The KYC remediation process mapped, every handoff counted

The KYC remediation process takes each existing customer file through eight stages: scoping the programme, pulling the data, analysing each file's gaps, reaching out to the customer, chasing the reply, reviewing what comes back, checking a sample, and closing the file with its evidence in the system of record. The stages are simple; the difficulty is the handoffs between them, because every one is a queue, and the longest queues sit in outreach, where the bank waits on a customer who did not expect to be asked. Botminds' KYC Remediation is built around that fact: its agents test and search every file first, so the customer is asked once, for only what is missing, and the analysts' review is never the bottleneck.

The examples come from a fictional sample institution, Norrell Federal Credit Union, and its programme to bring 38,400 acquired member files up to standard. Rule and enforcement references link to the regulators' own documents.

What are the KYC remediation process steps?

A KYC remediation process has eight steps: scope, data pull, gap analysis, outreach, chasing, review, quality control and closure. The first three happen inside the bank and can be measured in minutes per file. The next two depend on the customer and are measured in days. The last three are back inside the bank, and are fast if the file arrives at review with its evidence in one place.

Scoping and the data pull decide what every later stage costs

Scoping sets the population and the standard, and the data pull decides how much of the standard can be met without the customer. A scope that says "every business file needs verified owners" without saying what evidence counts will produce letters to every business customer. A scope that says a signed certification found in any loan file, matched to a recent state filing, closes the gap will produce letters only to the customers it cannot close. The second scope is cheaper and kinder, but only if the data pull actually reaches the loan system and the image archive.

The data pull is where remediation programmes most often under-invest. Core banking extracts are easy; loan origination systems, imaging archives and acquired-bank systems are not, and a contractor desk working by hand will not search them file by file. Regulators have written the expectation down in the orders that followed failures: the OCC's 2024 order against TD Bank required "procedures for identifying and timely remediating instances where required CDD information is missing or incomplete" (OCC AA-ENF-2024-77, Article XII). Identifying missing information across a book is a data problem before it is a people problem.

What is a gap analysis in KYC remediation?

A gap analysis tests each existing file against the remediation standard and lists every item that falls short, so the programme knows what each file needs before anyone acts on it. It should be mechanical and repeatable: the same file tested twice gives the same gaps. And it should keep every gap a file has, even when the file is reported in one cohort, because a customer with an expired ID and a missing purpose should be asked once for both.

A good gap analysis also records why each item is a gap, which rule or policy line it fails, so that the closure can show the same line was met. The CIP rule sets the bar for what the record must eventually say: it requires a written account of how each substantive discrepancy found during verification was resolved (31 CFR 1020.220(a)(3)(i)(D)). A remediation file that closes a discrepancy without describing how it was resolved is a file an examiner can reopen.

Outreach and chasing: where a remediation file spends its weeks

Outreach and chasing are where a remediation file spends most of its elapsed time, because every day in those stages is a day of waiting on someone outside the bank. On the sample programme, a request goes out, a text reminder follows on day 10, a call on day 20 and a final notice on day 30 with a 14-day window. A customer who never answers keeps the file open for 44 days before any decision about consequences can even be prepared.

The lesson for a plan is that review capacity is rarely what decides the finish date. A desk can add analysts and still miss its date, because the tail is made of customers who have not answered and decisions nobody is authorised to take. What shortens the tail is asking fewer customers, asking each one once, pacing letters so the contact center can answer the calls they cause, and deciding in advance what happens when nobody replies, the subject of KYC outreach when customers don't answer.

Counting the handoffs on one business file

A handoff is any point where the file waits for a different person or system to act. Counted on one business file with no verified owners, worked by hand, the outreach and chasing stages hold more handoffs than review and quality control together, and each is a queue with its own delay.

Fifteen handoffs on one file is not unusual, and six of them sit in stages a bank can avoid for every file it closes from its own records. The search step therefore matters for more than the minutes it saves. On the sample programme, searching the acquired loan files before writing to anyone closed 3,982 of 5,614 business files without a single request, and the 1,240 files that still needed something needed only one item each.

The search step: files closed from the bank’s records, and how many still need the customer

Review, QC and closure: what the file must show when it is done

A remediated file is done when its corrected values are in the system of record with the evidence they rest on, and a second person has approved them. Review compares the evidence to the standard; quality control samples the reviewer's work; closure writes the result. Regulators who have ordered remediation have asked for exactly this chain. The OCC's 2024 order against Blue Ridge Bank required procedures covering "the process for resolving issues when insufficient or inaccurate information is obtained" (OCC AA-ENF-2023-68), which is the review stage written as a requirement.

Re-reviewing old files has a side benefit programmes should plan for. FinCEN's 2024 alert on deepfake media noted that institutions often catch AI-generated or synthetic identity documents when they take a second look at a customer's account-opening papers (FinCEN Alert FIN-2024-Alert004). A remediation is a re-review at scale. The process should say what an analyst does when an image looks wrong, and who decides, before the first one turns up.

Closure: who approved, on what sample, and what was written to the core

CDD remediation and customer due diligence remediation: same process, different evidence

CDD remediation, or customer due diligence remediation, runs the same eight stages; what changes is the evidence each gap needs. An identification gap closes on a document or a verified data source. A beneficial ownership gap closes on a certification, the owners' identification and a check that nothing has changed. A nature-and-purpose gap closes on the customer's own answers, often three short questions, checked against how the account is actually used. A risk rating gap closes only after the others, because the rating should be recalculated on the corrected profile, not the stale one.

That ordering is why programmes that run cohorts in parallel still sequence within a file. Re-rating a customer before their purpose and owners are known reproduces the original failure on a fresh date; the quality assurance guide for remediation shows the error that results when missing data is scored rather than collected.

How long does a KYC remediation file take?

A file the bank can close from its own records takes minutes of work and a few days of review; a file that needs the customer takes weeks, mostly waiting. The solution's own estimate for one business file without verified owners is about 95 minutes of people's time by hand and about 21 with agents searching and drafting, leaving out the customer's reply time. The elapsed time is set by the customer: on the sample programme, 58% of customers answered within 14 days.

For a programme, the useful number is not the average file but the shape of the tail: how many files need the customer, how many of those answer, and how quickly the bank decides about the rest. A plan that states those three numbers per cohort can forecast its finish date; one that states only analyst capacity cannot.

The KYC remediation process in KYC Remediation

KYC Remediation runs the process with eight agents and four kinds of people. The Gap Finder tests every file against the approved scope; the Records Searcher searches the loan origination system, document imaging, account history and state filings, and proposes a closure only when the sources agree; the Package Builder assembles each file or batch with the record before and after and every source; the Member Request agent drafts one message per customer, paced to the contact center's capacity; the Non-response agent recommends what to do about silence; the Program Forecaster keeps the burn-up against the plan.

People take every decision that changes a record or a customer's position: an analyst approves as maker, a quality reviewer or the BSA officer approves as checker, the contact center supervisor sets the weekly message caps, and a limit on services needs three people. To see the stages on one programme, start from KYC Remediation; to see how they are staffed and priced, read a KYC remediation project with agents.

Questions people ask

What is the first step in a KYC remediation?

Scoping: deciding which files are in, what standard each gap must meet, and by when. The scope should be approved and versioned, because every later decision on a file is tested against it. Programmes that start with letters before the scope is fixed usually write to customers twice.

How does a KYC remediation project plan differ from a periodic review plan?

A remediation plan is built on a fixed stock of files and a committed date, so it needs a plan line in files per week, cohort by cohort, and a forecast of how many customers will answer. A periodic review plan is sized to a steady monthly flow. US rules require neither schedule; FinCEN's FAQ F.6 says updating is risk based.

Should we contact customers before searching our own systems?

No. Search first, then ask once for what is still missing. On the fictional sample programme, a search of business loan files closed 3,982 of 5,614 ownership files without a request, and the requests that remained asked for one item in 1,240 cases.

Who checks a remediated file?

A different person from the one who prepared it. On the sample programme, batches under 500 files go to a quality reviewer with a sample of 20, and larger batches and every beneficial owner batch go to the BSA officer with a sample of 40, stratified by source. One error returns its stratum for full review.

What should happen when a remediation finds a suspicious document?

The analyst stops and escalates to the BSA function, which decides whether further review or a SAR is warranted. FinCEN's 2024 deepfake alert notes that institutions often find synthetic content in ID documents by re-reviewing account opening documents, so a remediation should expect some. The file should then be restricted and its customer messages held.