Know Your Customer (KYC) Process Implementation Plan

Implement a KYC process with a project plan covering identity verification, document collection, risk scoring, and ongoing monitoring workflow design.

Know Your Customer (KYC) Process Implementation Plan

KYC Is Not a One-Time Check — It's a Lifecycle

The most dangerous misconception about KYC is that it's an onboarding event. Customer data is collected at signup, identity is verified, and the file is archived. Done.

But a customer who passed KYC two years ago may have become a PEP (Politically Exposed Person), been sanctioned by OFAC, or changed their business model in ways that change their risk profile significantly. A customer with a legitimate business relationship might change ownership, be acquired by a sanctioned entity, or begin transacting in patterns inconsistent with their stated purpose.

Effective KYC is a lifecycle: onboarding verification establishes the baseline, ongoing monitoring detects changes in risk, and periodic re-verification ensures the file remains accurate. The implementation plan must design all three layers.

Phase 1: KYC Requirements Definition (Weeks 1–3)

Customer type classification:

Different customer types require different KYC requirements.

Minimum required information by customer type:

Document exactly which fields are required vs. optional, which require document verification vs. database verification, and what triggers enhanced due diligence.

Regulatory mapping:

Map requirements to specific regulatory obligations:

Phase 2: Identity Verification Vendor Selection (Weeks 3–6)

Vendor categories:

Identity Document Verification (IDV):

Database Verification:

KYB (Know Your Business):

Evaluation criteria:

Phase 3: KYC Workflow Design (Weeks 5–9)

Design the decision logic before building anything.

Three-path model:

Green path (automated approval):

Yellow path (manual review required):

Red path (automatic decline or EDD required):

Individual consumer flow:

  1. Collect: name, date of birth, address, SSN (last 4 or full)
  2. Database verification: match against credit bureau and identity verification databases
  3. OFAC/PEP screening: run against SDN list and PEP databases
  4. Risk score calculation
  5. Decision: approve (green), review (yellow), decline or EDD (red)

Business account flow:

  1. Collect: business name, EIN, state of formation, business address
  2. Entity verification: confirm EIN registration, state filing status
  3. Beneficial owner collection: name, DOB, address, SSN for each 25%+ owner and control person
  4. IDV for each beneficial owner: document verification or database verification
  5. OFAC/PEP screening for each individual
  6. Business risk assessment: industry type, geographic exposure, transaction profile
  7. Decision

Phase 4: Risk Scoring Model (Weeks 7–10)

Every customer receives a risk score at onboarding that determines their ongoing treatment.

Risk score components:

Risk tier definitions:

Risk tier → program requirements:

Phase 5: Ongoing Monitoring Design (Weeks 9–13)

OFAC and PEP rescreening:

Adverse media monitoring:

Event-triggered re-KYC:

Certain events trigger immediate re-verification:

Periodic review schedule:

Phase 6: Technology Implementation (Weeks 8–18)

Build the KYC workflow as a system, not a manual process.

Required components:

Integration with account opening:

KYC approval is a gate in the account opening flow. The account creation process must hold until KYC decisioning is complete (green path) or approved by a KYC analyst (yellow path).

Phase 7: Testing and Compliance Review (Weeks 16–20)

Testing:

Compliance review:

Build the KYC implementation project plan in gantt-chart.io with workflow design and vendor selection running in parallel in Weeks 3–6, then technology implementation building on both. Track the compliance review milestone as a hard gate before go-live — it cannot be skipped in the name of schedule pressure.