse media data, and public sources such as company registers. Spreadsheet skill matters more than people expect, because reconciling an ownership chain by hand is common.

Certifications carry weight at promotion time rather than at hiring. Specialist anti money laundering credentials from recognised industry bodies are the usual route, and sanctions specific qualifications help if you want that path. If your firm also moves goods, broader trade compliance certification widens the options considerably.

What separates a good analyst

Speed is easy to measure, so firms measure it. Quality is what actually gets noticed. Four habits show up in the analysts who get promoted.

• They write the rationale, not the conclusion. “Cleared, date of birth differs by eleven years and nationality does not match” beats “not a match”.
• They record what they could not find. Negative evidence protects the firm, because an examiner can see the search was done and came back empty.
• They notice patterns across files, where most people look only within one. Three unrelated customers sharing a registered office address is a finding.
• They read the source document rather than the summary field a colleague typed into the system.

The test to apply to your own work is simple. Read your note back and ask whether a reviewer with no memory of the case could reach the same conclusion from it alone. If not, it is not finished.

Career path and adjacent moves

The standard ladder runs from junior analyst, handling alert dispositions and straightforward files, to senior analyst owning enhanced due diligence and complex structures, then to team lead or quality reviewer, then to compliance manager or reporting officer. Pay varies widely by country, by firm type and by whether the role sits in a shared service centre or a headquarters function, so treat any single published figure with caution.

Sideways moves are often faster than upward ones. Sanctions specialist, fraud analyst, financial crime investigator and trade compliance are all reachable from a KYC base. Trade compliance is the least obvious and one of the most open, because firms that move goods need people who can screen counterparties against export control lists as well as sanctions lists. Analysts who understand denied party screening alongside AML checks are scarce.

Automation has taken the mechanical parts. Data extraction from documents, first pass alert filtering and register lookups are increasingly handled by software. What remains is judgement on ambiguous evidence, corporate structures that resist automation, and writing a decision that stands up to review. Those are the parts worth getting good at.

Key takeaways

• A KYC analyst verifies identity, assesses risk, documents the evidence and escalates what cannot be explained. They do not file suspicious activity reports themselves.
• The work arrives as queues: overnight screening alerts, new onboarding files, and periodic reviews driven by risk rating.
• Most screening alerts are false positives, and clearing them means comparing fields and recording which one ruled the match out.
• Risk tier determines what is collected, how deep the checking goes, how often the file is revisited and who signs it off.
• Tipping off rules limit what an analyst may tell a customer, and breaching them is a legal risk rather than a procedural one.
• Corporate files with nominees, trusts or circular ownership are where the real difficulty sits, not individual onboarding.
• Trade compliance is an underused adjacent career path, because export control screening skills are less common than AML skills.

Frequently asked questions

Is a KYC analyst the same as an AML analyst?

They overlap and small firms combine them. A KYC analyst focuses on the customer: who they are, what they own, what risk they carry. An AML analyst focuses more on transactions and behaviour after onboarding. A sanctions analyst is narrower again, working only on list matches. Job titles vary between firms, so read the responsibilities rather than the label.

What qualifications do I need to start?

No regulator mandates a specific qualification. A degree in finance, law, accounting or economics is the common entry route, but firms hire graduates from other disciplines who show analytical care. Industry anti money laundering certifications matter more at the promotion stage than at hiring. Additional languages and comfort reading company registers are genuine advantages for entry level candidates.

How many files does an analyst handle in a day?

It depends entirely on the work type. Simple alert dispositions move quickly. A straightforward individual onboarding takes well under an hour. A corporate file with layered ownership can take a full day or longer, and a case involving source of wealth for a high risk customer can run across several days. Firms that set a single throughput target for all file types tend to get poor quality.

What happens if a customer refuses to provide documents?

The analyst escalates rather than deciding alone. Policy typically requires the relationship to be restricted and, if the position is not resolved, exited. Refusal itself can be a reportable indicator, so the file must record the request, the refusal and the dates. Quietly leaving the file incomplete is the worst outcome and the one most often found in audits.

Do KYC analysts screen for export controls too?

In financial institutions, usually not. In firms that move physical goods, increasingly yes, because the same counterparty needs checking against export control lists as well as sanctions lists. Those lists are separate and many AML tools do not carry them. You can see the difference by running a name through Globalior’s free screening tool and comparing what comes back.

Is the role at risk from automation?

The mechanical parts are already automated. Document data extraction, first pass alert filtering and register lookups need less human time each year. What has not automated is judgement on incomplete evidence, unpicking deliberately opaque ownership, and producing a written decision that survives examination. Analysts who build those skills stay in demand. Those who only clear simple alerts are more exposed.

If you are building an onboarding process from scratch, our guide to sanctions screening in customer onboarding sets out the sequence. To test a counterparty now, run a free denied party screening check, or contact the Globalior team to talk through how your screening is set up.