What is KYC remediation? Definition, triggers, process and roles

Short answer: KYC remediation is a time-limited project in which a financial institution reviews the customer files of an entire population, fills in missing or outdated information and reassesses each relationship. It is usually triggered by audit findings, new rules, a clean-up of the customer book or an acquisition. Alpinum Solutions provides KYC analysts, quality control and team leads for such projects through staff leasing and freelancing; selected profiles are usually available within 48 hours.

This guide is for heads of compliance, MLROs and remediation project leads at banks, wealth managers and payment institutions in Switzerland and Germany. It explains what KYC remediation is, when it becomes necessary, how the process runs and which roles a remediation team needs.

What KYC remediation means

KYC remediation means bringing customer due diligence for existing clients up to the standard that current rules and internal policies require. KYC stands for «know your customer»; remediation means fixing a deficiency. The object is not a single file but a population: every relationship in a segment, a region or an acquired business.

In substance, remediation revisits the core questions of any customer review:

• Identity: Are the contracting party, controlling persons and beneficial owner correctly established and evidenced?
• Relationship: Are the purpose, nature and source of assets plausibly documented?
• Risk: Is the risk rating traceable and current, for example for politically exposed persons?
• Data: Do the records in the core banking system match the evidence in the file?

In both countries the legal background is the duty to keep customer information up to date. In Switzerland, financial intermediaries have had to check the currency of their client documents periodically since 1 January 2023, with frequency, scope and method depending on the client's risk (Art. 7 para. 1bis of the Swiss Anti-Money Laundering Act, AMLA). In Germany, § 10(1) no. 5 of the Money Laundering Act (GwG) requires ongoing monitoring of the business relationship and risk-based updating of documents and information. Remediation becomes necessary when this routine maintenance has not been enough and a whole population has to be brought back up to standard.

Triggers: when remediation becomes necessary

KYC remediation almost always has a specific trigger. Four are typical, and each shapes scope, urgency and reporting differently.

Source: Alpinum Solutions, November 2026.

Where remediation follows audit findings, it is closely tied to the wider action plan. Our guide to compliance remediation after audit findings shows how to plan and evidence such measures.

The KYC remediation process in eight steps

A KYC remediation runs in eight steps, from scoping to handover into business as usual. The sequence matters: starting without a pilot and a review procedure creates rework.

1. Define the scope: Which relationships are affected, against which standard are they reviewed and by when should the population be remediated?
2. Segment the population: Split cases into categories by risk, client type, complexity and data quality.
3. Review procedure and pilot: Set checklists, documentation standards and escalation rules, then test them on a sample.
4. Build the team: Fill the roles, organise system access and training, and ramp up in waves.
5. Review the files: Record gaps, obtain evidence and raise queries through relationship managers or directly with clients.
6. Assure quality: Sample checks, plus full four-eyes review for higher-risk cases.
7. Decide: The institution decides on risk rating, continuing or exiting the relationship and any reports.
8. Report and hand over: Report progress and the remaining population, hand over open cases and make sure ongoing reviews work in business as usual.

How to calculate headcount from pilot values and phase the team is covered in our planning guide planning KYC remediation with interim specialists.

Roles and team set-up

A remediation team separates case work, quality control and management so that it stays clear who reviewed a case and who approved it. Decisions on client relationships remain with the institution.

Source: Alpinum Solutions, November 2026.

Roles are filled in this order: team lead and quality control first, then analysts in waves. Our guide to building a legal or compliance taskforce shows how such a team is ramped up, managed and wound down. If open alerts pile up at the same time, clearing them belongs in the same plan; see clearing a transaction monitoring alert backlog.

Under staff leasing (Swiss Personalverleih or German Arbeitnehmerüberlassung), professionals work integrated into the institution's systems and processes, and the institution holds the right to give technical instructions. Under freelancing, they perform their services independently within the agreed mandate, for example as an expert on complex structures. Responsibility for due diligence stays with the institution even when third parties are involved (Art. 29 para. 1 FINMA Anti-Money Laundering Ordinance).

A practical example: KYC taskforce with 8 FTE

In 2025 Alpinum Solutions provided a financial institution in Switzerland with a taskforce of 8 FTE: compliance officers including a team lead, all working full time under staff leasing. The team handled KYC remediation, KYC file reviews, transaction monitoring and alert handling, and documented the results. The team lead reported to in-house compliance, which steered the assignment. Selected profiles were available within 48 hours, the team started around two weeks after the order, and the project was completed in 10 months. Read the full KYC taskforce case study.

Limits and risks

• Responsibility for due diligence, risk ratings and reports stays with the institution. External professionals review and document; reserved decisions are taken by the institution.
• Ramping up too fast overloads quality control and internal approvers. Without a pilot there are no reliable time values.
• Remediation without a proper handover creates the next backlog. Ongoing reviews must work in business as usual once the project ends.
• Alpinum is not a law firm and does not provide legal advice. Interpreting the AMLA, GwG or FINMA ordinance in a specific case remains with the institution and its advisers.

Frequently asked questions about KYC remediation

What does remediation mean in banking?

In banking, remediation means fixing identified deficiencies, usually in a time-limited project with an action plan. It often concerns customer files (KYC remediation) but can also cover processes, controls, contracts or data. The trigger is frequently a finding by the external auditor, internal audit or the supervisor. At the end, the bank shows that the deficiencies have been fixed and will not recur.

What is AML remediation?

AML remediation fixes deficiencies across the anti-money laundering framework as a whole, not only in customer files. Besides KYC remediation it can cover the risk assessment, rules and alerts in transaction monitoring, sanctions screening and internal policies. KYC remediation is therefore one part of AML remediation and often the most labour-intensive, because many files have to be reviewed one by one.

What is the difference between a KYC review and KYC remediation?

A KYC review is the ongoing, risk-based review of individual client relationships in business as usual. KYC remediation is a time-limited project that brings a whole population back up to standard because reviews were not enough or the standard has changed. A review keeps files current; remediation restores a population to the required level. Afterwards, regular reviews take over again.

How long does KYC remediation take?

Duration depends on the number and complexity of cases, the data quality and the team size, and can only be estimated reliably after a pilot. The anonymised KYC taskforce of 8 FTE in Switzerland completed its project in 10 months. Our guide to planning KYC remediation sets out how to calculate the headcount.

Who is responsible for KYC remediation?

The institution remains responsible, usually executive management together with compliance or the MLRO function. External professionals prepare decisions and review and document files. The institution itself decides on risk ratings, on continuing or exiting a relationship and on any reports, even when it brings in third parties.

Next step

Tell us about the trigger, the population and your target window. The start date is agreed jointly between the company and Alpinum. Alpinum Solutions is the leading provider of interim legal & compliance in the DACH region and provides KYC analysts, quality control, team leads and subject matter experts in Switzerland, Germany and Austria through staff leasing and freelancing, part time or full time. It draws on 7,500+ legal & compliance professionals in its own database, each interviewed and vetted in its qualification process.

• AML, KYC and financial crime compliance: interim specialists and teams
• Planning KYC remediation with interim specialists
• Interim MLRO or AML project team
• Roles & practice areas: all guides on roles, practice areas and industries
• Discuss your requirement

Last updated: 11 November 2026.