← All guides

Know Your Customer (KYC) Process Implementation Plan

Implement a KYC process with a project plan covering identity verification, document collection, risk scoring, and ongoing monitoring workflow design.

Know Your Customer (KYC) Process Implementation Plan

KYC Is Not a One-Time Check — It's a Lifecycle

The most dangerous misconception about KYC is that it's an onboarding event. Customer data is collected at signup, identity is verified, and the file is archived. Done.

But a customer who passed KYC two years ago may have become a PEP (Politically Exposed Person), been sanctioned by OFAC, or changed their business model in ways that change their risk profile significantly. A customer with a legitimate business relationship might change ownership, be acquired by a sanctioned entity, or begin transacting in patterns inconsistent with their stated purpose.

Effective KYC is a lifecycle: onboarding verification establishes the baseline, ongoing monitoring detects changes in risk, and periodic re-verification ensures the file remains accurate. The implementation plan must design all three layers.

Phase 1: KYC Requirements Definition (Weeks 1–3)

Customer type classification:

Different customer types require different KYC requirements.

  • Individual consumer: SSN/government ID, date of birth, address verification
  • Sole proprietorship: individual owner KYC + business name and EIN
  • Small business (LLC, partnership, corporation): EIN, articles of incorporation/organization, beneficial owner collection (25%+ owners), control person
  • Large enterprise: entity verification, beneficial ownership, board resolutions for authorized signers
  • Financial institutions: correspondent KYC — the most complex, requires understanding their AML program

Minimum required information by customer type:

Document exactly which fields are required vs. optional, which require document verification vs. database verification, and what triggers enhanced due diligence.

Regulatory mapping:

Map requirements to specific regulatory obligations:

  • FinCEN CDD Rule (31 CFR 1020.220): minimum CDD requirements for covered financial institutions
  • OFAC requirements: sanctions screening at onboarding and on an ongoing basis
  • BSA requirements: currency transaction reporting, SAR filing obligations
  • State-specific requirements where applicable

Phase 2: Identity Verification Vendor Selection (Weeks 3–6)

Vendor categories:

Identity Document Verification (IDV):

  • Captures and authenticates government-issued identity documents (passport, driver's license)
  • Liveness detection: confirms the person is physically present, not a photo or spoofed image
  • Key vendors: Persona, Onfido, Jumio, Socure, Incode

Database Verification:

  • Validates identity information against authoritative databases: credit bureaus, DMV records, public records
  • No document required — frictionless for verified individuals
  • Key vendors: LexisNexis Risk Solutions, Experian, TransUnion, Socure

KYB (Know Your Business):

  • Verifies business entities: EIN validation, state registration, beneficial ownership
  • Key vendors: Middesk, Comply Advantage, Dun & Bradstreet

Evaluation criteria:

  • Pass rate by customer segment (how many legitimate customers pass automatically?)
  • Document types accepted (international document coverage if you serve global customers)
  • Geographic coverage (supported countries)
  • False positive and false negative rates
  • Time-to-decision for manual review cases
  • API quality and implementation support

Phase 3: KYC Workflow Design (Weeks 5–9)

Design the decision logic before building anything.

Three-path model:

Green path (automated approval):

  • Database verification passes: name, DOB, address, SSN match
  • OFAC screening: no match
  • PEP screening: no match
  • Customer risk score: low or medium
  • Outcome: automatic approval, account opened

Yellow path (manual review required):

  • Partial match or thin file on database verification
  • OFAC or PEP potential match requiring human review
  • High-risk customer type or geography
  • Outcome: routed to KYC analyst queue, decision within SLA (same-day or 24-hour)

Red path (automatic decline or EDD required):

  • Definitive OFAC match: decline and file SAR if required
  • Unable to verify identity after all attempts: decline
  • Definitive PEP with high-risk profile: EDD required before approval decision

Individual consumer flow:

  1. Collect: name, date of birth, address, SSN (last 4 or full)
  2. Database verification: match against credit bureau and identity verification databases
  3. OFAC/PEP screening: run against SDN list and PEP databases
  4. Risk score calculation
  5. Decision: approve (green), review (yellow), decline or EDD (red)

Business account flow:

  1. Collect: business name, EIN, state of formation, business address
  2. Entity verification: confirm EIN registration, state filing status
  3. Beneficial owner collection: name, DOB, address, SSN for each 25%+ owner and control person
  4. IDV for each beneficial owner: document verification or database verification
  5. OFAC/PEP screening for each individual
  6. Business risk assessment: industry type, geographic exposure, transaction profile
  7. Decision

Phase 4: Risk Scoring Model (Weeks 7–10)

Every customer receives a risk score at onboarding that determines their ongoing treatment.

Risk score components:

  • Customer type (individual, business type, financial institution)
  • Industry or business purpose (high-risk industries: cannabis, gambling, crypto, money services)
  • Geographic risk (customer location, beneficial owner citizenship, business activity geography)
  • Transaction profile: expected activity type, volume, and amount
  • PEP or adverse media flags

Risk tier definitions:

  • Low risk: individual consumer, standard industry, domestic, limited transaction volume
  • Medium risk: small business, standard industry, some international exposure
  • High risk: complex business structure, high-risk industry, international exposure, PEP connection

Risk tier → program requirements:

  • Low risk: standard CDD, periodic review every 3 years, standard monitoring thresholds
  • Medium risk: standard CDD, periodic review every 2 years, enhanced monitoring
  • High risk: enhanced due diligence (source of funds, source of wealth), periodic review every year, heightened monitoring thresholds

Phase 5: Ongoing Monitoring Design (Weeks 9–13)

OFAC and PEP rescreening:

  • Screen existing customers against updated SDN list when list updates (OFAC updates the SDN list multiple times weekly)
  • Automated alert when a new match is identified against an existing customer
  • Alert workflow: compliance review → file SAR if required → take adverse action if definitive match

Adverse media monitoring:

  • Monitor news sources for negative mentions of customers (fraud, money laundering, regulatory action)
  • Alert compliance team when significant adverse news is identified

Event-triggered re-KYC:

Certain events trigger immediate re-verification:

  • Change of beneficial ownership
  • Change of business address to high-risk jurisdiction
  • Request to add new authorized signer
  • Transaction pattern inconsistent with stated business purpose

Periodic review schedule:

  • Execute reviews according to risk tier schedule
  • Refresh customer information: confirm address, beneficial owners unchanged
  • Re-run OFAC/PEP screening
  • Reassess risk score
  • Document review conclusion in customer file

Phase 6: Technology Implementation (Weeks 8–18)

Build the KYC workflow as a system, not a manual process.

Required components:

  • IDV vendor API integrations (Persona, Onfido, or selected vendor)
  • Database verification API integration (LexisNexis, Experian)
  • OFAC/PEP screening API (Comply Advantage, Dow Jones, World-Check)
  • KYC case management system: review queue, analyst decision workflow, document storage
  • Customer risk score calculation engine
  • Periodic review scheduling and queue management

Integration with account opening:

KYC approval is a gate in the account opening flow. The account creation process must hold until KYC decisioning is complete (green path) or approved by a KYC analyst (yellow path).

Phase 7: Testing and Compliance Review (Weeks 16–20)

Testing:

  • Test full KYC flow using test identity documents and synthetic customer profiles
  • Test all three paths: green (auto-approve), yellow (manual review), red (decline)
  • Test OFAC match scenario: confirmed SDN match → correct adverse action triggered
  • Test beneficial ownership collection: business account with complex structure

Compliance review:

  • Have an experienced BSA/AML attorney or consultant review the KYC procedures and workflow before go-live
  • Confirm procedures satisfy FinCEN CDD Rule requirements
  • Document testing and review results for examination evidence

Build the KYC implementation project plan in gantt-chart.io with workflow design and vendor selection running in parallel in Weeks 3–6, then technology implementation building on both. Track the compliance review milestone as a hard gate before go-live — it cannot be skipped in the name of schedule pressure.