KYC outreach is the part of a remediation programme that contacts existing customers for the identification, ownership, purpose or other information their files are missing, chases the replies, and decides what happens to customers who never answer. It sets a programme's end date, because the last files open are almost always waiting on a customer, and it carries the programme's biggest fairness risk, because the consequence for silence can be a restricted or closed account. Botminds' KYC Remediation sends one plain message per customer for everything still missing, paces messages to what the contact center can answer, and never lets a limit on services happen without three people approving it.
procedures to enforce timely consequences when customers fail to provide the required CDD information
OCC Consent Order AA-ENF-2024-77, TD Bank, Article XII (h)
That line, from the OCC's 2024 order against TD Bank, is the regulator's answer to the oldest problem in remediation: the customer who never replies. The order pairs it with a duty to identify and promptly fix missing or incomplete CDD information. Together they say that asking is not enough; a programme must also decide, in advance and in writing, what happens when asking fails. The examples below come from a fictional sample institution, Norrell Federal Credit Union, and its programme on 38,400 acquired member files.
What is KYC outreach?
KYC outreach means contacting customers to collect or confirm the information their KYC files need, and in a remediation it is a campaign: thousands of customers, a deadline, and a contact center that will take the calls. Done well, it asks each customer once, in plain words, for only what the bank could not find itself, through the channels that customer uses. Done badly, it sends one letter per gap, in waves, to people who are surprised to be asked at all.
Outreach should be the last resort in the order of work. A programme that searches its own loan files, image archives and account history first sends far fewer messages; on the sample programme, searching business loan files before writing to anyone closed 3,982 ownership files with no request at all. Every message not sent is a call the contact center does not take and a customer who is not asked for something the bank already has.
The rule behind the deadline: timely consequences for missing CDD
No regulation sets a deadline for a customer to answer a KYC request, but the rules and the orders expect one. The CIP rule already requires procedures for the case where identity cannot be verified, including "When the bank should close an account, after attempts to verify a customer's identity have failed" (31 CFR 1020.220(a)(2)(iii)). The FDIC's 2024 order against Sutton Bank required procedures that "outline circumstances and timeframes in which accounts must be closed when deficiencies are identified" (FDIC-23-0110b). TD's order adds the general duty to enforce timely consequences.
What none of these documents does is choose the consequence for a given customer. They require a procedure, applied consistently, with a timeframe. That leaves the bank to design a ladder of reminders and steps, and to decide each customer's case on the facts of that customer, which is where the newer fair-banking rules come in.
KYC client outreach: one message per customer, paced to the phones
Good KYC client outreach sends each customer one message that covers every gap the file has, in the customer's language, through the channel they use, at a pace the contact center can absorb. The customer who gets three letters about three gaps from three cohorts answers none of them; the one who gets one message with two short items, as a sample member in the programme does, in Spanish, his preferred language on the core record, has a reason to answer.
What the sample programme’s outreach costs in calls
14
calls per 100 consumer messages
31
calls per 100 business messages
58%
of members answered within 14 days
480
calls a week the contact center is staffed for
Pacing is the part programmes skip. Business customers call more than twice as often per message as consumers on the sample programme, so a business wave the same size as a consumer wave doubles the load on the phones. The sample programme lets the contact center supervisor, not the remediation team, set the weekly caps, and shows six weeks of planned messages against the calls they will cause.
Six weeks of messages against the calls they will cause, and one member’s message
What a KYC outreach letter should say, and never say
A KYC outreach letter should say what is missing, why the bank is asking, how to answer and by when, and what happens if the customer does not. It should never hint at monitoring, investigation or a report. The SAR confidentiality rule forbids disclosing a SAR "or any information that would reveal the existence of a SAR" (31 CFR 1020.320(e)), and a remediation letter that tells a customer under review that the bank has concerns about their activity can cross that line.
A KYC update letter that gets answered and stays on the right side of the rules
- Ask for every missing item in one message
Two items from two cohorts asked together, not two letters a month apart.
- Say why in plain words
The bank is updating its records for members who joined through a merger, not "a regulatory review of your activity".
- Describe policy as policy
If no rule requires the item for this account, the bank’s policy asks for it.
- Give the easiest ways to answer
Digital banking upload, any branch, or a call; with the time it takes, about five minutes in the sample.
- State the date, and what happens after it
A reminder schedule and a final notice before any change to services.
- Use the customer’s language
From the preferred language on the core record.
- Pass a tipping-off check before it goes
No mention of monitoring, reviews of activity or reports; restricted files get no letter at all.
The outreach ladder: reminders, a final notice and a window
The outreach ladder is the fixed sequence of contacts a programme uses before any consequence, and it should be the same for every customer in a cohort. On the sample programme it is a request, a text reminder on day 10, a call from the contact center on day 20, and a final notice on day 30 with a 14-day window. Only then does the file reach the point where a person decides what happens next.
The outreach ladder: 44 days of asking before anyone decides, then 14 days’ notice
- Requestday 0
- Text reminderday 10
- Callday 20
- Final notice and windowday 30 to 44
- Waiting on the customer
- Notice before a limit takes effect14 d
A ladder like this does two things for the programme. It makes the end date forecastable, because the latest a file can stay open waiting on silence is known. And it makes treatment consistent, so a customer who is restricted can see that every other customer in the same position was asked the same number of times in the same way. Inconsistency is the failure the regulators' wording is aimed at, and it is also the failure customers complain about.
What happens if you don't respond to a KYC request?
If you don't respond to a bank's KYC request, the bank will usually remind you, then send a final notice, and then may limit some services on your account until you answer. Closing the account is generally a later step, and many banks keep deposits and loan payments flowing while services are limited. The exact steps are the bank's own policy, which regulators require it to have and apply consistently.
On the sample programme, the limit a member receives is narrow and stated in advance. Deposits, direct deposits and loan payments continue; no new loans, cards or accounts are opened; and a debit card is not reissued when it expires. The notice says what continues, what stops, the date it starts and how to fix it, and it goes out 14 days before the limit takes effect.
63 members past their window: what the agent recommended for each
Can a bank close your account for not updating KYC?
Yes, a bank can close an account when a customer does not provide information its programme requires, and regulators expect it to have a procedure that says when. The CIP rule requires procedures for when to close an account after attempts to verify identity have failed, and orders such as Sutton's require timeframes for closing accounts with deficiencies. But each closure must rest on that customer's own facts, and since 2025 that requirement has sharper edges.
The consequence ladder: what each step is, and what it rests on
| Step | What happens | What it rests on |
|---|---|---|
| Reminder and call | The customer is asked again, through another channel | The bank’s outreach procedure |
| Final notice | A dated notice of what will change and how to avoid it | Procedures for timely consequences (OCC, TD order) |
| A call first | A person speaks to a customer with vulnerability signs before any limit | The bank’s fair-treatment policy; the customer’s own facts |
| Limit on services | Deposits and loan payments continue; new products and card reissue stop | The programme’s policy, applied case by case, with a reviewed notice |
| Close accounts | Only after a further period with no reply | CIP closure procedures; orders’ closure timeframes |
| Exit a member (credit unions) | A separate board process | The credit union’s bylaws; never recommended by the agents in the sample |
Fair banking rules now shape the last step
Since August 2025, a decision to restrict or close a customer's account has to stand up as an individual, risk-based decision. Executive Order 14331 requires banking decisions to rest on an objective, risk-based assessment of the individual customer (EO 14331, 90 FR 38925; can a bank refuse to open an account sets out the limits). The OCC and FDIC final rule removing reputation risk from supervision took effect on June 9, 2026, barring the agencies from pushing banks to close accounts merely because a lawful but politically unpopular business is thought to carry reputation risk (91 FR 18279); NCUA's rule took effect on July 27, 2026 (NCUA), and the Federal Reserve's is still a proposal.
FinCEN's April 2026 proposal for AML programmes ties the two threads together. It aims to mitigate the risk of institutions "potentially being inappropriately pressured into closing customer accounts" by emphasising the risk-based nature of programmes (FinCEN NPRM, 91 FR 18704); it is not yet final. FATF has made the same point internationally: de-risking and financial exclusion "run contrary to the RBA", the risk-based approach (FATF, 2021).
For an outreach design, that means three things. Silence is a fact about a file, not a risk rating, so a limit should be the narrowest that keeps the file's risk in hand. Customers with signs of vulnerability, such as age or benefit deposits, should be spoken to before anything changes. And the record of each decision should show the facts it rested on, so the bank can show it was individual and consistent. The consent-order casebook shows how regulators frame the other side of the same balance.
What a KYC outreach team does, with KYC Remediation
A KYC outreach team drafts and sends the requests, answers the customers' calls, chases replies, and prepares the cases where nobody answers. In KYC Remediation, the Member Request agent drafts one message per customer with every gap across cohorts, holds it until the week's release is approved, and paces releases to the contact center's caps. The Non-response agent tracks each customer's window and recommends a call, a limit or closing accounts, with a drafted notice; it never limits services or closes an account itself, and signs of vulnerability always mean a call first.
Members who have not answered: recommendations, and three people for every limit
Every limit needs three people: an analyst prepares it, a quality reviewer checks the notice, and the BSA officer approves it. To see outreach, pacing and non-responders on one programme, start from KYC Remediation, and for the end-to-end sequence that outreach sits in, see the KYC remediation process mapped.
Questions people ask
What does KYC outreach mean?
It means contacting customers to collect or confirm the information their KYC files need. In a remediation it is run as a campaign with a deadline, a reminder schedule and a decision for customers who never reply. The OCC's 2024 TD Bank order requires procedures to enforce timely consequences for those customers.
Why is my bank asking me to update my KYC information?
Usually because its records for your account are incomplete or out of date against its current standard, often after a merger, a policy change or a review. US rules require banks to keep customer information current on a risk basis. A genuine request will not ask for passwords or one-time codes, and you can confirm it by calling the number on your statement.
How long do I have to respond to a KYC request?
The bank's letter should say. Programmes typically allow several weeks with reminders; the fictional sample programme sends reminders on days 10 and 20 and a final notice on day 30 with a 14-day window. Any limit then comes with 14 days' notice.
Can a bank freeze my account for not updating KYC?
A bank can limit services under its policy, and some do restrict accounts. Narrower limits are common: in the sample programme deposits, direct deposits and loan payments continue while new products and debit card reissue stop. Since EO 14331, each such decision should rest on an individual, risk-based analysis.
Should a KYC outreach letter mention suspicious activity?
No. 31 CFR 1020.320(e) forbids disclosing a SAR or any information that would reveal one, and a letter that mentions monitoring or an investigation risks doing that. Outreach on files restricted by the BSA function should be held entirely.