A KYC audit checklist for a corporate file should test two things before anything else: whether the file contains enough information to understand the nature and purpose of the relationship, and whether that information, beneficial ownership included, actually shaped the customer's risk profile. Those are the two questions the FFIEC examination procedures put to every sampled file. A checklist that only confirms documents were collected tests neither, and enforcement orders show files passing that kind of checklist and failing an examiner. Botminds' Corporate KYC is built so the stronger checklist can be answered from the file itself: every line cites its source, every judgement carries a name and a reason, and every version is kept.
The sample file used throughout is fictional: Corvane National Bank's KYC file on Brightwater Cold Chain Holdings, as it runs through the solution. The examination procedures and enforcement findings are real and linked.
What a KYC audit tests, in the examiner's words
A KYC audit tests whether the bank's customer due diligence works, not whether its forms are complete. The FFIEC's CDD examination procedure sets the test in one sentence. On the basis of a risk assessment, prior examination reports and the bank's audit findings, examiners "select a sample of customer information. Determine whether the bank collects appropriate information sufficient to understand the nature and purpose of the customer relationship and effectively incorporates customer information, including beneficial ownership information for legal entity customers, into the customer risk profile" (FFIEC BSA/AML Manual, CDD examination procedures).
Two verbs carry the weight: "understand" and "incorporates." The first asks whether a reader of the file could explain what the client does and how it will use the bank. The second asks whether that explanation changed anything: the rating, the monitoring baseline, the review cycle. An internal audit or a QC review that asks the same two questions of every corporate file is doing what the examiner will do.
The KYC audit checklist for a corporate file
The checklist below has twelve tests, grouped as the file is: the entity, the owners, the relationship, the screening, the rating and the decision. Each one can be answered yes or no from a well-built file without asking the analyst.
Twelve tests for a corporate KYC file, in the order an examiner reads it
- The entity’s name, address and TIN were obtained before the account opened
And existence was verified, by documents or non-documentary methods, with the method and result recorded (31 CFR 1020.220).
- Every entity in the structure that transacts is identified and screened
Not only the account holder: a subsidiary receiving wires is a party the bank must know.
- The ownership certification names each 25% owner and one control person
Or records the exclusion that removes the requirement, with its basis (31 CFR 1010.230(d)–(e)).
- The certification agrees with the ownership documents
Stock register, operating agreement, trust and fund look-throughs; any contradiction is resolved in writing.
- Each owner and the control person were verified, with the method recorded
Including the resolution of each substantive discrepancy (31 CFR 1010.230(i)).
- Nature and purpose explain the business and the relationship in specific terms
A reader could say what the client does, for whom and why it banks here.
- Expected activity is stated by product, in figures, from current documents
And it was loaded as the monitoring baseline, not replaced by early activity.
- Every screening match was cleared on identifiers or escalated
With who decided, when and why; true matches went to the sanctions function.
- The risk rating cites a source for every factor
And any override has a reason and a second approval.
- The rating reflects what the file found
International exposure, ownership through funds, cash or third-party payments appear in the factors.
- Maker and checker are different people, and both are named
With the time and the version each signed; high-risk files carry the second line’s approval.
- The file is complete for the auditor without the analyst
Every version, source, dispute and decision is retrievable for the retention period.
Tests 6, 7 and 10 are the ones a document checklist skips, and they are where the large findings sit. Why expected activity is the figure examiners return to is covered separately; the short version is that a profile no one compared with real activity is the gap in the biggest recent orders.
How do examiners test CDD on a sample of files?
Examiners test CDD by transaction testing: they draw a sample of customers, read the files and judge the process through them. The CDD procedure asks for "a sample of customer information" chosen on risk. The CIP procedure is more specific: a sample of accounts opened since the last examination, covering consumers and businesses, and on a risk basis accounts opened with the TIN-applied-for exception, with documentary and non-documentary methods, higher-risk accounts, accounts "opened with incomplete verification information," and accounts opened through third-party agents (FFIEC, CIP examination procedures).
For each sampled CIP account the examiner checks five things: that the identifying information was obtained before opening; that identity was verified "at account opening, or within a reasonable time after"; that unverifiable cases were resolved and SARs filed where appropriate; that the bank kept the verification results, discrepancies included; and that the name was compared with government lists. The beneficial ownership procedure samples new accounts opened for legal entity customers and runs the parallel checks on owners (FFIEC, beneficial ownership examination procedures).
The examiner's judgement is about the process. The FFIEC's CDD overview tells examiners to judge, above all, whether the bank's way of building customer risk profiles works, using individual files to test that process; where the process is effective and was followed, individual risk decisions are not criticised absent bad faith or a wider failure (FFIEC, CDD overview). A file that shows its reasoning lets the examiner see the process working.
How many KYC files do examiners sample?
There is no fixed number. The FFIEC procedures say the sample is chosen "on the basis of a risk assessment, prior examination reports, and a review of the bank's audit findings," and size it to the bank's risk; they do not set a count. What a bank can control is its own QC and audit sampling, and there the arithmetic is simple and worth knowing.
What a clean random sample of corporate files proves, at 95% confidence
9.5%
upper bound on the error rate if 30 files are tested and none fails
4.9%
upper bound if 60 files are tested and none fails
3.0%
upper bound if 100 files are tested and none fails
The numbers argue for a risk-stratified sample rather than a large flat one. Sixty clean files tell a QC lead that fewer than about one in twenty files fails the test, but only for the population sampled. A bank with a small number of high-risk corporate files should sample them separately and heavily, because that is where an examiner will look first.
The anatomy of a defensible corporate KYC file
A defensible file shows, for every statement in it, five things: the claim, its source, the check it passed, the person who accepted it and the version that person signed. An auditor who can trace any line through those five links can test the file without interviewing anyone. The sample file's Mexico wires show the chain.
One line of a corporate KYC file, traced through the five links an auditor needs
1 · Claim
Brightwater sends about 22 wires a month to Mexico, about $6.5M.
One sentence in the expected-activity chapter
2 · Source
FY2025 audited statements and the client’s signed Mexico activity form
Numbered, opened at the passage, dated
3 · Check
Re-read against the bank standard’s clause on the latest statements: holds
By a checker that cannot edit
4 · Decision
Signed by the analyst as maker, 3:51 p.m., with the attestation
A named person, a time, a reason where one is needed
5 · Version
Chapter 4, second version; the first, on FY2024 statements, kept
Nothing overwritten; every version in the pack
The reason the chain matters is the third link. A checklist confirms that a chapter exists; a check confirms that it holds against the bank's own standard and against the rest of the file. On the sample file the first version of this chapter existed, was well written and cited its source, and was wrong for the purpose: the statements predated the client's Mexican subsidiary. The check, not the checklist, caught it.
Findings a better KYC audit would have caught
Enforcement orders are the best catalogue of what a KYC audit should have found. Each finding below matches one of the twelve tests above, and none of them would have failed a list of documents.
What regulators found, and the audit test that catches it
The finding: Written procedures "only set forth a requirement to collect documents … without requiring further evaluation of those documents."
The test that catches it: Test 6: nature and purpose in specific terms, which cannot be met by collection alone.
The finding: Missing data was given low risk sub-scores, and of about six million customer-risk scores not one came out high.
The test that catches it: Tests 9 and 10: every factor sourced, and the rating reflects what the file found rather than what it lacks.
The finding: Where questionnaires were incomplete, staff were told to fill the gaps by asking account officers instead of the customers.
The test that catches it: Test 4 and the source link: each figure traced to a client document, not to a colleague’s note.
The finding: High-risk reviews called activity "reasonable" whenever it looked like it fitted the customer’s business model.
The test that catches it: Test 10 and the reason link: a judgement must state why, beyond consistency with the business.
The USAA finding is worth reading twice. The bank's model did not fail for lack of a rating; it failed because missing information was treated as low risk, so the ratings looked complete. A KYC audit that checks only whether every file has a rating would have passed every one of those six million files.
What is a KYC quality check, and how does it differ from an audit?
A KYC quality check is the review of each file before approval, by someone other than the person who prepared it; a KYC audit is the independent test of the whole process afterwards, on a sample. The AML program rule requires "independent testing for compliance to be conducted by bank personnel or by an outside party" as one of the program's pillars (31 CFR 1020.210). Regulators have also ordered quality control explicitly: the OCC's 2024 order against TD Bank listed "a quality control process" among the elements of the CDD program it required (OCC, AA-ENF-2024-77).
Three reviews of a corporate KYC file, and what each one is for
| Review | Who | When and how many | The question it answers |
|---|---|---|---|
| Quality check | QC reviewer, first line; second line for high risk | Every file, before approval | Is this file complete, consistent and signed, and may the bank open the relationship? |
| Independent testing (KYC audit) | Internal audit or an outside party | Periodically, on a risk-based sample | Does the bank’s process produce files that meet its standard and the rules? |
| Examination | Federal or state examiners | At each exam, on a sample they choose | Does the bank understand its customers and use that understanding? |
The three reviews should use the same tests. When QC applies a different standard from audit, files approved on Monday fail on Friday, and the gap becomes the finding. In Corporate KYC the QC reviewer's checklist is the bank's: every chapter signed, no open checker note, every party screened, owner and control person verified, the rating with its evidence, the client request closed.
The QC reviewer's checklist on the sign-off sheet
Evidence that must outlast the file: signatures, versions and retention
An audit can only test what survives, so the file's evidence has to last as long as the rules require and be retrievable without the people who made it. The beneficial ownership rule keeps the identifying information, including the certification, for five years from the day the account closes, and the verification records, including how each substantive discrepancy was resolved, for five years from the day each record is created (31 CFR 1010.230(i); the corporate KYC documents list maps each document to its clock). The CIP rule uses the same two clocks.
Retention is the minimum. What makes the evidence useful is versioning: a file that overwrites the first draft of a chapter loses the record of what the bank believed before the client's reply, and an auditor cannot see that the check worked. In Corporate KYC entries on the audit trail are never edited, every chapter version is kept, and Corvane's policy keeps the trail five years after the relationship ends.
The audit trail and examiner pack in Corporate KYC
The audit trail records who did what, when, why and on which evidence, for people and agents alike, chapter by chapter. From it the solution builds a pack per audience: one for the OCC examiner with every chapter, source, signature, checker note, the screening register and the rating worksheet, identifiers masked; one for internal audit with maker and checker per chapter, overrides with reason codes, agent and model versions and timings against service levels; one for the BSA officer with disputes, clearances, rating changes and every request sent to the client.
The audit trail, and an examiner pack built from it
A bank deciding whether its files would pass this checklist can find out on its own closed files before buying anything; how to run that pilot is set out separately, and the document behind each field is mapped in its own guide. To see the trail and the packs, start from Corporate KYC.
Questions people ask
What is a KYC audit?
A KYC audit is an independent test of whether a bank's customer identification and due diligence work as designed and meet the rules, done on a sample of customer files by internal audit or an outside party. The AML program rule requires independent testing as a program pillar, and examiners review the audit's scope and findings when they plan their own sample.
What does an AML KYC audit cover beyond the files?
The policies and procedures, the risk assessment that sets due diligence levels, the risk rating methodology, training, the quality control process and how findings from earlier audits were fixed. The file sample is how the auditor tests whether the written process is the one actually followed.
What should a KYC file review checklist include for a business customer?
At minimum: CIP information before opening and its verification, the beneficial ownership certification and verification of each owner and the control person, nature and purpose, screening results with how matches were resolved, the risk rating with its factors, and the approvals. The stronger checklists also test that these parts agree with each other.
What happens when a KYC audit finds deficient files?
The bank remediates the files, fixes the process that produced them and reports the findings through its governance. Where deficiencies are widespread, regulators order remediation: the OCC's 2024 order against TD Bank required procedures to find files missing required CDD information and fix them promptly.
Who should perform a KYC quality check?
Someone who did not prepare the file, applying the same written standard the auditors will use. A common design places QC in the first line with a second-line review for high-risk files; what matters to an examiner is independence from the preparer and consistency across files.