Most descriptions of the KYC process describe onboarding and then stop, which is why so many firms have an excellent front door and no file behind it. A process that ends when the customer is accepted is a workflow, not a process, because the obligation it exists to meet does not end there. This page walks the whole of it, including the part after the customer is live, and is honest about which step gets dropped.
Step one and two: collect, then decide what else you need
The first step is identification: the customer's own details and, if the customer is a company, the individuals behind it. The second step is the one firms collapse into the first, which is deciding what else this particular customer needs. That decision is the risk rating, and it has to come before the evidence set rather than after it, otherwise every customer gets the same folder and the higher-risk ones are under-evidenced while the standard ones are over-collected. Rate first, then collect to the rating.
Step three: approval, by a named person, on a date
For anything rated above standard the file needs somebody other than the person who opened it to say yes. The value of this step is not the second opinion, useful as that is. It is that the approval is a fact with a name and a date attached, so a year later the file answers the question of who decided rather than the question of what was decided. Firms that run approval over chat have the decision and not the record, which is the same as not having it.
Step four, the one that gets dropped: the review
The end of the process is a date in the future. Every file gets one, the interval comes from the rating, and the reminder goes to the person who owns that customer. When the date arrives the review is short: has anything changed, is the rating still right, is the evidence still current, and it is written onto the same record. This is the step with no natural deadline pressure, which is exactly why it needs to be a scheduled record rather than a habit.
Questions people ask about kyc process
How long should the KYC process take?
For a standard-risk customer it is minutes rather than days once the evidence set is decided in advance. The time goes on the rated-up files, where somebody has to trace ownership and wait on an approver. If you want your own number rather than an average, the free checklist takes your minutes per file at each rating and turns them into hours a year.
Is the KYC workflow the same as the KYC process?
They get used interchangeably and the difference matters. A workflow is the sequence of screens somebody moves through to open a file. The process includes what happens to that file afterwards, which is where the obligation actually lives. A firm can have a beautiful workflow and no process.
Where does screening fit in?
Screening a customer against sanctions, watchlist and adverse-media data is a step in the process and a separate product to buy. It is not something we do: this site is about the file that records what the screen returned, who ran it and when, alongside the rest of the customer's evidence.