KYC operations guide and editable checklist
Know Your Customer Checklist 2026
Published · Last updated
A practical KYC checklist for onboarding teams, with individual and business document lists, 24 editable controls, and clear rules for evidence, exceptions, and approval.
A know your customer checklist records the checks needed to understand a customer, verify identity, assess risk, and keep the relationship under review. Actigy BPO’s KYC checklist connects each check to its evidence, owner, and escalation route. It helps teams prepare consistent case files while the regulated business retains policy and customer acceptance decisions.
At handoff, the next reviewer should be able to see what was checked, what remains unresolved, and who can decide. A passport image and a green status field do not provide that record on their own.
This guide is for bank, payments, and fintech operations teams designing or improving a review queue. It is an operating template, not a universal legal form. Your compliance owner should map it to the entity, product, jurisdiction, and approved policy before use.
Download the editable Actigy BPO KYC checklist (Word) or get the printable PDF. Both include evidence references, review status, exceptions, and client sign-off fields. No email is required.
What a KYC checklist should include
Use these eight stages to organize the work. The level of checking within each stage depends on the applicable rules and the customer’s risk.
| Stage | What the case should show |
|---|---|
| 1 Set scope | Customer type, relevant jurisdiction, product, policy version, and assigned reviewer |
| 2 Verify identity | Required attributes, verification method, result, and unresolved mismatches |
| 3 Establish ownership | Business existence, ownership and control, and authority to act where relevant |
| 4 Review screening | Applicable sanctions checks, PEP assessment, and relevant adverse information |
| 5 Assess the relationship | Purpose, expected activity, risk rationale, and any enhanced review |
| 6 Check the evidence | Evidence references, quality review, and exceptions with named owners |
| 7 Record the decision | Authorized decision, reasoning, restrictions, and outstanding actions |
| 8 Maintain the file | Monitoring handoff, review triggers, retention rules, and access controls |
What current research says about onboarding and fraud
The evidence points to three separate pressures: customers leave slow onboarding processes, identity attacks evolve, and compliance work remains expensive. The figures below measure different populations. They should not be combined into a single KYC failure rate.
| Finding | Period and population | How to use it |
|---|---|---|
| 70% reported losing clients because of inefficient onboarding | Fenergo 2025 survey of 600 senior decision-makers across banks, asset managers, and fund administrators [1] | Track unresolved handoffs and waiting time |
| Around 10% average onboarding abandonment | Same Fenergo survey [1] | Compare only with a consistently defined internal cohort |
| US$72.9 million average annual AML/KYC operating spend | Same Fenergo survey [1] | Context for large institutions, not a small-fintech budget |
| 11% of reported fraud involved synthetic identities | LexisNexis Risk Solutions 2026 report, using 2025 data [2] | Document identity inconsistencies and escalation reasons |
| 38.3% of reported fraud was first-party fraud | Same LexisNexis report, drawing on over 116 billion online transactions [2] | A verified identity does not establish honest intent |
| 67% reported rising fraud events | Alloy 2026 report, published December 2025, surveyed over 500 senior US fraud decision-makers through The Harris Poll [3] | Keep fraud trends separate from KYC completion |
| 22% reported over US$5 million in direct fraud losses | Same Alloy survey [3] | A survey finding, not expected loss for every firm |
[1] Fenergo research. [2] LexisNexis Risk Solutions research. [3] Alloy research and methodology.
Actigy BPO’s interpretation is operational: measure the work that causes avoidable repeat contact, unclear escalation, and incomplete handoffs. None of these studies proves that a checklist alone reduces fraud or abandonment.
KYC documents for individuals and businesses
Start with the information and verification standard your policy requires. A list of possible documents should not become a request for every document from every customer. In US bank customer identification programs, the baseline identifying information includes name, date of birth for individuals, address, and an identification number, subject to the applicable provisions. Verification can use documentary or non-documentary methods. FFIEC guidance
| Evidence category | Individual customer | Business customer |
|---|---|---|
| Identity or legal existence | Accepted identity document or approved independent data checks | Registry extract, formation record, or other approved evidence of legal existence |
| Address and contact | Required address data and supporting checks under policy | Registered and operating address information as applicable |
| Ownership and control | Information on someone acting for another person where relevant | Ownership structure, relevant beneficial owners, control person, and authority to act |
| Purpose and expected activity | Intended use, relevant transaction profile, and expected funding | Business model, products, markets, expected flows, and counterparties where relevant |
| Additional risk evidence | Further explanation or source-of-funds evidence when required | Additional ownership, source-of-funds, or source-of-wealth evidence when required |
Check the quality and consistency of evidence before asking for more. An unreadable image, a transliteration difference, and an unexplained ownership layer need different responses. Record the mismatch precisely so the customer receives one useful request.
Collect only the information the process needs. Jumio’s 2026 study of 8,003 adult consumers found that 67% would feel more comfortable sharing proof of age eligibility than full personal details. That finding concerns age assurance, not bank KYC. It still gives operations teams a useful question: can you explain why each requested item is necessary? Jumio study
How to run the eight stages
1 Set the scope before requesting evidence
Record the legal entity providing the service, the customer category, the product, and the policy version. Identify whether this is new onboarding, periodic refresh, a trigger-based review, or remediation of an existing defect. Assign an owner before the file enters the queue.
This prevents a common source of rework: reviewers applying different standards to the same case. When policy is unclear, send a question to the policy owner. Do not resolve the gap by inventing another document requirement.
2 Verify identity and resolve inconsistencies
Separate collecting an identity claim from verifying it. Record which source or tool was used, when the check ran, and what it established. A tool result needs enough context for another reviewer to interpret it.
For remote onboarding, follow the approved procedure for document integrity, device or other risk signals, and liveness where applicable. If a check fails, record the reason and the allowed next route. Repeated retries should not silently turn a failed control into a pass.
3 Establish business ownership and authority
For an entity customer, confirm legal existence, relevant ownership and control, and the authority of the person acting for it. Keep the evidence used to trace the structure. A neat ownership diagram is useful only if its links can be supported.
Use the thresholds and control tests that apply to the relationship. Under the US CDD rule, the ownership prong generally covers individuals with 25% or more equity, with a separate control prong and exclusions. That is not a worldwide threshold. FinCEN CDD FAQs
4 Review screening with separate outcomes
Maintain distinct outcomes for sanctions screening, politically exposed person assessment, and adverse information. A similar name is an unresolved match until the approved review process reaches a conclusion. A PEP designation does not itself mean the person is sanctioned or engaged in wrongdoing.
For US banks, interagency guidance calls for risk-based treatment and does not create unique additional CDD steps solely because a customer is considered a PEP. Other regimes differ. US interagency statement
Entity screening also needs applicable ownership rules. OFAC’s 50 Percent Rule can block an entity owned, directly or indirectly, 50% or more in aggregate by blocked persons even when its own name is absent from a list. OFAC FAQ 401
5 Understand the relationship and apply the approved risk policy
Describe why the customer needs the product and what activity is expected. Apply the approved risk factors and preserve the reason for the assessment. An unexplained score is a weak handoff because it leaves the next reviewer to reconstruct the reasoning.
For enhanced due diligence, state the trigger and the extra evidence required. Source of funds addresses where particular funds come from. Source of wealth addresses how overall wealth was accumulated. Avoid treating those questions as interchangeable or requesting both in every file.
FATF Recommendation 10 covers identity, beneficial ownership, the purpose of the relationship, and ongoing due diligence. National rules determine how those principles apply. FATF Recommendations
6 Check the case before handoff
Actigy BPO’s checklist uses a simple completion standard: each applicable control needs a result, evidence reference, reviewer, and date. Each unresolved exception needs an owner and a next action. A reasoned “not applicable” entry is more useful than an unexplained blank.
Have the quality reviewer check whether the evidence supports the recorded conclusion. Set the required independent review or sampling coverage in the approved procedure. A completed checklist confirms the documented review status. It does not automatically approve the customer.
7 Record the authorized decision
Distinguish a case that is ready for a decision from one that has been approved. Capture the authorized decision-maker, date, rationale, any conditions, and the operational action to follow. Rejected and unresolved files also need a clear disposition.
If a case cannot proceed, use the approved route for account restrictions, escalation, and customer communication. Customer-facing explanations should follow the firm’s procedures, including applicable confidentiality obligations. Operations staff should not create their own explanation for a suspected financial-crime case.
8 Maintain the relationship and the record
Record the monitoring handoff and the next review date or trigger. Changes in ownership, activity, document validity, risk, or screening results can require attention between scheduled reviews. Your policy should determine which changes trigger which actions.
Keep retention rules specific to the record category and jurisdiction. UK HMRC guidance describes a five-year period from the end of the relationship or completion of the transaction. US bank CIP rules distinguish identifying information from verification records. A single instruction to keep everything for five years from collection is too imprecise. HMRC guidance · FFIEC recordkeeping guidance
For recurring queues, Actigy BPO’s KYC refresh service supports document outreach, file updates, and review preparation under the client’s policy. If the issue is a known defect across older records, use a defined KYC remediation scope with a documented closure standard.
The 2026 changes your checklist should distinguish
Two US developments are easy to confuse. FinCEN’s February 2026 relief allows covered institutions to limit beneficial-owner identification and verification to the first account, later doubts about existing information, and risk-based ongoing CDD needs. Institutions can choose whether to use the relief. FinCEN CDD FAQs
Separately, FinCEN’s August 2026 final rule removes Corporate Transparency Act reporting requirements for US companies and US persons. BOI reporting to a government database and a financial institution’s CDD obligations are different processes. Do not turn the reporting exemption into a blanket instruction to stop beneficial-owner checks. FinCEN announcement
In the EU, the new AML Regulation generally applies from 10 July 2027, with a later date for football clubs and agents. A 2026 checklist should identify the requirements currently applicable to the business and track future implementation separately. EUR-Lex summary
How to handle common KYC exceptions
A useful checklist makes unresolved work visible. Use specific reason codes so the team can distinguish customer waiting time, tool failure, policy questions, and cases awaiting an authorized decision.
| Situation | Operational response | What remains unresolved |
|---|---|---|
| Unreadable or expired evidence | Request an accepted replacement through the approved channel | Whether sufficient current evidence exists |
| Name or address mismatch | Compare permitted independent sources and record the discrepancy | Whether the mismatch is explained |
| Potential sanctions match | Route to the authorized sanctions reviewer under the escalation procedure | Match determination and required restrictions |
| Unclear ownership layer | Request supporting evidence and escalate the gap | Relevant ownership or control |
| Higher-risk activity or PEP finding | Apply the jurisdiction-specific procedure and required review | Additional evidence and authorized acceptance |
| Verification provider outage | Use an approved contingency or pause the affected step | The failed verification control |
For a worked example, consider a fictional company whose registration is verified but whose declared shareholder differs from the supporting ownership record. The reviewer records the discrepancy and requests the approved evidence. The file remains unresolved until the ownership question is addressed. Passing identity checks on the person submitting the application does not close the company ownership gap.
What to measure in a KYC queue
Measure speed and evidence quality together. Otherwise, a team can appear faster by moving unfinished work to another queue.
| Metric | Definition to agree before comparing results |
|---|---|
| First-pass file acceptance | Files accepted at the first quality review divided by files receiving a first review |
| Critical defect rate | Sampled files with at least one critical defect divided by sampled files |
| Rework rate | Reviewed files returned for correction divided by reviewed files |
| Review turnaround | Time from complete evidence intake to the defined review endpoint. Report median and 90th percentile |
| Customer waiting time | Time waiting for requested customer evidence. Report separately from active review |
| Aged exceptions | Open exceptions beyond the agreed due date, split by cause and owner |
| Cost per accepted file | Total queue cost, including QA and rework, divided by files accepted at the agreed quality gate |
The last metric is a cost per accepted review file, not a cost per approved customer. Keep those denominators separate.
Consider an illustrative month with 1,000 files reviewed and 820 accepted at first review. First-pass acceptance is 82%. If 920 files eventually pass the quality gate and total queue cost is US$18,400, the cost is US$20 per accepted file. These are teaching assumptions, not an Actigy BPO result or industry benchmark.
Compare teams only after aligning customer mix, risk tier, evidence completeness, and the definition of completion. Set pilot thresholds from your baseline and risk appetite. There is no single acceptable error rate or review time for every KYC queue.
When Actigy BPO fits a KYC operating model
Actigy BPO is a relevant delivery option when a bank or fintech has a defined onboarding, refresh, or remediation queue that needs additional review capacity. Its KYC outsourcing service covers operational review and case preparation under client-approved procedures. The client retains risk policy and customer acceptance decisions.
The same checklist supports several distinct scopes. An onboarding backlog needs a clear intake standard. Periodic refresh needs reliable triggers and outreach. Remediation needs defect categories and closure evidence. A screening queue needs match-resolution rules and named escalation owners. AML alert review should have its own workflow and reporting decisions.
In an anonymized fintech case study, Actigy BPO reports clearing 14,000 pending verifications and reducing manual false-positive triage by 88%. The team handled screening, triage, and case preparation. The client kept risk settings and final filing decisions. The figures are Actigy BPO-reported, not independently audited, and are specific to that engagement.
Outsourcing is also different from relying on another institution’s CDD. FATF’s interpretive note to Recommendation 17 distinguishes third-party reliance from outsourcing performed under the delegating institution’s procedures and control. FATF Recommendations
Need help turning the checklist into a working queue? Scope a paid KYC pilot with Actigy BPO. Share the queue type, monthly volume, systems, coverage, and compliance owner. Agree the evidence standard, critical defects, escalation rules, and retained decisions before expanding the scope. Do not upload customer identity documents through the public contact form.
Related Actigy BPO guides
When the question is whether controls worked across a period, use Actigy BPO’s AML audit checklist and evidence workpaper. It covers testing, sampling and findings closure beyond the individual customer-file review.
Frequently asked questions
What is the difference between KYC and customer due diligence?
KYC is the common label for understanding and verifying customers across a relationship. Customer due diligence is the set of checks used to establish identity, understand ownership and purpose, and assess and monitor relevant risk. Exact legal terminology varies by regime. The checklist should follow the terminology in the firm’s approved policy.
Is there a free KYC checklist template?
Yes. Actigy BPO provides an editable Word checklist and a printable PDF with 24 controls. Each control has space for an evidence reference, status, reviewer, and exception. The template includes a separate decision record so completion of review is not mistaken for customer approval.
Is a passport enough for KYC?
A passport may support identity verification. It does not by itself establish the purpose of a relationship, business ownership, screening outcomes, or whether additional review is needed. The required evidence depends on the customer, product, jurisdiction, and applicable policy.
What is the difference between KYC and KYB?
Know your business is the operational term often used for checks on legal entities. It covers the business and its relevant owners or controllers. Verifying the person who submits an application does not establish the existence or ownership of the business they represent.
How often should KYC be refreshed?
Use the schedule and event triggers defined by the applicable requirements and your risk-based policy. Record why the review is due and what has changed. Do not copy a universal annual, three-year, or five-year cycle into every customer segment.
Can KYC work be outsourced?
Defined tasks can be assigned to an operations provider where applicable rules and the engagement permit. Actigy BPO supports document review, screening triage, refresh, remediation, and case preparation under the client’s procedures. The client retains policy and final decisions. Review access, oversight, data locations, and exit arrangements before assigning a queue.
Does finishing the checklist mean the customer is approved?
No. It means the recorded checks reached their documented status. Approval requires the authorized decision and any required conditions. A pending control, unresolved match, or unapproved exception cannot be treated as a completed approval.
What should a KYC audit trail contain?
A useful trail connects the applicable procedure, evidence, verification results, screening disposition, risk rationale, review history, exceptions, and authorized decision. Store references in approved systems so a reviewer can reconstruct the case without relying on the original operator’s memory.
Download the Actigy BPO working files
Download the 24-control KYC checklist Word template
Download the KYC checklist PDF
Sources and reuse
Actigy BPO prepared this operating framework using the primary sources linked beside the relevant claims. Research was checked on 18 October 2026. Publication year and observation period are shown separately. Vendor surveys and network datasets describe their own samples, not all institutions or all fraud. The worked example is illustrative, and the Actigy BPO case study is self-reported.
You may reuse Actigy BPO’s original checklist and diagrams with attribution to this guide. For chart data, also credit the original research provider. Suggested citation: “Actigy BPO, Know Your Customer Checklist 2026, evidence checked 18 October 2026.” Third-party data and trademarks remain subject to their owners’ rights.
Download the checklist (Word) to adapt the controls to your policy, or discuss a defined KYC queue with Actigy BPO.