A KYC tracking system that pays: refresh KPIs and program math

A KYC tracking system is the part of a bank's KYC program that knows, for every customer, what is in the file, when each part was checked, which events have arrived since, what was decided about each and who decided it. It pays when it lets the bank stop re-reviewing files that have not changed and start acting on the changes it can see, and when it produces the numbers that show the program works. The business case for moving from calendar reviews to event-driven refresh rests on three things: how much of a periodic review is spent re-collecting what did not change, how many material events the book actually generates, and how much quality control the new model needs. Botminds' Perpetual KYC (pKYC) is built to track at section level and report those numbers; this page shows the arithmetic and the scorecard, and where the case is weaker.

What should a KYC tracking system track?

A KYC tracking system should track four things: the file by section, with a last-reviewed date and sources for each; every event that reaches a customer, with the decision, the rule and the reason; every change, with its maker and a different checker; and the queue, with service levels by risk tier. A system that tracks only the date of the next periodic review is a calendar, and it can only ever produce calendar economics.

Section-level tracking is the feature that pays. Once each section carries its own date and sources, an event that changes ownership can refresh the ownership and geography sections and leave the rest alone, and the file can still show an examiner exactly how current each part is. The event-driven KYC refresh process walks through what that looks like on one file.

What does a KYC periodic review cost?

No government or academic source publishes a cost per periodic review, and the figures that circulate come from industry surveys of uneven method. What the public evidence does establish is the share of compliance cost due diligence takes and the cost of the work at opening, which is the nearest measured analogue.

The GAO's study of 11 banks and credit unions found that customer due diligence and reporting were the two most expensive parts of BSA/AML compliance, at about 29% and 28% of the total on average, and that the selected banks spent an average of $15 per new account on due diligence, from $5 to $44 (GAO-20-574). It also estimated that staff needed about 30 minutes for a new consumer account and over an hour for a business account. A full periodic review of an established corporate customer, with a history to reconcile, is longer.

For the hours inside one refresh, the best available figure is a product estimate, and it should be read as one. Botminds estimates that bringing one corporate customer's file up to date after a change of ownership takes about 13.5 hours of people's time as a full manual review, and about one hour when only the touched sections are refreshed with agents drafting: two hours finding the change, six re-collecting sections, an hour and a half screening, an hour each on the rating and the customer request, and two on approvals and system updates by hand. Neither figure includes the weeks spent waiting for the customer.

The program math: calendar against events

The program math compares the hours a calendar spends re-reviewing unchanged files with the hours an event-driven model spends on real changes, quality control and backstop reviews. The saving is not in any one refresh; it is in the files the event model never opens because nothing happened to them.

To see the shape, take an illustrative book of 10,000 business customers, of which 10% are high risk, 30% medium and 60% low, under a one, three and five year policy. That is 1,000 + 1,000 + 1,200 = 3,200 full reviews a year. At the 13.5-hour estimate, about 43,200 hours. If the bank's replay showed, say, 1,500 material events a year, at the one-hour estimate that is 1,500 hours of refresh work, before quality control and backstops. Those are assumptions for illustration, not benchmarks; the two inputs that decide the case, the bank's own event rate and the minutes per sampled call, come from a replay of its own history.

Which KPIs for KYC refresh?

The KPIs that matter for KYC refresh measure three things: how much work the program avoids, how fast it acts on real changes, and whether the calls it makes, especially the calls to do nothing, are right. A scorecard that reports only completed reviews and overdue reviews measures the calendar, not the risk.

Two of these KPIs are new to most programs and matter most to an examiner. The QC pass rate by trigger family is the only evidence that events closed without action were closed rightly; the time from a mass event to an approved decision shows whether the program can absorb a list update or a policy change without a backlog. Customer due diligence refresh when one event hits thousands shows how the second is produced.

The KYC review queue: what to measure in it

A KYC review queue should be measured by risk, not by volume. The number of open items matters less than how many high-risk items are past their service level, how old the oldest material event is, and whether anything is waiting on a decision only one person can make.

In the sample bank, the head of KYC operations owns 1,184 open material events across 64 analysts and 22 QC reviewers; each event arrives with a service level by tier, one business day for High and three for Medium. Analyst Priya Natarajan works 14 of them. The queue view shows each one with the sections it touched and what the agents drafted, so the analyst can start from the decision rather than from the search.

The analyst's side of the Perpetual KYC (pKYC) queue: approved as maker, waiting for a checker

The new costs an event-driven program brings

An event-driven program is not free, and a business case that leaves out its new costs will not survive its first year. Four costs are real. Quality control grows, because every change still needs a checker and the daily sample of closed events is new work. Backstop reviews remain for files that stay quiet. The trigger policy needs an owner, testing and change control. And the feeds, from registries to transaction monitoring, need to be connected and kept connected.

Customer outreach also changes shape rather than disappearing. Requests become narrower, asking only for what an event made missing, but they need deadlines and consequences. Regulators have ordered banks to set procedures that enforce timely consequences when customers do not supply required due diligence information, as the OCC did in its 2024 order against TD Bank (OCC, TD Bank, 2024), and a tracking system should report how many requests are overdue and what was done about them.

What examiners and boards will read in the numbers

Examiners will read whether the numbers show a working control; boards will read whether they show a program that keeps up. Both are served by the same scorecard, and regulators have signalled that demonstrable results from new technology will count. FinCEN's April 2026 proposed AML/CFT program rule, not yet final, would let the Director consider innovative activities "producing demonstrable outputs evincing the effectiveness of the bank's AML/CFT program (including effective use of artificial intelligence, federated learning, or other advanced monitoring tools)" (FinCEN NPRM, 91 FR 18704).

The operative word is demonstrable. A program that can show pass rates by trigger family, a seeded test before go-live and the time from event to decision is producing exactly the kind of output that language describes. The seeded test for an event-driven KYC review is how the first of those numbers is earned.

What the scorecard is built from in Perpetual KYC (pKYC): each section's own date

Where the case is weaker

The case is weakest where the calendar was already light. A bank with mostly consumer customers, few business accounts and low event rates spends little on periodic review to begin with, and the fixed costs of feeds, policy and quality control may not pay back. A bank whose files are not complete enough to compare changes against needs remediation first. And for a book governed by the EU's refresh ceilings from July 2027, the backstop cannot be stretched beyond one year for higher-risk customers or five for others, which caps the saving there.

The case is strongest for corporate and business books, where ownership and geography change, public filings reveal it and a full review is expensive. It is also where the trigger with the most law behind it, a change of beneficial owner at the 25% line, applies.

Questions people ask

What is KYC management software?

Software that holds customers' due diligence files and manages their review: who is due, what is missing, what changed and who approved it. The more useful products track each section of a file with its own date and source, so an event can refresh part of a file without re-reviewing the whole.

What is a KYC check system?

The term is used loosely for identity verification at onboarding and for screening; for existing customers it usually means the system that checks files are current. In the latter sense it should report the KPIs above, not just a list of overdue reviews.

How much does KYC refresh cost per customer?

No government or academic source publishes a per-review figure. The GAO found due diligence at opening cost $5 to $44 per new account in 2018, and due diligence was about 29% of direct BSA/AML compliance cost on average; a full refresh of an established corporate file is longer than opening one.

What is a good QC pass rate for KYC "no action" calls?

It is a policy choice tied to risk. The sample bank sets a 97% floor by trigger family and opens a rule review when a family falls below it; what matters is that the floor is written down, measured by family and acted on.

How do you build a business case for perpetual KYC?

Count the full reviews the calendar requires each year, replay a past period of your own trigger events to find the material event rate, time a sample of event refreshes and sampled closures, and add backstop reviews and quality control. The difference, with every input from your own book, is the case.