KYC remediation: what it is, the process and how banks get it done

If you run KYC operations at a corporate, investment or commercial bank, you don’t need convincing that remediation matters. What you need is a way to work through thousands of customer files, each with its own ownership structure, jurisdictions and document trail, without stalling client relationships or overrunning the budget.

The problem is rarely that onboarding was done badly. It’s that standards have moved faster than the files. A corporate client onboarded under a 2018 policy may now be missing ownership data, screening results or verification evidence that today’s policy requires.

What’s changed is that this is no longer a single-jurisdiction problem with a single deadline. The EU’s Anti-Money Laundering Regulation (AMLR) sets hard maximum intervals between customer updates from July 2027. Australia’s reformed ongoing customer due diligence obligations are already live. The SEC’s Treasury clearing mandate puts a date on resolving every client entity in a US Treasury book. Ireland has just launched its most significant financial crime overhaul in years. For any bank operating across more than one of these, the size of the gap in the back book is about to become very visible, in several places at once. We cover each of these in the regulatory context section below.

What is KYC remediation?

KYC remediation is the process of reviewing existing customer files, fixing anything that falls short of current regulation or internal policy, and re-rating the customer’s risk. That means collecting and verifying the missing information until every file is complete, accurate and correctly rated. For banks, it usually applies to the back book: customers onboarded under older standards.

It is a corrective exercise. It takes the existing customer data a financial institution already holds, compares each record against the standard it should meet today, and closes the gaps.

For legal entity customers, that goes well beyond replacing an expired document. A remediated corporate KYC file typically needs current and verified:

• company registry data and legal form
• ownership and control structure, traced through to ultimate beneficial owners (UBOs)
• directors, controllers and authorized signatories
• nature and purpose of the relationship and expected activity
• sanctions, politically exposed person (PEP) and adverse media screening results for the entity and its related parties
• a risk rating that reflects all of the above, with the rationale recorded

The goal isn’t clean customer records for their own sake. It’s a file that stands up to an auditor or supervisor, and a risk rating the bank can defend.

What triggers KYC remediation?

AMLR: the trigger with the hardest numbers attached

AMLR is a directly applicable EU regulation that replaces national implementations of the AML directives with a single rulebook from 10 July 2027. Several provisions change what “up to date” means for an existing KYC file:

• Maximum update intervals. Article 26(2) caps the time between customer information updates at one year for higher-risk customers and five years for all other customers.
• Event-driven updates. On top of those periodic updates, customer information must be reviewed when relevant circumstances change. AMLA’s draft guidelines on ongoing monitoring point to triggers such as changes in identity, ownership or legal status, transactional anomalies, adverse media or PEP status.
• Beneficial ownership threshold. The threshold moves from “more than 25%” to “25% or more”, bringing additional individuals into scope.
• Targeted financial sanctions. Verifying whether customers are subject to EU targeted financial sanctions becomes part of the core AML framework.

The operational impact is easy to underestimate. Take an illustrative bank with 20,000 corporate relationships, 15% of them rated higher risk. It would need around 3,000 higher-risk reviews every year, plus an average of 3,400 reviews a year across the remaining 17,000 clients to stay within the five-year limit. That’s roughly 6,400 reviews annually before a single event-driven trigger. Files that don’t already meet the new standard need remediating before that cycle can even run cleanly.

AMLR applies to EU entities, but UK and US banks with EU subsidiaries, branches or clients will feel it too. It is also not the only clock running. Australia’s reformed ongoing CDD obligations took effect in March 2026, the SEC’s Treasury clearing deadlines land in December 2026 and June 2027, and Ireland’s new AML strategy adds national requirements on top of AMLR. The regulatory context section sets out what each one asks of an existing customer file.

KYC remediation vs KYC refresh vs periodic review vs perpetual KYC

These terms are often used interchangeably, but they describe different activities. Getting the distinction right helps you scope programmes, budget, and explain to clients why you’re contacting them.

In practice, remediation is what happens when refresh and periodic review haven’t kept pace with changing standards. Perpetual KYC aims to make large remediation programmes the exception rather than a recurring cost.

The KYC remediation process in five steps

A successful KYC remediation process starts before any file is opened: agree and document the standard every file must meet for each customer segment, and make sure it reflects the regulatory compliance obligations in every jurisdiction you and your clients operate in. A standard that shifts halfway through a programme is one of the fastest ways to generate rework.

Step 1: Triage and prioritize the back book

Segment your existing customer data by risk rating, jurisdiction, entity type and date of last review, then start with higher-risk clients and the segments with the greatest regulatory exposure. Separate files that can likely be completed from public data from those that will need customer outreach, and flag relationships where exit may make more sense than remediation.

Related solution: EC Review, for bulk cleanse of the existing book.

Step 2: Run a gap analysis

Compare each file against its segment’s standard to find missing or expired documents, unverified UBOs, out-of-date screening and conflicting internal data. Record gaps at data-attribute level: “missing verified date of birth for a 30% shareholder” is actionable in a way that “file incomplete” isn’t.

Step 3: Collect data and reach out to clients

Source everything you can independently first, from registries, filings and premium data providers. Then send a single, consolidated request for only the customer information that can’t be found elsewhere, explaining why it’s needed. Keeping customer outreach to one round is the difference between a remediation process clients tolerate and one they resent.

Related solutions: EC Public Automation and EC Private Outreach.

Step 4: Verify, rebuild ownership and re-screen

Verify information against independent sources and rebuild the ownership and control structure to identify UBOs, which is far faster when the structure is visualized rather than pieced together by hand. Then re-screen the entity, UBOs, directors and related parties against sanctions, PEP and adverse media sources.

Related capabilities: UBO verification and screening.

Step 5: Re-rate, sign off and record the audit trail

Recalculate the risk rating, escalate to enhanced due diligence where needed, apply QA, and record a clear decision to retain, restrict or exit. Capture every search, source and decision with its rationale so the file stands up to audit, then set the next review date so the file moves from remediation into your regular refresh and ongoing monitoring cycle.

Related capabilities: dynamic audit trail and EC Review, for the ongoing refresh cycle the file moves into.

Red flags to watch for during KYC remediation

Remediation often surfaces risks that weren’t visible at onboarding. Watch for:

• Opaque or circular ownership. Layered holding companies, trusts or nominee arrangements that make it hard to identify UBOs, especially across multiple jurisdictions.
• Registry mismatches. Differences between what the client has told you and what company registries show about directors, shareholders or addresses.
• Frequent changes in control. Repeated changes of directors, shareholders or registered address in a short period.
• Reluctance to provide information. Unexplained delays, partial responses or pushback on routine requests.
• Shell company characteristics. No clear operating activity, minimal staff, or a registered address shared with many unrelated entities.
• High-risk jurisdictions. New or existing links to jurisdictions on FATF or internal high-risk lists.
• Indirect sanctions exposure. Ownership or control by designated persons, even where the entity itself isn’t listed.
• New PEP or adverse media connections. Related parties who have become politically exposed, or negative news about the entity or its owners.
• Activity inconsistent with the profile. Transaction patterns that don’t match the stated business, or dormant relationships that suddenly reactivate.

A red flag doesn’t automatically mean exit. It means the file needs escalation, further investigation and a documented decision.

How long KYC remediation takes, and what drives cost

Programme length depends far more on the make-up of the back book than on its size alone. The main cost and timeline drivers are:

• Entity complexity. Multi-layered ownership structures take many times longer to remediate than simple ones.
• How much needs customer outreach. Files completed from public data move quickly. Files waiting on client responses don’t.
• Number of jurisdictions. Each registry has its own data formats, access routes and quality.
• Internal data quality. Customer records that are fragmented or conflicting across legacy systems add investigation and reconciliation time.
• Analyst capacity. Experienced KYC analysts are scarce and expensive, and backlogs grow when they’re spent on data gathering rather than judgement.
• QA and rework. Inconsistent standards lead to files failing review and being reworked.
• Moving goalposts. Policy changes mid-programme can reopen files already closed.

To estimate what automation could save on your own programme, try the Encompass ROI calculator.

Why remediation programmes stall

Most financial institutions know what good remediation looks like. Delivering it at scale is harder, for five main reasons:

• Volume and complexity. Thousands of legal entity files, each spanning multiple registries and jurisdictions.
• Speed vs accuracy. Regulatory deadlines push for speed, but rushed files fail QA or, worse, supervisory scrutiny.
• Analyst shortages. Teams spend their time collecting data instead of assessing risk.
• Client friction. Corporate clients are already frustrated with KYC. Our research found that KYC dissatisfaction among corporate treasurers has reached 95%. Every unnecessary outreach request adds to that.
• Fragmented technology. Legacy systems that don’t integrate with modern KYC tools create silos, duplicate data entry and inconsistent customer records.

What this looks like in practice

The same bottlenecks that stall remediation (manual data gathering, rework and repeated client outreach) are where Encompass clients have seen the biggest gains:

• Faster KYC cycles. One Tier 1 bank using Encompass reduced its KYC cycle from multiple days to just a few hours.
• Less rework. A Tier 1 bank eliminated checking, rework and human error in KYC, significantly increasing analyst productivity and capacity while reducing costs.
• Lighter client outreach. ING uses EC Private Outreach to reduce the KYC compliance burden for both its customers and the bank.

The regulatory context: UK, US, EU, Ireland and Australia

United Kingdom

The Money Laundering Regulations 2017 require financial institutions to apply customer due diligence to existing customers on a risk-sensitive basis, including when their circumstances change, and to carry out ongoing monitoring of business relationships. The FCA supervises banks’ compliance, and the Joint Money Laundering Steering Group (JMLSG) guidance sets out how the rules apply in practice. The UK sets no fixed maximum review interval, which means the risk-based justification for your own cadence has to be documented and defensible.

United States

Two things are happening at once in the US, and they pull in different directions.

FinCEN’s Customer Due Diligence (CDD) Rule requires banks to identify and verify the beneficial owners of legal entity customers. That means each individual owning 25% or more, plus one individual with significant control. Banks must also maintain and update customer information through ongoing monitoring on a risk basis. Examiner findings and consent orders remain among the most common triggers for large-scale remediation.

What’s changed is where the evidence comes from. With federal beneficial ownership reporting for domestic entities now withdrawn, the bank’s own verification work has become the primary source of beneficial ownership evidence for US entities, rather than something a register can corroborate. The CDD Rule’s obligations are unchanged; the supporting infrastructure behind them is not. See: the federal beneficial ownership register is gone

The SEC’s Treasury clearing mandate

Separately, the SEC’s mandatory central clearing requirement for US Treasury transactions applies to eligible cash transactions from 31 December 2026 and eligible repo transactions from 30 June 2027. It isn’t an AML rule, but it creates a remediation programme in everything but name: before a trade can clear, a firm has to evidence, at legal-entity level, each client’s FINRA registration status and CRD number, its FICC membership status and member number, and that its own records resolve to the correct legal entity rather than a trading name, abbreviation or parent group.

In practice the obstacle is usually that last point. The entity-resolution gap in existing records is the same underlying problem KYC remediation solves, against a harder deadline. See: the SEC’s Treasury clearing mandate turned your client book into a deadline

European Union

AMLR (Regulation (EU) 2024/1624) applies in all 27 member states from 10 July 2027, replacing national implementations of the AML directives with a single rulebook. Its maximum update intervals, one year for higher-risk customers and five years for everyone else, are the hardest numbers any of these regimes puts on an existing file, and the reason AMLR is the trigger most EU-exposed banks are scoping for. The beneficial ownership threshold also moves from “more than 25%” to “25% or more”, bringing additional individuals into scope of files that were previously complete.

Supervision is changing alongside the rules. The EU’s new Anti-Money Laundering Authority (AMLA), based in Frankfurt, has moved from establishment into taking on direct supervisory responsibility for selected large cross-border institutions, with national supervisors coordinated beneath it. The practical consequence for remediation is less about new obligations and more about scrutiny: legacy files spread across disconnected CLM systems, manual KYC processes and inconsistent data models are exactly what a more centralized supervisor is equipped to find. See: AMLA explained

Ireland

Ireland launched its first national strategy on anti-money laundering, counter-terrorist financing and counter-proliferation financing on 13 August 2026. The Tánaiste and Minister for Finance described it as the most significant strengthening of the country’s financial crime framework in years. It builds on the 2026 National Risk Assessment and brings tighter rules on crypto-asset transfers, greater transparency around corporate ownership, new disclosure requirements for limited partnerships and other higher-risk vehicles, and closer intelligence sharing between the Central Bank, Revenue, the Criminal Assets Bureau and law enforcement.

For banks with Irish operations this lands roughly a year before AMLR does, which makes the sequencing matter: the ownership transparency and higher-risk-vehicle work can be scoped once and satisfy both. See: Ireland’s toughest AML shake-up in years

Australia

The AML/CTF Amendment Act 2024 reformed Australia’s regime, with the new AML/CTF Rules taking effect on 31 March 2026 and Tranche 2 sectors, including legal, accounting and real estate, brought into scope from 1 July 2026.

The detail that matters for remediation is the asymmetry in the transition. Existing reporting entities have until 30 March 2029 to move to the reformed initial customer identification requirements, and can continue using pre-reform procedures for nominated customer classes in the meantime, provided they have a transitional policy in place setting out those classes and when each will switch. Ongoing customer due diligence has no transition period at all. It applies without exception from 31 March 2026.

That split is easy to misread. It means the obligation to keep existing customer information current is already live, even where the obligation to re-identify those customers to the new standard is years away. For a bank with an Australian book, ongoing CDD is the part that needs to be defensible now.

What this means in practice

No single jurisdiction’s requirements are a superset of the others. AMLR sets the tightest intervals, Australia’s ongoing CDD obligations are live earliest, the SEC mandate demands entity-level precision the AML rules don’t, and the UK and US both place the weight of justification on the bank’s own documented reasoning.

The practical response isn’t five parallel programmes. It’s defining the file standard once, at the high-water mark across every jurisdiction you and your clients operate in, and remediating against that. This is what makes the standard-setting step before step 1 worth the time it takes.

How technology changes KYC remediation

Manual remediation scales linearly: more customer files means more analysts. Encompass automates the most time-consuming parts of each step, from bulk uploading files and gathering public and premium data to visualizing ownership structures, screening related parties and recording a full audit trail. That frees skilled analysts to focus on exceptions and judgement calls.

The bigger shift is what happens afterwards. Once a client has a complete, real-time corporate digital identity (CDI) profile, future refreshes and periodic reviews start from current data rather than from scratch. That’s how banks move from repeated remediation projects towards perpetual KYC.

Find out how Encompass helps banks automate KYC remediation and refresh, or explore EC Review.

KYC remediation FAQs

What does remediation mean in banking?

In banking, remediation means correcting a regulatory compliance gap. In a KYC context, it’s the work of bringing existing customer records up to the current standard, usually after a regulatory change, audit finding, enforcement action or acquisition.

What does it mean if an account is in remediation?

It means the bank has flagged the customer’s KYC file as incomplete or out of date and has started the remediation process to update it. The customer may be asked for information or documents, and depending on the bank’s policy and the level of risk, some activity may be restricted until the review is complete.

What are the 5 stages of KYC?

Frameworks vary, but KYC is commonly described in five stages: customer identification and verification, customer due diligence, risk assessment, enhanced due diligence where the risk requires it, and ongoing monitoring. Remediation sits within ongoing monitoring.

Is KYC a legal requirement in the UK?

Yes. Under the UK Money Laundering Regulations 2017, banks and other regulated firms must carry out customer due diligence, apply it to existing customers on a risk-sensitive basis, and conduct ongoing monitoring. The FCA supervises banks’ compliance.

How often should KYC be refreshed?

It depends on the customer’s risk rating and the rules that apply to you. Many banks refresh higher-risk customers annually and lower-risk customers every three to five years. Under the EU’s AMLR, from July 2027 the maximum interval is one year for higher-risk customers and five years for all others.

Final thoughts

KYC remediation isn’t a one-off clean-up. With AMLR setting hard maximums on update intervals, and supervisors in the UK and US continuing to scrutinize ongoing monitoring, the financial institutions that cope best will be those that fix their existing customer data once and then keep it current.

Get in touch to find out how Encompass can transform your KYC remediation programme.

Editor’s note: This article was first published on 24 June 2024. It was substantially updated on 2 November 2026 to reflect AMLR, current UK and US requirements, and Encompass’ experience of supporting bank remediation programmes.