Onboarding remediation: what the decision maker looks at
Onboarding remediation reopens a client file that no longer matches its risk rating, a missing document, or a trigger event. The decision maker reviews the gap, the client's response, and the residual risk before choosing to close the file, restrict the relationship, or escalate to exit. The review sits with the compliance function, not with the account team.
What triggers remediation, and what it changes
A file usually reopens for one of a small number of reasons: a periodic review falls due, adverse media appears on the client or a beneficial owner, ownership or control changes, a transaction pattern breaks the expected profile, or an internal audit finds a document missing from the original onboarding. None of these triggers requires a court finding or a regulator's letter — an internal control catching a gap is enough to start the clock.
Once a file is flagged, new activity outside the documented risk appetite stops until the gap closes. This is an operational hold set by the compliance function, not a freeze imposed by a court or a regulator. The account team keeps servicing existing, already-approved activity unless the compliance officer says otherwise in writing.
What to do
- The compliance analyst pulls the client file and lists every open gap against the current risk rating.
- The case owner sends the client a written request naming each missing item and a response deadline.
- The compliance officer assesses the response against the risk rating and drafts a recommendation: close, restrict, or escalate.
- The MLRO or senior management, depending on the risk tier, takes the decision and records the reasoning.
- The compliance function files the decision, dated and signed, inside the client's permanent record.
- If exit is chosen, the relationship manager runs the wind-down on the firm's internal schedule.
Who decides
Authority moves up the chain as the risk rating rises. A low-risk document gap can close at analyst level; a high-risk ownership question goes to the escalation committee.
| Stage | Who decides | Typical forum | Timing |
|---|---|---|---|
| Gap identification | Compliance analyst | Case file review | Ongoing, on trigger |
| Client response review | Compliance officer | Internal case review | Set by internal policy |
| Escalation decision | MLRO or senior management | Escalation committee | Set by internal policy |
| Exit execution | Relationship manager with compliance sign-off | Wind-down checklist | Notice period per contract |
Forks
If the file review overlaps with a change of regulator partway through a licensing project, the escalation timeline can shift — see The regulator changes during the project authorisation the deadline.
If the client's technology stack includes open source components whose terms conflict with the service agreement, that conflict is logged as a separate gap and does not block the AML decision on its own — see When open source terms conflict with the licence.
If beneficial ownership records surface a joint development partner who filed a patent alone, ownership needs re-verification before the file closes — see When a joint development partner files alone.
If the client routes part of its operation through a subcontractor abroad, remediation confirms the data-handling terms before the risk rating is reset — see When the outsourcing provider subcontracts abroad.
What this page does not cover
This page describes the internal escalation path only. It does not set the substantive risk rating methodology, does not decide whether a specific finding meets an internal threshold, and does not replace the firm's own remediation policy. Numbered thresholds and internal scoring rules are policy detail, not procedure, and belong in the firm's own manual rather than in a public guide.
Verified
This page describes an internal escalation procedure. It carries no statutory citation because a procedural page of this kind reports process steps, not legal provisions, and no external source is claimed here. Reviewed for internal consistency on 4 June 2025.
Related publications
The same decision-maker structure appears in ongoing monitoring, not only at onboarding — see Monitoring rule review step by step.
FAQ
How long does a typical onboarding remediation take?
A single missing document usually closes in five to ten business days. A gap involving beneficial ownership or an adverse media hit can run four to six weeks, mainly waiting on the client's response.
Which documents does the case owner need to start?
The current KYC file, the risk rating history, the trigger event note that opened the case, and the correspondence log with the client. Without these four, the analyst cannot map the gap.
What happens if the client does not respond to the remediation request?
The clock keeps running from the first request. No response by the stated deadline moves the file to restriction, and continued silence moves it to exit, under the firm's own internal schedule.