Onboarding remediation: stages and deadlines

Onboarding remediation is the process of closing gaps in a client file after the file has already been accepted. It runs in stages: gap identification, client notice, document collection, verification, risk re-rating and sign-off. There is no single statutory deadline for the whole process. Each obliged entity sets its own internal timeline, driven by risk rating, and that timeline has a point beyond which the account is restricted rather than merely flagged.

Why remediation happens

A file moves into remediation when a periodic review, a transaction pattern, a name-screening hit or a change in ownership shows that the original due-diligence file no longer matches the client's current risk profile. The trigger is internal policy, not a single external instruction. The obligation to keep client files current is a standing one, and remediation is simply how an obliged entity discharges it once a gap is found.

What changes once remediation starts

Three things change immediately. First, the client file is marked open and cannot be closed by a routine review until the gap is resolved. Second, the account moves under closer transaction monitoring for the duration of the case. Third, a deadline is set for the client to respond, and that deadline is tracked separately from the general review cycle.

None of this changes the client's underlying rights. It changes the pace at which the relationship is allowed to continue without fresh evidence.

Steps to complete remediation

• The compliance team records the specific gap and the risk rating that triggered it.
• The client receives a written request naming the exact documents or clarifications required.
• The client submits the documents through the channel specified in the request, not through ad hoc correspondence.
• A reviewer checks the submission against the gap, not against the whole file.
• If the submission closes the gap, the file is re-rated and the case is closed.
• If the submission is incomplete, one further request is sent, with a shorter internal deadline.

Who signs off and who escalates

Ownership of a remediation case sits with the compliance function, not with the relationship team. A relationship manager may collect documents, but only a compliance officer can close the case or escalate it.

The pace at each stage is set case by case. An entity with a straightforward retail file moves faster than one with layered corporate ownership across several jurisdictions. Internal policy, not a fixed external clock, sets the actual number of days at each step.

If your file looks like this

If verification tasks sit with an external provider and the arrangement itself comes under scrutiny, a separate procedure applies: Outsourcing is challenged by the supervisor authorisation who decides.

If a client refuses to grant audit rights under the account agreement, escalation follows a different track, set out separately: When an audit clause is refused.

Where the file belongs to a client whose business involves physical goods, a comparable hold-up can appear outside the compliance file itself, for example: When a customs authority detains a shipment.

Where the verification vendor changes during remediation and client data moves to a new processor, a related question arises: When personal data flows to a new subprocessor.

If the client is unresponsive rather than uncooperative, the deadline still runs, but the escalation letter is worded differently, and the record of attempted contact becomes the key document in the file.

The point of no return

Every remediation timeline has a point at which silence stops being tolerated. Once the internal deadline passes without a substantive response, the account is typically restricted: outgoing transactions are held, and new activity is paused. A further, shorter deadline usually follows before the relationship is terminated. This is not a penalty against the client; it reflects that the obliged entity can no longer justify treating the file as current.

What this page does not cover

This page describes the internal mechanics of a remediation case. It does not set out the statutory basis for ongoing due diligence, the content of a specific regulator's guidance, or the deadlines that apply to a single named jurisdiction. Those depend on the entity's home regulator and licence, and they are addressed on a case-by-case basis, not on this general procedure page.

Verified

This description reflects internal escalation and quality-control practice as generally applied by obliged entities in the digital assets sector, reviewed as at the publication date of this page. It is not a substitute for the specific escalation policy of any single entity, and it does not state a statutory deadline.

Related publications

A related process, covered separately, is how ongoing monitoring rules are reviewed once a file has been closed: Monitoring rule review step by step.

FAQ

How long does onboarding remediation take in practice?

There is no fixed statutory period. Duration depends on the risk rating of the client, the number of jurisdictions involved and whether an external verification provider is part of the file. Straightforward retail cases close faster than layered corporate structures.

Which documents are needed to start?

The request names the exact gap: typically proof of identity, proof of address, evidence of source of funds, or an updated ownership chart. The client receives a specific list, not a generic checklist, because the request targets the identified gap rather than the whole file.

What happens if the other side does not respond?

A first missed deadline usually triggers a reminder with a shorter internal deadline. A second missed deadline typically leads to account restriction: outgoing activity is held pending a response. Continued silence moves the case to termination of the relationship.

— Aleks Vaher, AURELIS