KYC Refresh Process for Banks Without a Backlog

Run Your KYC Refresh Without a Backlog

67% of banks lost clients to slow KYC in 2024. A KYC refresh set by risk and trigger events keeps client files current without a backlog.

Alexander Kiel

Business Analyst · Banking & Wealth Management

16.06.2025 · 8 MIN READ · PROCESS OPTIMISATION

ON THIS PAGE

1. Set Refresh Cycles by Risk

2. Define the Trigger Events

3. Measure the Backlog Honestly

4. Reuse Data Before Asking Clients

5. Plan Capacity Around the Peaks

6. Escalate Clients Who Do Not Respond

Sample case: ABN AMRO

In short

FAQ

Slow KYC costs banks their clients. In a 2024 Fenergo survey of over 450 C-level executives, 67% of banks said they had lost clients due to slow and inefficient onboarding and KYC. Fenergo puts the annual cost of KYC reviews at $60 million for a corporate and institutional bank. The KYC refresh, the periodic and event-driven update of each client file, decides whether that work flows or piles up.

The rules are getting firmer. The EU Anti-Money Laundering Regulation applies from 10 July 2027 and sets maximum update intervals of one year for higher-risk customers and five years for all others. German law already requires client information to be updated at appropriate intervals depending on the risk.

A backlog rarely starts with neglect. It starts with a calendar that makes thousands of reviews due in the same month. Does your bank know how many KYC reviews are overdue today and which clients they concern?

Illustrative KYC refresh plan comparing reviews due per month under one fixed calendar, with peaks above team capacity and a growing backlog, against a risk-based refresh with spread due dates that stays within capacity

STEP 1

Set Refresh Cycles by Risk

A KYC refresh starts with the cycle. Tie each client's next review date to the risk rating: high-risk clients every year, medium-risk clients every two or three years and low-risk clients at the longest interval the law allows. One cycle for all clients wastes analyst time on low-risk files.

The EU Anti-Money Laundering Regulation sets the outer limits: customer information must be updated at least every year for higher-risk customers under enhanced due diligence and every five years for all others. Within those limits each bank sets its own cycles. EY found commercial banks using one-, two- and three-year refreshes or one-, three- and five-year refreshes, while wealth and asset managers revisit high-risk customers annually.

✓

Link every review date to the client's current risk rating

✓

Document the refresh cycle for each risk class in the KYC policy

✓

Recalculate the next due date whenever the risk rating changes

Does your bank still review its low-risk clients as often as its high-risk clients?

Keep in mind: A shorter cycle is not automatically safer. If the team cannot keep up, a shorter cycle only produces overdue files faster.

STEP 2

Define the Trigger Events

A periodic due date alone misses what happens between two reviews. Define the trigger events that start an event-driven KYC review: a change of domicile or tax residence, a new beneficial owner, an adverse media hit, a politically exposed person alert or account activity that no longer fits the client profile.

The EU regulation requires a review when there is a change in the relevant circumstances of a customer. The German Money Laundering Act already sets the same trigger for existing clients in § 10(3a) GwG. EY lists adverse media results, politically exposed person alerts, out-of-pattern activity and SAR filings as possible triggers. Perpetual KYC takes this furthest and reviews clients mainly on events rather than dates.

✓

List every trigger event together with its source system

✓

Set a deadline for each event-driven review

✓

Reset the periodic due date after every completed review

Which trigger events reach your KYC team automatically and which depend on an adviser remembering them?

Keep in mind: Too many triggers flood the team with low-value reviews. Test each new trigger on a sample of clients before it goes live.

STEP 3

Measure the Backlog Honestly

A KYC backlog that nobody counts keeps growing. Report overdue reviews every week by risk class, business line and days overdue. Separate files waiting for the client from files waiting for the bank, because the two need different fixes: reminders for the first, capacity or better data for the second.

Count each client once. EY recommends that institutions deduplicate their own customer population across business lines to consolidate refresh efforts, so a client with an account, a mandate and a loan gets one review instead of three. Fenergo found that over half of financial institutions spend between 61 and 150 days on KYC client reviews. My article on as-is process mapping shows how to find the steps where refresh files wait longest.

✓

Report overdue reviews weekly by risk class and business line

✓

Split waiting time between the client and the bank

✓

Merge duplicate client records before counting the backlog

How many overdue KYC reviews in your bank wait for the client and how many for the bank?

Keep in mind: Closing easy low-risk files first makes the backlog figure fall quickly. Overdue high-risk files must still come first.

STEP 4

Reuse Data Before Asking Clients

Every question sent to a client costs time on both sides. Before any outreach, pre-fill the KYC refresh with data the bank already holds: core banking records, the CRM, screening results, public registers and recent documents from other business lines. Then ask the client only for what is missing. Working with relationship managers on KYC documents, I found clients accepted a refresh more easily when their adviser explained why than when a form simply arrived.

Data is often the real bottleneck. In Fenergo's 2024 survey, 86% of banks named poor data management and siloed processes as a reason for losing clients. EY notes that wealth managers use scheduled KYC touchpoints for refresh activities and that risk-based programmes avoid unnecessary customer outreach. My article on the data quality framework explains how a golden source for client data makes this reuse reliable.

✓

Pre-fill each review from client data the bank already holds

✓

Send each client one request listing only the missing items

✓

Use scheduled adviser meetings to collect refresh documents

How many questions in your bank's refresh letter ask for data the bank already holds?

Keep in mind: Reused data must still be valid. An expired passport copy from another business line does not complete a KYC file.

STEP 5

Plan Capacity Around the Peaks

KYC backlogs grow where due dates cluster. An onboarding campaign, a merger or an earlier remediation project can leave thousands of reviews due in the same months. Forecast the reviews due per month for the next year, bring some low-risk reviews forward to flatten the peaks and plan analyst capacity on the real volume per risk class.

Each review has a price. Fenergo built its estimate of a corporate bank's annual review bill on 26,800 medium-risk clients at $2,250 per case. In EMEA, LexisNexis Risk Solutions found that 72% of organisations noticed rises in labour costs for financial crime compliance. A weekly capacity report keeps the forecast current, as my article on how to automate reports in Excel describes.

✓

Forecast KYC reviews due per month for the next 12 months

✓

Bring low-risk reviews forward to flatten the peak months

✓

Agree extra capacity before the peak months arrive

In which month of next year will your KYC team face the most reviews?

Keep in mind: Never push a review beyond its legal maximum to smooth the curve. Peaks are flattened by working earlier, not later.

STEP 6

Escalate Clients Who Do Not Respond

Some clients never answer a refresh request. Set a fixed escalation path for the KYC refresh: two reminders, a call from the relationship manager, restrictions on new business and finally a decision on the relationship. Without that path, unanswered files sit in the backlog for years.

The EU regulation is clear about the last step. A bank that cannot apply customer due diligence shall terminate the business relationship and consider reporting a suspicious transaction to the FIU. The EBA warns against exits by reflex: before making a decision to reject a customer, several options need to be considered. It adds that the de-risking of entire categories of customers without looking at individual risk can be unwarranted.

✓

Set a fixed number of reminders and a final deadline

✓

Involve the relationship manager before any restriction

✓

Record each exit decision together with its reason

How long does an unanswered KYC request stay open in your bank before someone decides?

Keep in mind: Restrictions and exits affect clients directly and depend on national law and contract terms. Involve Compliance and Legal in every case.

What You Can Do to Stop Economic Crime | Hanjo Seibert (Managing Director & Partner @ BCG)

SAMPLE CASE

ABN AMRO

In April 2021 ABN AMRO agreed to pay EUR 480 million, a fine of EUR 300 million plus EUR 180 million in disgorgement. The Dutch Public Prosecution Service found that the bank had structurally failed to carry out client due diligence in sufficient depth.

Client files were the weak point. In many of them, client data or documents were missing, or the source of data was unclear. Without periodic reviews of clients, the bank risked missing relevant information. For several years it also struggled with a backlog in handling alerts.

Catching up was expensive. After centralising its client lifecycle processes in October 2018, ABN AMRO ran a Detecting Financial Crime programme. By the end of 2020, 3,800 full-time employees, one in five jobs at the bank, worked in Client LifeCycle processes. Planned to end in 2022, the programme was still expected to finish in 2023 when the bank reported its 2022 results.

Key takeaway: A refresh backlog never stays small or cheap. Reviewing client files on time, by risk and by trigger event, spares a bank the remediation programme, penalty and extra staff that catching up demands.

"This is unacceptable and we take full responsibility for this."

Robert Swaak (CEO @ ABN AMRO)

In Short

A KYC refresh without a backlog rests on six habits: refresh cycles set by risk, clear trigger events, an honest weekly count, reuse of the data the bank already holds, capacity planned around the peaks and a fixed path for clients who do not respond.

The result is client files that stay current, fewer letters to clients, a predictable workload for the KYC team and a bank that is ready for the EU Anti-Money Laundering Regulation before July 2027.

Frequently Asked Questions

What is a KYC refresh?

A KYC refresh is the update of a client's know-your-customer file after onboarding. The bank checks identity documents, beneficial owners, source of wealth, tax residence and the risk rating against current information. Refreshes run on a fixed cycle by risk class and after trigger events such as a change of domicile, a new beneficial owner or an adverse media hit.

How often must banks refresh KYC under the EU AMLR?

From 10 July 2027 the EU Anti-Money Laundering Regulation requires banks to update customer information at least every year for higher-risk customers under enhanced due diligence and at least every five years for all other customers. Banks may choose shorter cycles. A relevant change in a customer's circumstances also requires a review, whatever the next due date is.

What is the difference between KYC refresh and KYC remediation?

A KYC refresh is the routine update of client files on a cycle or after a trigger event. A KYC remediation is a one-off project that repairs many outdated or incomplete files at once, often after an audit finding, a new regulation or a merger. A well-run refresh process is what keeps a bank from needing a large remediation project later.