KYC Customer Verification SOP Template

1.Purpose

To verify who a customer is, screen for known risk indicators, assign an appropriate risk rating, and keep that information current, following the bank's compliance program and applicable law.

2.Scope

Applies to identity verification and ongoing due diligence for personal and business customers. Completing the account application and funding is covered in the separate account opening SOP.

Definitions

Customer risk rating

A classification, such as low, medium or high, that reflects how closely a customer's activity and profile should be monitored.

Enhanced due diligence

Additional verification and monitoring steps applied to higher-risk customers or relationships.

Beneficial owner

An individual who ultimately owns or controls a business customer, as defined by the bank's policy.

Refresh

Updating a customer's identity and risk information on a scheduled or triggered basis.

3.Responsibilities

Personal Banker

Collects identifying documents from the customer and submits them for verification.

Compliance Officer

Authenticates documents, screens customers, assigns risk ratings and manages the refresh schedule.

Branch Manager

Approves or declines customer verification and reviews escalations.

Operations Officer

Records verification decisions and monitors account activity for red flags.

RACI matrix

R = Responsible, A = Accountable, C = Consulted, I = Informed

4.Materials and PPE

Materials, tools and systems

• →Government-issued identification
• →Core banking customer information system
• →Watchlist and sanctions screening tool
• →Beneficial ownership certification form
• →Customer risk rating worksheet
• →Case management tool for escalations

5.Procedure

1. 5.1

   Collect identifying documents

   Personal Banker

   The personal banker collects a current, government-issued photo identification and, for a business customer, formation documents and a beneficial ownership certification.

2. 5.2

   Authenticate the identity document

   Personal Banker

   The personal banker examines the identification for security features, confirms it is unexpired, and compares the photo and details to the person and information presented.

   Checkpoint: The document is genuine, unexpired, and the photo clearly matches the customer before proceeding.

3. 5.3

   Screen against sanctions and watchlists

   Compliance Officer

   The compliance officer screens the customer's name and any beneficial owners against sanctions lists and other required watchlists using the screening tool.

   Warning: Do not proceed with the relationship if the screening tool returns a potential true match until compliance leadership reviews and clears it.

4. 5.4

   Verify beneficial ownership

   Compliance Officer

   For business customers, the compliance officer reviews the beneficial ownership certification, identifies each individual who meets the bank's ownership or control threshold, and verifies their identity.

5. 5.5

   Assign the customer risk rating

   Compliance Officer

   The compliance officer assigns a risk rating using the risk rating worksheet, considering the customer type, expected activity, geography and any watchlist results.

   Checkpoint: The assigned risk rating and its supporting factors are documented in the customer file.

6. 5.6

   Apply enhanced due diligence where required

   Compliance Officer

   For customers rated higher risk, the compliance officer gathers additional information, such as expected transaction patterns and source of funds, following the bank's enhanced due diligence procedure.

7. 5.7

   Approve or decline verification

   Branch Manager

   The branch manager reviews the compliance officer's findings and approves the customer for onboarding, requests more information, or declines the relationship.

8. 5.8

   Record the verification decision

   Operations Officer

   The operations officer records the verification decision, the documents reviewed and the risk rating in the customer information system for audit purposes.

9. 5.9

   Set the review and refresh schedule

   Compliance Officer

   The compliance officer sets a review and refresh date for the customer file based on the assigned risk rating, with higher-risk customers reviewed more frequently.

10. 5.10

    Monitor account activity for red flags

    Operations Officer

    The operations officer reviews account activity reports for patterns inconsistent with the customer's stated profile, such as unexpected transaction types or volumes, and escalates any concern to compliance.

    Warning: Activity that does not match the customer's stated purpose is a red flag and must be escalated, not dismissed.

11. 5.11

    Conduct the periodic refresh

    Compliance Officer

    When a customer's review date arrives, the compliance officer re-verifies identifying information, re-screens against watchlists, and updates the risk rating as needed.

    Checkpoint: No customer passes its scheduled refresh date without a documented review.

12. 5.12

    Escalate unresolved concerns

    Compliance Officer

    The compliance officer escalates any unresolved identity, screening or activity concern to compliance leadership for a decision on the relationship, following the bank's compliance program.

6.Quality checks

• →Every identity document is authenticated and matched to the customer before onboarding.
• →No customer is onboarded with an unresolved watchlist match.
• →Every customer file shows a documented risk rating and its supporting factors.
• →Refreshes are completed on or before each customer's scheduled review date.

7.Records

• →Copy or log of identity documents reviewed
• →Watchlist screening results
• →Risk rating worksheet and decision
• →Refresh and escalation history

8.KPIs

• →Percentage of customer files with an on-time refresh
• →Average time to clear a flagged screening result
• →Number of accounts escalated for activity red flags
• →Percentage of higher-risk customers with completed enhanced due diligence

9.Common mistakes

• →Accepting an expired or clearly altered identity document.
• →Skipping beneficial ownership verification for a business customer.
• →Letting a customer's refresh date pass without a documented review.
• →Dismissing unusual activity instead of escalating it to compliance.

10.Revision history