Client lifecycle management in KYC: one file per client, not per desk

Client lifecycle management in KYC is the practice of managing a client's due diligence as one continuous file, from onboarding through every new account, change and review to exit, across all the entities in its group and all the desks that serve it. In a commercial bank the alternative is common: treasury services opens a file, lending opens another, a new subsidiary gets a third, and nobody holds the whole picture. The rules have moved toward the client-level view, most recently with FinCEN's February 2026 relief on repeat ownership checks, and enforcement has repeatedly found the per-desk view wanting. Botminds' Corporate KYC builds one file per corporate client across entities, owners and products, and keeps it current as the client changes.

The worked example is a fictional bank and client, Corvane National Bank and Brightwater Cold Chain Holdings, a Delaware holding company with four subsidiaries, as the file runs through the solution. Regulatory sources are linked where they are used; one standards-body document, from the Wolfsberg Group, is cited as guidance only.

What is client lifecycle management in banking?

Client lifecycle management, CLM, is the set of processes and systems a bank uses to run a client relationship from onboarding to offboarding: collecting and verifying information, opening accounts and products, keeping the data current, reviewing the relationship and closing it. In commercial and corporate banking, KYC is the heaviest part of CLM, and "CLM KYC" usually means the KYC file managed as part of that lifecycle rather than as a one-off onboarding task.

The distinction matters because the rules are written around moments. CIP applies when a customer "opens a new account"; the beneficial ownership rule applies "at the time a new account is opened"; ongoing due diligence applies all the time, "on a risk basis." A bank organised around account openings tends to do the first two well and the third poorly. A bank organised around the client does the third by design.

Why the unit of KYC should be the client, not the account

The unit of KYC should be the client because risk travels across a client's accounts and entities, and a per-account file cannot see it. The clearest public case is old but exact. In its 2017 order against Deutsche Bank, part of a $425 million penalty over mirror trades that moved more than $10 billion out of Russia, the New York regulator found that "virtually all of the KYC files for the counterparties implicated here were insufficient," and named a structural cause.

Because no central repository for KYC information existed at Deutsche Bank, when the Bank suspended a counterparty for suspicious trading, a related counterparty was able to get onboarded and resume trading activity without raising any red flags.

New York State Department of Financial Services, consent order with Deutsche Bank AG, January 30, 2017

The same order found that "nor were any steps taken to periodically review and verify clients once brought in." Both failures are lifecycle failures: no single place where a client and its relatives are known, and no process that keeps the file alive after onboarding. A per-desk model reproduces both by default, because each desk's file starts and ends with its own account.

Do we need new KYC for each account of an existing client?

No, not in full, and since February 2026 not even for beneficial ownership, if the bank chooses. Under the CIP rule a person who already has an account with the bank is not a new "customer", as long as the bank already reasonably believes it knows who that person is (31 CFR 1020.100). The beneficial ownership rule, read literally, still asks for identification "at the time a new account is opened," but FinCEN's exceptive relief order FIN-2026-R001 lets a bank limit it to the client's first account, to any later moment when it learns facts that give it reasonable cause to doubt what it holds, and to what its risk-based ongoing due diligence requires (FIN-2026-R001; the order is read in full in FinCEN's 2026 CDD rule relief).

FinCEN's reasoning is the client-level argument in its own words. Repeating ownership checks at each new account, it wrote, "may generate useful information beyond what those core obligations of the 2016 CDD Rule already reveal, but is increasingly inconsistent with FinCEN's risk-based approach." The order quotes industry comments asking for the rule to be applied "at a customer versus account level," one of which observes that "many large corporate customers … frequently open new accounts." The relief is optional, and when a bank does re-identify under ongoing due diligence it may rely on earlier information if the client confirms it, verbally or in writing, provided it keeps a record of the confirmation (FinCEN CDD FAQs, D.3).

The relief rewards the bank that already knows its client. Relying on a confirmation is safe only if the bank would notice facts that contradict it: a new owner in a registry extract, a new subsidiary in the client's statements, activity the profile cannot explain. Those facts usually surface on a different desk from the one opening the next account.

How to manage KYC across subsidiaries and affiliates

Manage KYC across subsidiaries by mapping the whole group once, deciding which entities are customers, and screening every entity that will transact, whether or not it holds an account. A subsidiary that opens its own account is a customer in its own right, with its own CIP and, unless excluded, its own ownership certification. A subsidiary that only sends or receives money through the parent's accounts is not a customer, but it is a party the bank needs to know.

Three rules help with groups. A US subsidiary at least 51% owned by a company listed on the New York or American Stock Exchange or the Nasdaq National Market falls outside the legal entity customer definition through 31 CFR 1020.315, so it needs no ownership certification of its own (31 CFR 1020.315). A bank may rely on another regulated financial institution, "including an affiliate," to perform the beneficial ownership work, if reliance is reasonable and the affiliate signs a contract with an annual certification (31 CFR 1010.230(j)). And sanctions screening reaches every entity that transacts, which is why Corvane's standard says every entity that will transact through it is screened before approval.

The sample file shows why that last rule matters. Brightwater's parent and its three US subsidiaries were screened on day 1. Its fourth subsidiary, a Mexican company formed in 2025, appeared in the entity chapter but not in the screening register, and only became urgent when the client's reply showed it would receive about $6.5 million a month in wires. The Checker agent caught it by reading the chapters against each other. In a per-desk model the subsidiary would have been someone else's problem.

Correspondent and affiliate relationships inside a banking group

Relationships between a bank and its own foreign affiliates are still correspondent relationships, and the due diligence rule does not relax for family. The correspondent rule requires a due diligence program for foreign financial institutions that is specific and risk-based, enhanced where needed, that weighs among other things what kind of account it is, what it is for and the activity expected through it, and that reviews that activity periodically (31 CFR 1010.610).

In October 2026 the OCC found that, before August 2024, Bank of America "failed to collect required information regarding correspondent accounts that the Bank maintains for its foreign branches and affiliates," and had leaned, wrongly, on simplified due diligence that could not capture the different BSA/AML risks of those foreign offices (OCC, AA-ENF-2026-41). The lesson for CLM is the same as for corporate clients: a relationship inside the group is still a relationship, and its file needs the same evidence.

The cost of getting group relationships wrong shows up as de-risking. BIS researchers found that the number of correspondent banks fell 20% between 2011 and 2018, even as payment values rose, and that about 22% of correspondent banks terminated active relationships for reasons related to compliance and reputation (BIS Quarterly Review, March 2020). One file per client is also how a bank keeps a relationship it can defend instead of closing one it cannot.

One file per client changes how refresh works

With one file per client, refresh becomes event-driven rather than desk-driven. FinCEN says the duty to update information arises when normal monitoring brings something about the customer to the institution's attention, and that periodic reviews "are not by themselves a trigger" to update beneficial ownership (FAQ B.18). Regulators have ordered banks to build those triggers: the OCC's 2024 order against TD Bank required the bank to collect fresh information whenever an event suggested it would be prudent to do so (OCC, AA-ENF-2024-77; more such orders are collected in the trigger events regulators have named).

Event triggers only work when the event lands in the file that needs it. A new subsidiary in a lending desk's covenant package, a change of control in a registry extract, or a jump in wires seen by treasury services each belongs in the one client file. The Wolfsberg Group, a banks' standards body, makes the same recommendation in its 2022 guidance on digital customer lifecycle management: move away from fixed refresh cycles towards reviews set off by events (Wolfsberg Group, 2022). That is guidance, not a US rule; the US rule is that updates are risk based.

What a CLM system holds, and what the KYC file still has to prove

A CLM system holds the workflow; the KYC file holds the evidence. Most commercial banks run onboarding through a client lifecycle management platform that opens and closes cases, routes tasks and writes back approvals. What examiners test is the content: whether the bank understood the client and built that understanding into the risk profile. A CLM platform with a perfect audit of who clicked what can still carry a file that does not explain the client.

In Corporate KYC the CLM system remains the system of record for cases: files open and close there, and approvals are written back. The KYC file sits beside it as the evidence, one per client, with every sentence cited to its source.

The client lifecycle management analyst: the seat that keeps the file current

A client lifecycle management analyst keeps clients' files current between onboarding and exit: processing changes, running periodic and event-driven reviews, and coordinating new accounts for existing clients. In many banks the role sits next to, or inside, the KYC team, and the skills overlap with what a KYC analyst does day to day. The difference is time horizon: the onboarding analyst gets the file right once; the CLM analyst keeps it right for years.

That seat benefits most from one file per client. When a client's treasurer is asked once, for only what is missing, and the request lists what is already on file, the client sees one bank rather than several desks. On the sample file the Outreach agent sent exactly such a request, and the relationship manager saw progress in his CRM but no ratings or screening results.

One request to the client, with what is already on file listed and not asked again

One file per client in Corporate KYC

In Corporate KYC every corporate client has one file of seven chapters and six appendices: entity and registrations, ownership and control, nature and purpose, expected activity by product, screening, risk rating and approval, with the structure chart, screening register, client request, checker's notes, rating worksheet and sign-off sheet behind them. The Registry agent keeps extracts for every entity in the structure under 90 days old; the Ownership agent maintains the structure and who must be identified; a change in one chapter reopens the chapters that depend on it.

The ownership and subsidiary map that one file keeps for the whole group

A bank weighing whether its own files work this way can test it cheaply on closed files; how to run that test is set out separately. To see the file itself, start from Corporate KYC.

Questions people ask

What does CLM KYC mean?

CLM KYC means KYC run as part of client lifecycle management: one due diligence file per client, kept current through new accounts, changes and reviews, rather than a separate onboarding file for each account. It is common wording in commercial and corporate banking, where clients have many entities and products.

What is a CLM system in a bank?

A CLM system is the platform that runs the client lifecycle: it opens onboarding cases, routes tasks between the relationship manager, KYC and operations, tracks service levels and writes back approvals. It holds the workflow; the KYC evidence still has to show the bank understood the client.

Does a new account for an existing business client need a new beneficial ownership certification?

Not if the bank adopts FinCEN's February 13, 2026 relief: identification and verification can be limited to the first account, doubtful facts and risk-based ongoing due diligence. Even before the relief, FAQ D.3 let a bank rely on the earlier certification if the client confirmed it was current and the bank recorded the confirmation.

Can a bank rely on its affiliate's KYC for a shared client?

For beneficial ownership, yes, within limits: 31 CFR 1010.230(j) allows reliance on another regulated financial institution, including an affiliate, if reliance is reasonable and the affiliate contracts to certify annually that it has an AML program and performs the work. The relying bank remains responsible for its own program.

Is a parent company's KYC enough for its subsidiaries?

Not for a subsidiary that opens its own account: it is a separate customer. A US subsidiary at least 51% owned by a listed parent is outside the ownership certification, but still needs CIP, and any subsidiary that transacts through the relationship should be screened.