Fund KYC software is the system an asset manager, private markets firm or fund administrator uses to onboard and refresh investors: collect documents, verify identity, unfold owners, screen every party, rate risk and route approvals. Going live with it is less a software installation than a change to how investor decisions are made, so it has to be proved on files whose outcomes are already known before it touches a live subscription. The plan below takes eight weeks when the inputs are ready on day one, and longer when they are not: week by week, it writes the firm's rules as settings, replays past files, runs in parallel, gets the MLRO's sign-off and moves refresh to trigger events. It is the plan we suggest for Botminds' Investor KYC/AML Onboarding, and most of it applies to any product.
The examples come from Quillfield Capital, a fictional sample firm in the solution, and its sample files; the eight weeks are our plan, not a measured result. The rules are linked where they appear.
What to have ready before week one
- Your risk model
The factors, their weights, the bands and the rules that override them, such as a PEP among the owners setting High. If it lives in a spreadsheet, that is the starting point.
- Document rules by investor type and country
What an individual, a company, a trust, a foundation, a pension plan and a fund must provide, and what changes by jurisdiction.
- Screening rules
Which lists, the match threshold, how low-score discounts are sampled, how long former PEPs stay PEPs, and how often every party is rescreened.
- Review cycles and triggers
How often each band is reviewed, and which events open a review in between: ownership changes, new designations, PEP appointments, adverse news, bank-detail changes.
- Roles and approvers
Who prepares, who checks, who approves each band, who releases accounts, and who may change settings, with preparer and checker always different people.
- Connections
Investor portal, registry gateways, the screening service, the transfer agency system, the document archive and CRM, and the fund administrator.
- About forty past files with known outcomes
Including the hardest: trusts, foundations, foreign registers, PEPs, true and false matches, a decline. These become the test.
- Your current numbers
Days to accept by band, reviewer returns, refresh backlog: the baseline the new process has to beat.
How long does fund KYC software take to implement?
Eight weeks is realistic when the inputs above exist and past files can be replayed rather than re-collected; when the risk model and document rules have to be written first, the plan grows by however long that takes. The time goes into deciding the rules and proving them, not into the software. A firm that cannot say what its risk model is will spend the first month finding out, with or without a new system.
An eight-week go-live, and what has to be true before each step
- Rules as settingsWk 1–2
- Replay past filesWk 3–4
- Parallel run on live filesWk 5–6
- MLRO sign-offWk 7
- Go live; refresh by triggerWk 8
What do we need to start with fund KYC software?
Decisions more than data. The first two weeks turn each of the firm's rules into a setting that can be read, versioned and approved: the risk model's factors and bands, the document list for each investor type and country, the screening threshold and sampling rate, the review cycles and targets. In the sample firm, Low is below 35, Medium 35 to 64 and High 65 and above; any PEP among the owners sets High; high-risk files are reviewed every year, medium every three years and low every five.
Those cycles are not arbitrary. From 10 July 2027, the EU AML Regulation says the period between updates of customer information "shall not in any case exceed" one year for higher-risk customers and five years for all others (Regulation (EU) 2024/1624, Art. 26(2)). A firm with EU funds should set its cycles inside those limits now. The same Article lists the events that must trigger a review in between: a change in the customer's relevant circumstances, a legal obligation to contact the customer, or a relevant new fact.
The screening rules as settings, changed by administrators and approved by the MLRO
Do we redo existing investor files?
No. Bring them in as they are, screen every party from the first night, and let each file's review date or the next trigger event decide when it is updated. Re-collecting every investor's documents at go-live is the most expensive way to start, and the rules do not require it.
The US rules point the same way. The beneficial-ownership requirement applies to accounts opened on or after its May 2018 applicability date, and FinCEN's 13 February 2026 order lets covered institutions, mutual funds among them, identify a legal entity's owners when it first opens an account and thereafter only when facts call the information into question or the institution's risk-based procedures require it (FinCEN, FIN-2026-R001). The mutual fund identification rule likewise excludes an existing customer whose identity the fund already reasonably believes it knows (31 CFR 1024.100(c)(2)(iii)).
What the go-live does need is a list of existing files that already fall outside the new rules: files past their review date, high-risk files without a source-of-wealth record, legal-entity files without beneficial owners. Those join the refresh queue in risk order. What KYC remediation involves covers the larger version of that problem, when a whole book is below standard.
Replaying past files: the test that matters
Weeks three and four run the sample of past files through the software and compare its results with what the firm's analysts concluded: owners and percentages, screening decisions and risk bands. Every disagreement is investigated before anything goes further, because each one is either a setting that is wrong, a document the software misread, or an earlier human decision that was wrong.
In the sample firm's setup, 40 past files ran through Investor KYC/AML Onboarding before go-live: the owners matched on 40 of 40 and the risk band on 39 of 40. Those are results on fictional sample files, and what they show is the shape of the test, not a forecast. The one band that differed is the useful part: in a real replay it is where the firm learns whether its model or its past decision should change.
What to compare in a replay, and what a disagreement usually means
| Compare | Agreement means | A disagreement usually means |
|---|---|---|
| Owners and percentages | The chain was read and multiplied the same way | A misread document, a missed layer, or an analyst who stopped at the register |
| Trust and foundation roles | The regime’s roles are named the same way | A setting for the wrong regime, or an old file under an old rule |
| Screening decisions | The same hits were raised and decided the same way | A threshold set differently, or a past discount with no recorded reason |
| Risk band | The model produces the bands the firm intends | A factor weighted differently in practice than on paper |
| Documents requested | The document rules match what analysts asked for | Rules that ask too much or too little for an investor type |
How do we run old and new side by side?
For two weeks, new files run through the software while analysts also work them the old way, or at least review every file against the old checklist, and the second reviewer compares the two. Measure three things: days from a complete package to acceptance, files returned by the reviewer and why, and decisions where the two routes differ.
The numbers a parallel run should move: days to accept, on the sample data and against target
A parallel run that shows no difference in days is not a failure if the files are better; one that shows fewer days and more reviewer returns is a warning. The sample firm's high-risk file in its story, a Danish holding company with a Jersey trust in its chain, was accepted in ten business days, 32 days before the fund's first close.
Who signs off fund KYC software go-live?
The MLRO, for the settings and the risk model, and whoever approves the AML program, if the go-live changes it. Under the EU AML Regulation the approval of the firm's internal policies, procedures and controls is one of the decisions that may not be outsourced, and the compliance manager, a member of the management body, is responsible for ensuring they match the firm's risk exposure (Arts. 11 and 18(3)). A US mutual fund's program must be approved in writing by its board (31 CFR 1024.210(a)), so a change to the written program goes back to the board.
Six roles in a fund KYC software rollout, and what each signs or checks
Today
Owns the risk model and screening rules, often in documents no system reads.
With agents
Approves each setting in weeks one and two, reviews every replay disagreement, signs go-live.
Still theirs: Every later change to the model or thresholds.
Today
Answers for late files at each fund close.
With agents
Sets targets and escalation points, plans the parallel run around closes, reports days to accept.
Still theirs: Account release through a second person.
Today
Prepare files by hand.
With agents
Confirm the replay results against their own past decisions and work the parallel run.
Still theirs: Every confirmation in the live file.
Today
Re-performs every file before approval.
With agents
Compares old and new routes in the parallel run; samples low-score discounts.
Still theirs: The second check on every file.
Today
Maintains spreadsheets and templates.
With agents
Enters the settings and connections; proposes changes for the MLRO to approve.
Still theirs: No decision on any file.
Today
Rebuilds decisions from email and exports.
With agents
Tests the trail on replay and parallel-run files before go-live.
Still theirs: Independent testing afterwards.
How do refresh cycles move to event triggers?
By watching every accepted file for the events that change its risk, and opening a review when one happens, while keeping the periodic cycle as a backstop. The EU Regulation requires both: maximum intervals by risk, and a review whenever relevant circumstances change. FinCEN's 2026 order moves the US in the same direction for beneficial owners, toward risk-based updates rather than a fixed point at each new account.
The week's trigger events, each with what changed and the agent's proposal
Week eight switches the existing book to that model. In the sample firm's book, 23 trigger events arrived in one week: four needed a person's review, and 17 others were screened and closed by people with a reason. The payoff is in the periodic queue: of 1,138 reviews due in the quarter, 274 low-risk files had nothing changed and were ready to re-attest without re-collecting documents. How often KYC should be updated compares the US, EU and UK answers on cycles.
Working back from 10 July 2027 and 1 January 2028
Two dates set the latest sensible go-live for many fund groups. EU funds and their managers come under the AML Regulation on 10 July 2027, with its one-year and five-year update limits and its bar on outsourcing acceptance decisions. US advisers come under FinCEN's AML rule on 1 January 2028 (91 FR 36). An eight-week plan that starts with its inputs ready finishes well inside both; one that starts with the risk model still in discussion needs to start sooner. The investment adviser AML rule explains the US date, and 12 questions to ask investor AML software covers the choice before the plan.
Where Investor KYC/AML Onboarding fits the plan
Investor KYC/AML Onboarding is built from the inputs in the first checklist: the firm's risk model, document rules, screening rules and a sample of past investor files, which it replays before go-live so its results can be compared with the analysts'. Its settings, from thresholds to review cycles, are changed by administrators and approved by the MLRO, and its seven agents work each file while people confirm, check, approve and release. It does not replace the screening service, the registry gateways or the transfer agency system; it connects to them.
The fastest way to see whether the plan fits is the replay itself: Botminds runs Investor KYC/AML Onboarding on a sample of a firm's own past investor KYC files. To start, see Investor KYC/AML Onboarding.
Questions people ask
Can fund KYC software go live in the middle of a fundraise?
It can, but the parallel run should avoid the weeks before a close, when every file is urgent and no one has time to compare two routes. Plan the parallel run for a quiet period and go live for new files between closes.
What if the replay shows the software disagreeing with our analysts?
Investigate each disagreement before go-live. Each one is a setting to change, a document the software misread, or an earlier decision that was wrong; all three are worth knowing, and the third may need its own remediation.
Do we need board approval to change KYC software?
Not for the software itself, but a US mutual fund's AML program must be approved in writing by its board, so if the change alters the written program, the amended program goes back to the board. Under the EU Regulation, approval of internal policies and procedures cannot be outsourced.
How do we migrate files held by our fund administrator?
Agree the format, the documents and the evidence that come with each file, and import them as they are; then let the review date or the next trigger decide when each is updated. The administrator agreement should already give the manager copies of every file on request and on exit.
What should we measure after go-live?
Days to accept by risk band, reviewer returns and their reasons, trigger events handled and their outcomes, overdue periodic reviews, and overrides of agent proposals. In the sample firm, overrides need a reason code and are reported to the MLRO every month.