Run Your KYC Refresh Without a Backlog

67% of banks lost clients to slow KYC in 2024. A KYC refresh set by risk and trigger events keeps client files current without a backlog.

Alexander Kiel

Business Analyst · Banking & Wealth Management

16.06.2025 · 8 MIN READ · PROCESS OPTIMISATION

ON THIS PAGE

1. Set Refresh Cycles by Risk

2. Define the Trigger Events

3. Measure the Backlog Honestly

4. Reuse Data Before Asking Clients

5. Plan Capacity Around the Peaks

6. Escalate Clients Who Do Not Respond

Sample case: ABN AMRO

In short

FAQ

Slow KYC costs banks their clients. In a 2024 Fenergo survey of over 450 C-level executives, 67% of banks said they had lost clients due to slow and inefficient onboarding and KYC. Fenergo puts the annual cost of KYC reviews at $60 million for a corporate and institutional bank. The KYC refresh is the regular and event-driven update of each client file. It decides whether that work flows or piles up.

The rules are getting stricter. The EU Anti-Money Laundering Regulation applies from 10 July 2027. It sets maximum update intervals of one year for higher-risk customers and five years for all others. German law already requires client information to be updated at appropriate intervals depending on the risk.

A backlog rarely starts with neglect. It starts with a calendar that makes thousands of reviews due in the same month. Does your bank know how many KYC reviews are overdue today and which clients they concern?

Illustrative KYC refresh plan comparing reviews due per month under one fixed calendar, with peaks above team capacity and a growing backlog, against a risk-based refresh with spread due dates that stays within capacity

0 of 18 done

Click a bullet point to tick it off.

1 · Set Refresh Cycles by Risk

Does your bank still review its low-risk clients as often as its high-risk clients?

☐

Link every review date to the client's current risk rating

☐

Write down the refresh cycle for each risk class in the KYC policy

☐

Recalculate the next due date whenever the risk rating changes

Keep in mind: A shorter cycle is not automatically safer. If the team cannot keep up, it only produces overdue files faster.

FULL STEP

A KYC refresh starts with the cycle. Tie each client's next review date to the risk rating. Review high-risk clients every year and medium-risk clients every two or three years. Review low-risk clients at the longest interval the law allows. One cycle for all clients wastes analyst time on low-risk files.

The EU Anti-Money Laundering Regulation sets the outer limits: customer information must be updated at least every year for higher-risk customers under enhanced due diligence and every five years for all others. Within those limits each bank sets its own cycles. EY found commercial banks using one-, two- and three-year refreshes or one-, three- and five-year refreshes. Wealth and asset managers revisit high-risk customers annually.

2 · Define the Trigger Events

Which trigger events reach your KYC team automatically and which depend on an adviser remembering them?

☐

List every trigger event together with its source system

☐

Set a deadline for each event-driven review

☐

Reset the regular due date after every completed review

Keep in mind: Too many triggers flood the team with low-value reviews. Test each new trigger on a sample of clients before it goes live.

FULL STEP

A fixed due date alone misses what happens between two reviews. Define the events that start an extra review. Examples are a change of domicile or tax residence, a new beneficial owner, a negative press report, an alert for a politically exposed person or account activity that no longer fits the client profile.

The EU regulation requires a review when there is a change in the relevant circumstances of a customer. The German Money Laundering Act already sets the same trigger for existing clients in § 10(3a) GwG. EY lists adverse media results, politically exposed person alerts, out-of-pattern activity and SAR filings as possible triggers. Perpetual KYC goes furthest. It reviews clients mainly when something happens, not on fixed dates.

3 · Measure the Backlog Honestly

How many overdue KYC reviews in your bank wait for the client and how many for the bank?

☐

Report overdue reviews weekly by risk class and business line

☐

Split waiting time between the client and the bank

☐

Merge duplicate client records before counting the backlog

Keep in mind: Closing easy low-risk files first makes the backlog figure fall quickly. Overdue high-risk files must still come first.

FULL STEP

A KYC backlog that nobody counts keeps growing. Report overdue reviews every week by risk class, business line and days overdue. Separate files waiting for the client from files waiting for the bank. The two need different fixes: reminders for the first, more staff or better data for the second.

Count each client once. EY recommends that institutions deduplicate their own customer population across business lines to consolidate refresh efforts. A client with an account, a mandate and a loan then gets one review instead of three. Fenergo found that over half of financial institutions spend between 61 and 150 days on KYC client reviews. My article on as-is process mapping shows how to find the steps where refresh files wait longest.

4 · Reuse Data Before Asking Clients

How many questions in your bank's refresh letter ask for data the bank already holds?

☐

Pre-fill each review from client data the bank already holds

☐

Send each client one request that lists only the missing items

☐

Use planned adviser meetings to collect refresh documents

Keep in mind: Reused data must still be valid. An expired passport copy from another business line does not complete a KYC file.

FULL STEP

Every question sent to a client costs time on both sides. Before you contact anyone, pre-fill the KYC refresh with data the bank already holds. Sources are core banking records, the CRM, screening results, public registers and recent documents from other business lines. Then ask the client only for what is missing. Working with relationship managers on KYC documents, I found clients accepted a refresh more easily when their adviser explained why than when a form simply arrived.

Data is often the real bottleneck. In Fenergo's 2024 survey, 86% of banks named poor data management and siloed processes as a reason for losing clients. EY notes that wealth managers use scheduled KYC touchpoints for refresh activities. It adds that risk-based programmes avoid unnecessary customer outreach. My article on the data quality framework explains how a golden source for client data makes this reuse reliable.

5 · Plan Capacity Around the Peaks

In which month of next year will your KYC team face the most reviews?

☐

Forecast KYC reviews due each month for the next 12 months

☐

Bring low-risk reviews forward to flatten the peak months

☐

Agree extra capacity before the peak months arrive

Keep in mind: Never push a review beyond its legal maximum to smooth the curve. Flatten peaks by working earlier, not later.

FULL STEP

KYC backlogs grow where due dates bunch up. An onboarding campaign, a merger or an earlier clean-up project can leave thousands of reviews due in the same months. Forecast the reviews due each month for the next year. Bring some low-risk reviews forward to flatten the peaks. Plan analyst capacity on the real volume per risk class.

Each review has a price. Fenergo built its estimate of a corporate bank's yearly review bill on 26,800 medium-risk clients at $2,250 per case. In EMEA, LexisNexis Risk Solutions found that 72% of organisations noticed rises in labour costs for financial crime compliance. A weekly capacity report keeps the forecast current, as my article on how to automate reports in Excel describes.

6 · Escalate Clients Who Do Not Respond

How long does an unanswered KYC request stay open in your bank before someone decides?

☐

Set a fixed number of reminders and a final deadline

☐

Involve the relationship manager before any restriction

☐

Record each exit decision together with its reason

Keep in mind: Restrictions and exits affect clients directly and depend on national law and contract terms. Involve Compliance and Legal in every case.

FULL STEP

Some clients never answer a refresh request. Set a fixed path for them: two reminders, a call from the relationship manager, limits on new business and finally a decision on the relationship. Without that path, unanswered files sit in the backlog for years.

The EU regulation is clear about the last step. A bank that cannot complete customer due diligence shall terminate the business relationship and consider reporting a suspicious transaction to the FIU. The EBA warns against exits by reflex: before making a decision to reject a customer, several options need to be considered. It adds that the de-risking of entire categories of customers without looking at individual risk can be unjustified.

What You Can Do to Stop Economic Crime | Hanjo Seibert (Managing Director & Partner @ BCG)

SAMPLE CASE

ABN AMRO

In April 2021 ABN AMRO agreed to pay EUR 480 million, a fine of EUR 300 million plus EUR 180 million in disgorgement. The Dutch Public Prosecution Service found that the bank had structurally failed to carry out client due diligence in sufficient depth.

Client files were the weak point. In many of them, client data or documents were missing, or the source of data was unclear. Without periodic reviews of clients, the bank risked missing relevant information. For several years it also struggled with a backlog in handling alerts.

Catching up was expensive. ABN AMRO brought its client lifecycle processes together in October 2018. It then ran a Detecting Financial Crime programme. By the end of 2020, 3,800 full-time employees, one in five jobs at the bank, worked in Client LifeCycle processes. The programme was planned to end in 2022. It was still expected to finish in 2023 when the bank reported its 2022 results.

Key takeaway: A refresh backlog never stays small or cheap. Review client files on time, by risk and by trigger event. That spares a bank the clean-up programme, the penalty and the extra staff that catching up demands.

"This is unacceptable and we take full responsibility for this."

Robert Swaak (CEO @ ABN AMRO)

In Short

A KYC refresh without a backlog rests on six habits. Set refresh cycles by risk. Define clear trigger events. Count the backlog honestly every week. Reuse the data the bank already holds. Plan capacity around the peaks. Keep a fixed path for clients who do not respond.

The result is client files that stay current and fewer letters to clients. The KYC team gets a predictable workload. The bank is ready for the EU Anti-Money Laundering Regulation before July 2027.

Frequently Asked Questions

What is a KYC refresh?

A KYC refresh is the update of a client's know-your-customer file after onboarding. The bank checks identity documents, beneficial owners, source of wealth, tax residence and the risk rating against current information. Refreshes run on a fixed cycle by risk class. They also run after trigger events, such as a change of domicile, a new beneficial owner or a negative press report.

How often must banks refresh KYC under the EU AMLR?

From 10 July 2027, the EU Anti-Money Laundering Regulation sets two limits. Banks must update customer information at least every year for higher-risk customers under enhanced due diligence. For all other customers, the limit is at least every five years. Banks may choose shorter cycles. A relevant change in a customer's situation also requires a review, whatever the next due date is.

What is the difference between KYC refresh and KYC remediation?

A KYC refresh is the routine update of client files on a cycle or after a trigger event. A KYC remediation is a one-off project that repairs many old or incomplete files at once. It often follows an audit finding, a new regulation or a merger. A well-run refresh process keeps a bank from needing a large remediation project later.