What is KYC remediation? Bringing old files up to today's standard

KYC remediation is the work of bringing existing customer files up to a bank's current know-your-customer standard (its customer identification program, customer due diligence and enhanced due diligence) once a gap has been found across many files at once. It usually starts after a regulator's order, an audit finding, a merger or a new standard, and unlike a periodic review it is a campaign with a fixed scope and an end date. It is hard because the customers are already banking, the evidence is scattered across old systems, and every request to a customer costs goodwill and contact-center time. Botminds' KYC Remediation runs that campaign with agents that test every file, close what they can from records the bank already holds, and ask customers only for what is missing.

The examples on this page come from a fictional sample institution, Norrell Federal Credit Union, as it brings 38,400 member files acquired in a merger up to its own standard. Rules and enforcement facts are linked to the regulators' own documents.

What is KYC remediation? A definition, and what it is not

KYC remediation is a bounded programme on the back book: a defined set of existing files, a standard each must meet, a deadline, and a record of how each file was brought up to it. It is not onboarding, because the customers already have accounts, and it is not the steady-state review cycle, because it ends. In the context of AML compliance, it is how an institution repairs the customer-information side of its programme after something showed that the information was not good enough to support risk ratings and monitoring.

The defining feature is that the gap is shared. One file missing a beneficial owner is a review item. Six thousand business files with no verified owners, because the bank that acquired them never collected certifications, is a remediation. Scale changes the method: the work has to be sorted into cohorts by gap and risk, sequenced, staffed, paced against the contact center and reported against a plan, and that is what separates a remediation programme from a big queue.

Remediation also has to say what standard it is applying. That standard is the bank's own CIP and CDD policy, which sits on top of the rules but often goes further, for example by asking for beneficial ownership on business accounts the 2016 rule never reached. Getting that line right, and writing it down, is the subject of beneficial owner declarations for existing customers.

KYC remediation vs periodic review: why the difference matters

Periodic review keeps files current; remediation repairs files that were never current, or that a new standard has left behind. A bank can run both at once, and often must, but they need different plans. A periodic review cycle is sized to a steady flow and judged on timeliness. A remediation is sized to a stock, judged on whether the stock is cleared by the committed date, and watched by whoever committed the date, often a board and an examiner.

US rules shape the difference. FinCEN's consolidated CDD FAQs say plainly that no rule makes a bank refresh customer information continuously or on a fixed cycle (FinCEN, FAQ F.6; perpetual KYC builds on that answer). The duty is to update on a risk basis, as normal monitoring reveals the need. So a periodic cycle is a policy a bank chooses, while a remediation is what a bank is pushed into when its risk-based updating did not happen.

Standards bodies are moving steady-state work away from the calendar. The Wolfsberg Group's 2022 guidance encourages banks to replace fixed refresh cycles with reviews set off by events (Wolfsberg Group, Digital Customer Lifecycle Management, 2022). Europe is going the other way on the outer limit: from 10 July 2027, the EU's AML Regulation caps the time between updates at one year for higher-risk customers and five years for all others (Regulation (EU) 2024/1624, Art. 26). Neither changes what a remediation is; both change how large the next one is likely to be.

What triggers a KYC remediation?

A KYC remediation is triggered when a gap is found across many existing files at once, and the four usual sources are a regulator, an audit, a merger and a change of standard. A consent order or a matters-requiring-attention letter is the most visible trigger and usually comes with a deadline. An internal audit or independent test that samples files and finds the same defect in a meaningful share of them is the most common. A merger brings in a book collected to someone else's standard. And a new or corrected standard, such as a new question added to the CDD questionnaire, leaves every earlier file short of it the day it takes effect.

The last trigger is the one banks most often miss. FinCEN's 2026 order against the broker-dealer Canaccord Genuity found that the firm had no process to update CDD and customer risk profiles until December 2022, and that its new policy "has yet to be implemented for many of Canaccord's existing customers" (FinCEN Consent Order No. 2026-01). A new standard without a back-book plan is a remediation waiting to be ordered, and BSA consent orders that ordered KYC remediation show what that plan looks like once a regulator writes it.

Financial institutions should be required to apply CDD measures to existing customers on the basis of materiality and risk, and to conduct due diligence on such existing relationships at appropriate times, taking into account whether and when CDD measures have previously been undertaken and the adequacy of data obtained.

FATF Recommendations, Interpretive Note to Recommendation 10, ¶13

The international standard puts the scoping question in one sentence. "Materiality and risk" decides which existing customers a remediation reaches first; "whether and when CDD measures have previously been undertaken and the adequacy of data obtained" is a description of the gap analysis every remediation starts with.

What is remediation in AML KYC? The four gaps most programmes chase

Remediation in AML KYC means closing specific, testable gaps in customer files, and most programmes sort them into four kinds. Identification gaps are CIP items: a missing or expired ID, a missing date of birth or taxpayer number, an unresolved discrepancy. Ownership gaps are beneficial owners and a control person that were never certified or verified. Profile gaps are the nature and purpose of the relationship and the expected activity a risk rating should rest on. Rating gaps are customers never rated, or rated on a model whose inputs were missing.

The cohorts matter because each closes differently. An expired ID can often be closed from an image the bank captured at a branch visit or a loan closing. Ownership needs a certification, the owners' identification and a check that nothing has changed. Nature and purpose is a short conversation with the customer. A rating gap closes only after the others, because the rating should rest on the corrected profile. Sorting first lets a programme run each cohort at its own pace instead of sending one generic letter to everyone.

What back book remediation means

Back book remediation means remediating the stock of existing customers, the "back book", as distinct from the "front book" of new customers onboarded under the current process. The term comes from banking's habit of calling a portfolio a book; in KYC it marks the line between files collected before a standard changed and files collected after. Fixing the onboarding process stops the gap growing; only a back book programme closes it.

The back book is where risk hides longest. FinCEN's 2024 order against TD Bank recorded a back book of 1.6 million customers who had never been scored for risk, a sample suggesting more than 200,000 of them could be high risk, and a committee decision not to remediate them (FinCEN Consent Order No. 2024-02). A back book that is not on the plan is a back book nobody is looking at.

A back book in four cohorts, with one burn-up against the committed date

What is the KYC remediation process, in brief?

The KYC remediation process runs in the same order on every file: scope, test, search, ask, review, check and close. Scoping fixes the population, the standard and the deadline. Testing finds each file's gaps. Searching looks for evidence the bank already holds. Asking goes to the customer only for what is still missing, ideally once. Review reads the evidence against the standard; a second person checks a sample; closure writes the corrected values to the core system with their sources.

The hard part is rarely the review; it is the waiting. The KYC remediation process mapped stage by stage counts every handoff on one file and shows why the date a programme finishes is usually set by outreach, not by analysts.

Why KYC remediation programmes run late

Remediation programmes run late for three recurring reasons, and each is visible in the plan before the first letter goes out. The first is asking before searching: a programme that writes to every customer for every gap floods the contact center and waits weeks for documents the bank already holds. The second is one letter per gap, so a customer with three gaps is asked three times and answers none. The third is no consequence for silence, so the last tenth of the book sits open while the deadline passes.

There is a fourth reason, less visible: the programme closes files without evidence to hit the date, and a later sample finds it. That is why the definition of done matters as much as the deadline. A file is remediated when its corrected values are in the system of record with the evidence they rest on and a second person has approved them, not when a contractor has marked it complete.

How KYC Remediation runs a remediation

KYC Remediation runs the programme as one page: four cohorts by gap, each file in exactly one state, and a burn-up against the committed date. Its Gap Finder tests every file against the approved scope; its Records Searcher looks in the loan origination system, document imaging, account history and state business filings, and closes a gap only when the sources agree, citing every line it used; its Member Request agent drafts one message per customer for everything still missing, paced to what the contact center can answer.

One member file: each gap, how it closed, and the record before and after

On the sample programme the order of work is what moves the date. One search of business loan files closed 3,982 of 5,614 ownership files without contacting a member, and approving that batch moved the programme from 32 to 61 days ahead of its plan line. People keep the decisions: an analyst approves each batch as maker, a quality reviewer or the BSA officer samples it as checker, and limits on a customer's services need three people. To see the cohorts, the burn-up and the files together, start from KYC Remediation.

Questions people ask

What does KYC remediation mean in banking?

It means bringing existing customer files up to the bank's current KYC standard as a defined programme, after a gap has been found across many of them. The programme has a scope, a deadline and a plan, and it ends once the files in scope meet the standard. Steady-state reviews then keep them current.

What is AML remediation?

AML remediation is the wider repair of an anti-money-laundering programme after a failure: monitoring rules, alert backlogs, SAR lookbacks, governance and training, as well as customer files. KYC remediation is the customer-file part of it. TD Bank's 2024 orders, for example, required both a SAR lookback and changes to customer due diligence.

Is KYC remediation required by law?

No rule names it. The CDD rule requires banks to maintain and update customer information on a risk basis, and when that has not happened across a book, a remediation is how the bank complies. Regulators often require one explicitly in an order, with milestones.

How long does a KYC remediation take?

It depends on the file count, the gaps and the customers' response, and orders set the pace when they apply. FDIC's 2024 order against Sutton Bank allowed 120 days for a CIP lookback; the fictional sample programme on this page plans about 975 files a week over some 39 weeks to bring 38,400 files to standard.

Is a KYC refresh the same as KYC remediation?

No. A KYC refresh updates a file that met the standard at its previous review, on a schedule or a trigger. Remediation fixes files that fall short of the standard now, usually many at once and against a deadline. The same file can need both: remediated once, then refreshed as its circumstances change.