KYC quality assurance in a remediation means checking a sample of each batch of remediated files, by someone other than the person who prepared them, against a written definition of an error, and stating what the result supports. The arithmetic is simple and often misread: if a checker samples 40 files at random and finds no errors, the bank can say with 95% confidence that fewer than 7.2% of the batch is wrong, and no more than that. Remediation QA is hard because batches are large, errors are rare but costly, and a sample that is too small, or an error definition that misses the failures examiners look for, approves bad work with a clean record. Botminds' KYC Remediation states the sample, the result and the confidence on every batch it sends to a checker.
The examples come from a fictional sample institution, Norrell Federal Credit Union, approving batches in its programme on 38,400 acquired member files. The arithmetic is ours and shown in full; enforcement facts link to the regulators' orders.
What a clean sample supports, at 95% confidence
20files
sampled with no errors: fewer than 13.9% of the batch is wrong
40files
sampled with no errors: fewer than 7.2% is wrong
59files
needed with no errors to say fewer than 5%
300files
needed with no errors to say fewer than 1%
What does KYC quality assurance mean in a remediation?
In a remediation, KYC quality assurance is the control that lets a bank approve thousands of files without re-reading each one, by sampling them and stating what the sample shows. It answers the question a board or an examiner will ask about any batch: how do you know these closures are right? "A senior person looked at some of them" is not an answer; "a different person sampled 40 at random, stratified by source, against this error definition, found none, so fewer than 7.2% are wrong at 95% confidence, and one error would have sent the stratum back for full review" is.
Regulators ask for the control by name. The OCC's 2024 order against TD Bank required, among the elements of the new CDD programme, "a quality control process to ensure CDD policies and procedures are adhered to" (OCC AA-ENF-2024-77, Article XII (p)). Examiners test in the same way: the FFIEC's CDD procedures tell them to "select a sample of customer information" and judge whether it supports the customer's risk profile (FFIEC examination procedures, CDD). A remediation's QA should be at least as rigorous as the sample the examiner will draw.
How many files should you sample in KYC QA?
Sample enough files that a clean result rules out the error rate you could not accept. If the bank's tolerance for a batch is "fewer than 10% wrong", 30 clean files will show it; "fewer than 5%" needs 59; "fewer than 1%" needs about 300. The size of the batch hardly matters once it is in the thousands, which surprises people: 40 clean files say the same thing about a batch of 4,000 as about a batch of 40,000.
Bigger samples buy tighter bounds, slowly: the error rate a clean sample rules out
The curve is why most programmes settle on a few fixed sizes rather than a percentage of the batch. A 1% sample of a 300-file batch is three files and proves almost nothing; a 1% sample of a 30,000-file batch is 300 and proves more than most programmes need. The sample programme's choice, 20 files for small batches checked by a quality reviewer and 40 for large and beneficial owner batches checked by the BSA officer, puts the tighter bound where the volume and the risk are.
What zero errors in 40 files proves, and what it does not
Zero errors in 40 files proves that the batch's error rate is very unlikely to be above 7.2%: if it were 7.2%, a random sample of 40 would come back clean only about one time in twenty. It does not prove the batch is perfect, and it cannot tell a batch with no errors from one with a few. A batch with a 2% error rate passes a 40-file sample about 45% of the time; a batch at 5% still passes about 13% of the time.
How often a batch passes a clean-sample test, by its true error rate
| True error rate in the batch | Chance 20 sampled files are all clean | Chance 40 sampled files are all clean |
|---|---|---|
| 1% | 82% | 67% |
| 2% | 67% | 45% |
| 5% | 36% | 13% |
| 7.2% | 22% | 5% |
| 10% | 12% | 1.5% |
That is the right way to read a QA result: as a screen, not a certificate. It is also why the sampling is only half the control. The other half is upstream: rules that stop bad closures being proposed at all, such as never closing when two sources disagree. When a single error does turn up, the arithmetic changes sharply: one error in 40 lifts the 95% upper bound to about 11.3%, which is why a failed sample should trigger a full review of its stratum, not a shrug.
What counts as an error in KYC QA?
An error in KYC QA is any closure that the evidence in the file does not support under the programme's standard, plus any breach of a control the programme treats as absolute. The definition has to be written before sampling starts, because a checker who decides case by case what counts will find what they expect. It should distinguish errors that fail the file from defects that are fixed in place.
An error definition for remediation QA: what fails a file, and what is fixed in place
| Finding | Counts as | Why |
|---|---|---|
| A value in the record that its cited source does not show | Error | The closure is unsupported, whatever else is right |
| A file closed when two sources disagree | Error | The disagreement was the thing to resolve |
| A missing value scored as low risk, or filled from someone’s recollection | Error | Missing data must be collected, not assumed |
| A beneficial owner or control person not screened | Error | Screening is part of the closing rule |
| A message sent on a restricted file, or one hinting at monitoring | Error | A tipping-off risk, whatever the file’s state |
| The wrong reason code on a correct decision | Defect, fixed in place | The evidence supports the outcome |
| A source cited correctly but at the wrong page or line | Defect, fixed in place | A checker can still find it |
Missing is not low: the USAA lesson for error definitions
The most damaging KYC error is not a wrong value but a missing one treated as a value. FinCEN's 2022 order against USAA Federal Savings Bank found that "Management would arbitrarily assign risk sub-scores of 1 or 2 (on a 10-point maximum scale) for risk factors where member data was missing", and that "of approximately six million customer-risk scores, not a single customer received a high-risk score of 5.5 or higher" (FinCEN Consent Order No. 2022-01). Each score might have passed a QA check that asked only whether the arithmetic was right.
The lesson for a remediation QA plan is to test for absence. A sampled file should be checked for whether each value the standard needs is present and sourced, not only whether the values present are correct. In a remediation that re-rates customers, a rating proposed before the file's other gaps close should count as an error, because it repeats exactly the failure the order describes; that is why ratings come last in the KYC remediation process.
Stratify the sample, and decide what one error does
A stratified sample draws from each source or type of file in proportion, so a problem confined to one source cannot hide behind clean files from the others. On the sample programme, the BSA officer's 40 files from a 3,982-file beneficial owner batch were drawn by loan type: 12 equipment loans, 11 commercial real estate, 10 operating lines and 7 vehicle loans. An error in one stratum returns that stratum, not the whole batch, for full review.
The checker’s sample: 40 files, stratified, with each file’s sources side by side
Two other rules belong in the plan. The checker must not be the maker, however small the batch. And the sample must be drawn by the system or by the checker, not chosen by the maker. A QA plan that writes down the sample size per batch type, the strata, the error definition, the rule for one error and who checks which batches can be read by an examiner in five minutes, which is the point.
A KYC QC checklist for every remediation batch
- The maker and the checker are different people
No exceptions for small batches or busy weeks.
- The sample size is set by batch type, not chosen per batch
For example 20 below 500 files, 40 above and for every beneficial owner batch.
- The sample is stratified by source or file type
So a fault in one loan system or one cohort cannot hide.
- The error definition is written down first
Including missing values treated as values, and tipping-off breaches.
- Each sampled file is read against its sources
The value in the record, the line in the document, the rule it meets.
- One error has a stated consequence
The stratum goes back for full review, and the cause is fixed before the next batch.
- The result and its confidence are recorded with the approval
With the reason, so the audit trail shows what the checker relied on.
KYC document review: what the checker actually reads
A checker in KYC document review reads the cited source, not the analyst's summary of it. For a beneficial owner closure, that is the signed certification with its owners, percentages, control person and signature date; the owners' identification images; and the state annual report listing the same people. For a reply from a customer, it is the uploaded document and the customer's answers next to the value proposed for the record.
A quality reviewer reads a customer’s reply with each proposed value beside its source
The speed of the read is what makes a 40-file sample practical. If evidence has to be fetched from three systems for each sampled file, a checker will sample fewer files or read them less carefully; if each source opens from the file with the lines used highlighted, a clean read of 40 files is a morning's work. European supervisors make a similar point for automated onboarding: the EBA's guidelines list "sample testing" and "manual reviews" among the means a firm should use to monitor the adequacy of its solution (EBA/GL/2022/15).
KYC quality control vs quality assurance vs KYC audit
Quality control checks each batch before it is approved; quality assurance tests whether the programme's controls work across batches; a KYC audit is the independent third line, internal audit or an examiner, testing both. In job titles the terms blur, and a KYC quality control analyst often does what this page calls QA. The distinction matters for the plan, because each line needs its own evidence.
Three lines checking one remediation, and what each needs from the file
| Line | What it checks | What it needs |
|---|---|---|
| Quality control (first line) | Each batch before approval, on a stated sample | Cited sources, the error definition, the sampling rule |
| Quality assurance (second line) | Whether QC works: error trends, returned strata, maker and checker patterns | Every batch’s sample, result and reason in one place |
| KYC audit (third line) and examiners | Both, independently, on their own sample | An export of files, sources, approvals and the audit trail |
How KYC Remediation states the confidence behind each batch
KYC Remediation makes the sample a setting and the confidence a line on the approval. Batches under 500 files go to a quality reviewer with a sample of 20; larger batches and every beneficial owner batch go to the BSA officer with a sample of 40, stratified by source; one error returns its stratum for full review; these are settings an administrator can change only with a second administrator's approval. For each sampled file the agents re-read the sources side by side, and the checker can open any of them.
On the sample programme's beneficial owner batch, 40 of 40 matched their sources, the BSA officer approved with the reason "Sample passed with no errors", and 3,982 files were written to the core banking system with their evidence. The design target is that 100% of closed files cite the record used and carry a maker and a different checker. To see the sample, the reasons and the audit trail together, start from KYC Remediation; to see how QA fits the staffing of a whole project, read a KYC remediation project with agents.
Questions people ask
What does a KYC quality control analyst do?
A KYC quality control analyst checks other people's files against the standard, usually on a sample, and records whether each passes and why. In a remediation they act as the checker on batches the analysts have approved as makers. On the fictional sample programme, quality reviewers check batches under 500 files on a sample of 20.
What sample size do regulators require for KYC QA?
No US rule sets one. Orders such as TD Bank's require a quality control process, and examiners draw their own samples. The bank should choose sizes it can defend with arithmetic: 40 clean files support fewer than 7.2% errors at 95% confidence, and 59 clean files support fewer than 5%.
Does the batch size change the sample I need?
Very little once a batch is in the thousands. The bound depends on the number of files sampled, not the share; 40 clean files say about the same for a batch of 4,000 as for 40,000. For small batches, sampling without replacement makes the bound slightly tighter, so the large-batch figure is conservative.
What should happen when the QA sample finds an error?
Return the affected stratum, or the batch if it was not stratified, for full review, and find the cause before approving the next batch. One error in 40 lifts the 95% upper bound to about 11.3%, so a batch with a failed sample cannot be approved on that sample.
Will an examiner rely on our QA sample?
Not instead of their own. Examiners draw their own sample of customer information under the FFIEC's CDD procedures, and they will also look at whether the bank's quality control caught what it should have. A QA record that states each batch's sample, result and reason makes that review faster and the bank's account of its own controls credible.