A KYC file is not a folder of identity documents. It is the evidence that you knew who your customer was, understood the risk they carried, and kept watching them for as long as the relationship lasted. When an examiner opens a file, they are testing that chain of reasoning, not the neatness of the scan quality.
Identification is the beginning, not the file
Identification establishes who the customer claims to be: legal name, registration or identity number, address, and the individuals who control the entity. Verification establishes that those claims are true, using independent sources rather than client-supplied copies alone.
A defensible file records both steps separately, names the source relied on, and notes the date the check was performed. Where an original document could not be obtained, the file should say what alternative evidence was accepted and why it was sufficient.
- Constitutional documents, register extracts or government-issued identification, captured and dated.
- The independent source used to corroborate each item, such as a registry lookup, sanctions screening result or verified database.
- The reviewer's name, the review date and the approval decision.
Beneficial ownership needs a trail
For entities, the file should show the ownership chain from the client down to each natural person who ultimately benefits, including the percentage held at each layer. Screenshots of a corporate registry are useful; a written articulation of the chain is what makes them evidence.
Where ownership is layered across jurisdictions or held through nominees, examiners expect the file to demonstrate that you tested the structure rather than accepting the client's summary. If a layer could not be verified, say so, and record the risk decision that followed.
Risk rating with a stated basis
A risk rating is a conclusion, and conclusions need support. A defensible file sets out the factors that drove the rating, such as customer type, geography, product, delivery channel and transaction profile, and states which of them pushed the customer higher.
Ratings that have never changed are a signal in themselves. The file should show that the rating was revisited when the relationship changed: new ownership, a shift in volume, a new jurisdiction, or an adverse media hit.
Ongoing monitoring is where files usually fail
Most of the deficiencies we see are not in onboarding. They are in the twelve to thirty-six months that follow, where the file shows no evidence that anyone looked at the relationship again. Examiners read silence as absence of monitoring.
Monitoring evidence should tie to the risk rating: higher-risk customers reviewed more often, with the review documented in a way that shows what was examined, including transaction activity against expectations, screening results, changes in beneficial ownership, and the basis for continuing the relationship.
- Periodic review completed within the frequency your policy sets for that risk band.
- Screening results retained, including false-positive dispositions and who cleared them.
- Escalations recorded with the decision made, not only the alert that triggered them.
What an examiner tests first
In practice, examiners sample files and trace a small number of threads: the identity of the customer, the basis for the risk rating, the last monitoring event, and whether any alerts were raised and how they were resolved. Files that answer those four questions cleanly tend to survive the sample.
The pattern that fails is fragmentation: documents in one system, screening results in an inbox, review notes in a spreadsheet, and no single record connecting them. Remediation then becomes a reconstruction exercise under time pressure.
The standard is not perfection of the original file; it is the ability to demonstrate a documented, risk-based judgement at each stage of the relationship.
