Planning KYC remediation with interim specialists: sizing, team and process

Short answer: Banks and financial institutions plan a KYC remediation project in four steps: segment the backlog, measure real handling times in a pilot, calculate the headcount and ramp up the team in waves. The number of analysts equals cases per category multiplied by measured handling time, plus quality control and rework, divided by the productive hours available in the project window. The legal framework is Art. 7(1bis) of the Swiss Anti-Money Laundering Act (GwG) and the FINMA AML Ordinance (GwV-FINMA) in Switzerland, and section 10(1) no. 5 of the German Money Laundering Act (GwG) in Germany.

This guide is for heads of compliance, MLROs and project leads in banks, wealth managers and payment institutions in Switzerland and Germany. It shows how to plan a KYC remediation project with interim specialists, size the team reliably, settle roles, system access and reporting before the start, and keep periodic reviews in Swiss banks on track afterwards.

The four planning steps and the legal framework

A KYC remediation becomes plannable when four steps run in this order:

1. Segment: split the population by risk, age, deadlines and data gaps.
2. Pilot: measure handling time, queries and rework on a representative sample.
3. Calculate: derive the headcount from case volumes and pilot values.
4. Stagger: ramp up the team in waves and update the assumptions every month.

The legal trigger is usually the duty to keep customer data up to date. In Switzerland, financial intermediaries have had to review the required records periodically since 1 January 2023; frequency, scope and method depend on the risk posed by the client (Art. 7(1bis) GwG). Internal directives must govern how client records are updated (Art. 26(2)(l) GwV-FINMA). In Germany, section 10(1) no. 5 GwG requires ongoing monitoring and risk-based updates "at appropriate intervals". From 10 July 2027 the EU Anti-Money Laundering Regulation (AMLR) applies: customer information must then be updated at least every year for higher-risk customers and every five years for all others (Art. 26(2) Regulation (EU) 2024/1624).

Segment the population: risk, age, deadlines, data gaps

Segmentation decides which cases go first and how long each case takes. Without it, every capacity estimate becomes an average across very different files.

• Risk: Swiss intermediaries must identify and flag higher-risk relationships internally (Art. 13(6) GwV-FINMA). That flag is the first axis.
• Age of documentation: date of last review, missing or expired IDs, outdated beneficial ownership details.
• Deadlines: internal deadlines, commitments to the audit firm or supervisor, dates in a remediation plan.
• Client type and complexity: private clients, operating companies, domiciliary companies, trusts and foundations, multi-layered structures.
• Data quality: what sits in structured fields of the core banking system, what only in scanned documents, what is missing?
• Document language: which languages do analysts need to read documents and draft queries? The pilot will tell you.

The result is a matrix of three to six categories, for example "standard, low risk", "companies with a simple structure" and "higher risk or complex structure". Each category gets its own handling time and its own quality control.

Run a pilot on a representative sample

A pilot replaces estimates with measured values. It should cover every category and run on the same systems, checklists and approval routes as the main project.

What the pilot should measure

• Handling time per case and category, split into first review and rework
• Share of cases needing queries to relationship managers or clients, and the waiting time
• Error rate in quality control and the most common error types
• Share of cases that need escalation
• System time: loading times, missing access rights, manual workarounds

The pilot ends with a binding review procedure, a case register and realistic time values. Only then is it worth ramping up.

Capacity formula with a worked example

Analyst headcount can be estimated with a simple formula: the sum of cases per category multiplied by handling time, plus a rework allowance, divided by productive hours per person per month multiplied by project months. Quality control, team leadership and subject matter experts are planned on top.

The following calculation is a template. All values are assumptions and do not replace pilot measurements.

Assuming 120 productive hours per person per month, this gives roughly 82 person-months. For a twelve-month window you need about seven analysts. Following the role model below, add one or two quality controllers, a team lead and a part-time subject matter expert. Halving the timeline does not simply double the team: onboarding, queries and approvals grow too, and internal sign-off functions become the bottleneck.

Role model: analyst, senior analyst/QC, team lead, subject matter expert

A KYC team separates processing, quality control and steering. That keeps it traceable who reviewed a case and who approved it.

These ratios are planning values, not requirements. A high share of higher-risk cases needs more quality control. How such a team is ramped up and steered is covered in our guide to building a legal and compliance taskforce.

Alpinum Solutions provides analysts, senior analysts, team leads and subject matter experts for AML and KYC remediation through staff leasing and freelancing, part-time or full-time. Under staff leasing, the institution gives the professional instructions and the specialists work in its systems and processes. Under freelancing, specialists work independently within the agreed mandate.

Access, tools and data protection

System access and confidentiality often decide the start date, not the search for people. Settle these points before ramping up:

• Need-to-know access: read access to the files of the assigned category, write access only in the remediation tool.
• Place of work: on-site, via a secure remote environment or hybrid, depending on security rules and Swiss banking secrecy.
• Devices and accounts: provided by the institution; allow lead time for accounts, tokens and training.
• Confidentiality: non-disclosure undertakings, data protection briefing, rules for filing and communication.
• Use of third parties: in Switzerland, an intermediary that mandates external persons to identify clients or carry out additional checks needs a written agreement and must select, instruct and supervise them carefully; regulatory responsibility stays with the institution (Art. 28 and 29 GwV-FINMA). In Germany, transferring internal safeguards to a third party must be notified in advance (section 6(7) GwG). Under staff leasing, by contrast, specialists work integrated into the institution and under its instructions. For outsourcing, FINMA Circular 2018/3 requires a provider to perform a function independently. Whether an assignment nonetheless counts as use of third parties or notifiable outsourcing in a specific case is for the institution to decide and document (BaFin guidance, section 3.10).

More in our guide to confidentiality and system access for interim staff.

Reporting to management and supervisors

Good reporting shows progress, quality and residual risk, not just closed cases. Use a few metrics calculated the same way every week:

• Open, processed and QC-accepted cases per category
• Rework rate and most frequent error types
• Open queries and their age
• Escalations and decisions on continuing relationships
• Forecast of the remaining backlog against the target plan

Decisions on higher-risk relationships stay with the institution: in Switzerland, for certain categories such as relationships with politically exposed persons, the most senior executive body or one of its members decides on taking them on and annually on continuing them (Art. 19 GwV-FINMA). If the remediation stems from an audit finding, interim updates to the audit firm or supervisor belong in the project plan. How to plan and evidence measures after findings is covered in our guide to compliance remediation after audit findings.

Switzerland: periodic review of client relationships after remediation

Once remediation ends, periodic review begins: since 1 January 2023, Swiss banks have had to check periodically that the records on their client relationships are up to date and update them where needed (Art. 7(1bis) of the Swiss Anti-Money Laundering Act, GwG). There is no fixed statutory interval. The bank sets frequency, scope and method on a risk basis, but must justify them from its risk analysis and anchor them in internal directives.

• Art. 6(1) GwG: the frequency of checks and the management level that decides on continuing a relationship also depend on risk.
• Art. 13 GwV-FINMA: the bank develops criteria for higher-risk relationships, identifies those relationships and flags them internally. Relationships with foreign politically exposed persons (PEPs) are always higher risk.
• Art. 19 GwV-FINMA: the most senior executive body or one of its members decides every year on continuing certain PEP relationships and orders regular checks of all higher-risk relationships.
• Art. 26(2)(l) GwV-FINMA: internal directives govern how client records are updated.
• Banks' code of conduct: for identifying the contracting party and establishing the controlling person and the beneficial owner, Art. 35 GwV-FINMA currently refers to the Agreement on the Swiss banks' code of conduct with regard to the exercise of due diligence of 13 June 2018 (CDB 20, German: VSB 20). On 30 October 2026 the Swiss Bankers Association published the new version, VSB 27; it enters into force on 1 January 2027, replaces CDB 20 and provides for a four-month transitional period (SBA, 30 Oct 2026). Updating the reference in Art. 35 is part of the ongoing partial revision of the GwV-FINMA. The code determines which records a file must contain.

What the 2026 AML revision changes

Since 1 October 2026, the revised GwG, the Transparency of Legal Entities Act (TJPG) and the implementing ordinances have been in force, and the transparency register is operational. Legal entities report their beneficial owners in stages: companies limited by shares with a full statutory audit within three months, other legal entities within six months (Art. 51 TJPG). From 1 April 2027, financial intermediaries report discrepancies between their records and the register (Art. 30 and 54 TJPG). A register check therefore belongs in every review of corporate clients as a fixed step. In addition, FINMA opened a consultation on a partial revision of the GwV-FINMA on 12 May 2026, including a duty to understand ownership and control structures. According to FINMA's overview of regulatory projects, adoption is planned for the fourth quarter of 2026 and entry into force for the first quarter of 2027 (status October 2026). Details are in our guide to the Swiss AML revision and transparency register.

Planning business-as-usual effort

Annual effort equals the number of relationships due per category multiplied by the handling time measured in the pilot. Three effects create peaks: relationships reviewed in the same remediation fall due again in the same year; every upward re-rating shortens the interval; and register checks and ownership structures lengthen the handling of corporate clients from 2027. A three-year due-date schedule shows whether the core team can cope or whether peaks need interim support.

Example: 8 FTE, 10 months, file reviews and alert handling

In 2025 a financial institution in Switzerland deployed a taskforce of 8 FTE: compliance officers including a team lead, all full-time under staff leasing. The team handled KYC remediation, KYC file reviews, transaction monitoring and alert handling, and documented the results. The team lead reported to internal compliance. Selected profiles were available within 48 hours; the team started around two weeks after the order was placed. The project was completed in 10 months. Details are in the KYC taskforce case study. How to clear an alert backlog in parallel is shown in our guide to transaction monitoring alert backlogs.

Limits and risks

• Responsibility for due diligence, risk ratings and suspicious activity reports stays with the institution. External specialists prepare and document; reserved decisions are taken by the institution.
• A daily case target without a pilot is not a reliable planning basis. Data quality and queries set the pace.
• Ramping up too fast overloads quality control and internal sign-off functions. Stagger the team in waves.
• Alpinum is not a law firm and does not provide legal advice. Interpreting the GwG and GwV-FINMA in individual cases remains with the institution and its advisers.

Frequently asked questions about KYC remediation

How long does a KYC remediation project take?

Duration depends on case volume, complexity, data quality and team size. The worked example above reaches about twelve months with seven analysts. The anonymised taskforce of 8 FTE completed its project in ten months. A reliable timeline only exists after the pilot, once measured handling times and the query rate are known.

How often must client relationships be reviewed in Switzerland?

The law sets no fixed interval. Under Art. 7(1bis) GwG, frequency, scope and method of the review depend on the risk posed by the client; the bank sets the intervals in internal directives and justifies them with its risk analysis. For certain PEP relationships, senior management decides every year on continuing the relationship (Art. 19 GwV-FINMA).

Is there a fixed review interval in the EU?

From 10 July 2027, yes. The AMLR requires customer information to be updated at least every year for higher-risk customers and every five years for all other customers (Art. 26(2) Regulation (EU) 2024/1624). The AMLR does not apply directly to Swiss banks, but it does apply to their EU entities. Groups should therefore align their intervals.

Can KYC reviews be done remotely?

Yes, if the institution provides a secure remote environment and its security rules allow it. Many teams work hybrid: onboarding and calibration on-site, then part of the processing remotely. For cross-border commuters, the social security and tax effects of remote work need to be checked before the remote share is fixed.

What remains the bank's responsibility?

The bank remains responsible for meeting its due diligence obligations, even when it uses third parties (Art. 29(1) GwV-FINMA). It decides on risk ratings, on continuing or ending relationships and on reports to the Money Laundering Reporting Office. External specialists review files, document results and prepare these decisions.

Staff leasing or freelancing for a KYC team?

Staff leasing fits when specialists are integrated into the institution's systems, processes and reporting lines and the institution directs the work. Freelancing fits clearly defined tasks delivered independently, for example a subject matter expert for complex structures. Many projects combine both, such as a leased analyst team and a senior freelance expert.

Next step

Tell us about your population, categories and target window. Selected profiles are usually available within 48 hours; the start date is agreed jointly between the company and Alpinum.

• AML, KYC and financial crime compliance
• Clearing a transaction monitoring alert backlog
• Interim MLRO or AML project team
• Staff leasing for legal and compliance
• Discuss your requirement

Last updated: 31 October 2026.