KYC Periodic Review Checklist for UK Firms

A UK KYC periodic review checklist should show what changed, what evidence supports the current risk assessment and who approved the outcome. Start with the existing file, refresh the information that needs updating, investigate inconsistencies and record the next review date. Keep an earlier-review route for new risks between scheduled reviews.

Know your customer (KYC) reviews keep customer due diligence (CDD) information current. This guide is for compliance and operations teams at UK financial services firms, including fund managers, administrators, banks and investment firms. It focuses on existing customer relationships under the Money Laundering Regulations 2017 (MLRs). Confirm which entity, activity and supervisor are in scope; a UK manager and an offshore fund may have different obligations.

Written by AgentKYZ. Sources checked: 19 October 2026. This is general information, not legal advice. The checklist is our operational template, not an FCA-issued form or a guarantee of compliance. Adapt it to current law, sector guidance and your approved anti-money laundering (AML) policy with qualified advice where needed.

Download the free editable UK KYC review checklist (CSV), or use the 12 checks below. Open the CSV in Excel or another spreadsheet application. No customer information is collected by this download. If you need capacity to complete the reviews, see AgentKYZ’s UK managed KYC service.

What UK law requires and what your policy decides

Regulation 28(11) requires ongoing monitoring: scrutinising transactions against what you know about the customer, their business and risk profile, including source of funds where necessary, and keeping CDD documents or information up to date. Regulation 28(12) makes the extent of CDD risk-sensitive. Under Regulation 28(16), the firm must be able to demonstrate that its measures are appropriate to the risks.

Regulation 27(8) and (9) require CDD at appropriate times for existing customers on a risk-based approach and when relevant circumstances change. Other triggers include doubts about identification evidence and suspicion of money laundering or terrorist financing. Regulation 27(8) also includes particular contacts required by law concerning beneficial ownership or international tax compliance.

These provisions do not set one universal annual, three-year or five-year review cycle. The FCA’s Financial Crime Guide, FCG 3.2.5, describes regular periodic reviews and event-driven procedures as examples of good practice for keeping CDD current. The guide is supervisory guidance; the underlying legal duties remain those in the applicable rules and legislation.

Your policy should set the review intervals, trigger triage, evidence standards and approval roles for your business. Higher-risk relationships require enhanced due diligence (EDD) and enhanced ongoing monitoring under Regulation 33. A scheduled file review covers only part of the monitoring obligation.

The 12-step KYC periodic review checklist

Use one checklist per customer relationship. Record the customer reference, responsible legal entity, reviewer, policy version, last completed review, current due date and review reason. For every item, retain status, evidence reference, finding, action owner and due date. Use “not applicable” only with a reason. Keep sensitive documents in the approved repository, with links or references in the checklist.

The actions below combine legal duties with recommended ways to document them. The named regulations establish the duties; the suggested evidence and workflow fields are AgentKYZ’s practical recommendations.

1. Define the review scope and reason. Identify whether this is a scheduled review, a trigger-event review or remediation of a known gap. Check the previous assessment and unresolved actions. Record the products, accounts and period of activity covered, including any information held by an administrator or another team. Retain the review assignment and policy reference. Escalate a material new concern immediately through the approved route rather than leaving it in a routine queue.

2. Check customer identity and representatives. Confirm that customer details remain accurate and that existing verification is adequate. Check relevant changes in legal name, address, company status, business activity and authorised representatives. Verify new representatives and their authority as required by Regulation 28(10). Retain updated independent evidence where needed and explain any decision to reuse existing evidence. An expired passport does not automatically require a complete repeat of onboarding; doubts about the evidence do trigger CDD under Regulation 27(1)(d).

3. Refresh beneficial ownership and control. Review changes in direct and indirect ownership, control rights and relevant trust roles. Identify and take reasonable measures to verify beneficial owners under the applicable tests, documenting the ownership chain and any unresolved links. Regulation 28(9) prevents reliance solely on registrar information to satisfy its beneficial ownership requirements. Retain the current structure, supporting evidence and analysis of changes; a customer-supplied chart alone may leave important questions unanswered.

4. Check register discrepancies where applicable. For customers within Regulation 30A, obtain the relevant register excerpt, or establish that no relevant information is held, as required during ongoing CDD. Compare it with what the review establishes. Assess material discrepancies under the statutory test and report them to the appropriate registrar or HMRC as applicable. Keep the extract, assessment and reporting reference. Companies House guidance distinguishes reportable discrepancies from minor errors and differences between PSC and AML beneficial-owner definitions.

5. Refresh screening and assess the results. Check the customer and relevant connected parties under your screening policy for sanctions, politically exposed person (PEP) exposure and relevant adverse information. Record search dates, identifiers, sources and why each potential match was cleared or escalated. Confirm the screening provider uses current UK sanctions data. Assess sanctions ownership and control separately from the AML beneficial-ownership test. A clear name search does not establish that sanctions cannot apply to an unlisted entity.

6. Compare actual activity with the expected relationship. Review relevant transactions and monitoring findings against expected values, frequency, counterparties, products and countries. For investor files, consider subscriptions, redemptions and third-party payments where relevant. Record the review period, information used, unexplained deviations and follow-up. Where another team monitors transactions, obtain its relevant findings and define who investigates gaps. Do not close this step simply because no alert was forwarded to you.

7. Reassess source of funds and wealth where required. Source of funds explains the origin of the money used; source of wealth explains how wealth was accumulated. Check whether existing explanations still fit the activity and whether new evidence is needed. Requirements depend on the risk and applicable EDD trigger, including Regulation 35 for PEPs and Regulation 33(3A) for the country trigger. Retain evidence and the reviewer’s assessment. A transfer from a named bank account may establish the payment route without explaining the origin of the money.

8. Update the customer risk assessment. Reconsider the customer, ownership, geography, products, delivery channels and activity using current information. Record the previous and proposed rating, the reasons for any change or no change, and any override. Explain why standard, simplified or enhanced measures are appropriate under the applicable requirements. A low numerical score cannot cancel a mandatory EDD trigger or a sanctions restriction.

9. Complete applicable enhanced checks and approvals. Where EDD applies, state the trigger and complete the measures it requires, including enhanced ongoing monitoring. For PEP relationships, record the role or connection, proportionate source-of-wealth and source-of-funds measures, and required senior-management approval for continuing the relationship. Apply the UK domestic PEP distinction explained below. Keep the evidence and approval record; a PEP database label alone is not the risk assessment.

10. Resolve gaps and escalate concerns. Give missing evidence and unresolved findings an owner, deadline and closure condition. Refer potential suspicion promptly to the nominated officer or money laundering reporting officer (MLRO) under the firm’s procedure, with restricted records and appropriate tipping-off safeguards. Handle sanctions concerns through the sanctions escalation route. Where required CDD cannot be applied, assess and act on Regulation 31, including transaction restrictions, termination and consideration of a disclosure, subject to its exceptions. An internal exception cannot waive a legal duty.

11. Record the decision and quality review. Have the authorised person decide the relationship outcome and document the reasons, restrictions and any required approvals. Apply your quality-control policy, including reviewer challenge appropriate to the risk. Distinguish “review work finished” from “relationship approved”. Keep the reviewer’s name, decision-maker, dates and any remaining actions; unresolved mandatory CDD should not be marked complete.

12. Set the next review and retain the record. Calculate the next due date under your approved policy, recording the risk tier, interval and reason. Keep trigger-event monitoring active. Preserve the evidence and decision history under Regulation 40 and your retention policy. Relationship CDD records are generally retained for five years after the relationship ends, not five years after this review. The regulation also addresses transaction records, a ten-year limit on the requirement for certain transaction records, and deletion of personal data unless an exception applies.

Set review frequency and earlier-review triggers

Build a schedule from your customer risks and the controls that operate between reviews. For each risk tier, record the interval, its justification, who approved it, the next due date and the escalation route for overdue work. Check any sector-specific requirements before adopting the schedule.

For illustration only, a firm might choose 12, 24 and 36 months for different risk tiers. Those numbers are not UK legal deadlines or a recommended default. A higher-risk relationship may need a shorter interval or more intensive monitoring; a longer cycle needs a defensible basis. The JMLSG current-guidance page links the October 2026 Part I guidance and flags subsequent revisions. Read the relevant sector guidance alongside it.

Examples of matters to assess before the next scheduled date include:

• A change in ownership, control, representatives or the purpose of the relationship.
• Activity inconsistent with the known business, unexplained third-party payments or new geographic exposure.
• A potential sanctions match, new PEP information or credible adverse information relevant to financial-crime risk.
• Doubts about identity evidence, significant missing information or a change affecting the risk rating.
• Required customer contacts falling within Regulation 27(8), including the specified beneficial-ownership and tax-compliance contacts.

Record when the trigger became known, the initial assessment and who owns the response. A possible sanctions restriction or suspicion needs prompt handling under the relevant procedure; a minor administrative update may need a narrower check. Neither should disappear behind the next scheduled date.

UK checks to keep current in 2026

Sanctions data changed on 28 January 2026. The UK Sanctions List became the sole source for UK sanctions designations; the OFSI Consolidated List stopped being updated. Confirm that your provider’s feeds and identifiers reflect that change. Designation screening is only part of sanctions compliance: assess ownership and control, relevant sectoral restrictions and applicable regime rules. Follow OFSI guidance on freezing, reporting and licensing where relevant. A suspicious activity report (SAR) does not satisfy a separate sanctions reporting duty.

The country-based EDD trigger changed on 30 June 2026. Regulation 33(1)(b) now refers to a person established in a FATF call for action country, including the specified relevant transactions. Check the current list when reviewing a case. FATF increased monitoring (the grey list) remains relevant to risk assessment but is not itself this automatic trigger. Other high-risk circumstances can still require EDD. The 2026 commencement provision gives later dates for some other amendments, so do not assume every provision is already in force.

UK domestic PEPs have a lower-risk starting point. Under Regulation 35, domestic PEPs, their family members and known close associates start at a lower risk than non-domestic PEPs. Without additional enhanced risk factors, the extent of EDD must be less. Required approval, adequate source-of-wealth and source-of-funds measures, and enhanced ongoing monitoring still apply. Use FCA FG25/3 when applying the rules proportionately. UK residence alone does not make someone a domestic PEP; the definition concerns prominent public functions entrusted by the UK.

Use the template to manage closure and overdue cases

The CSV includes case fields and the same 12 checks, with space for evidence references, findings, owners, deadlines and approval. Duplicate it for each relationship in an access-controlled location. Use the case reference rather than copying identity documents or confidential reporting details into a general tracker.

For a backlog, track total cases, risk tiers, overdue age, outstanding evidence, cases awaiting decision and completed reviews separately. Prioritise urgent triggers and higher-risk gaps. Preserve the original due date when recording a revised target; changing a spreadsheet date does not resolve an overdue review.

For the distinction between missed policy dates and legal breaches, reporting decisions and a population-level recovery plan, read Overdue KYC Reviews: Regulatory Risks and What to Do Next.

For queue prioritisation, staffing estimates and quality control across the population, see how to clear a KYC review backlog.

Illustrative example: a corporate investor’s scheduled review finds that a new holding company acquired its shares. The reviewer obtains the updated structure and supporting ownership evidence, refreshes relevant screening and checks whether the new information changes the risk assessment. One ownership link remains unsupported. The case stays open with an evidence owner and escalation decision, even though the routine document checks are finished.

For the wider framework and outsourcing responsibilities, read our UK AML compliance guide. If your administrator holds the files, agree record access and responsibility for follow-up before starting the review.

Put the checklist to work with AgentKYZ

AgentKYZ’s UK managed KYC service supports periodic reviews, onboarding and CDD remediation under your approved AML policy. Agents organise the evidence and perform the first pass; qualified compliance reviewers check the work. Your team receives reviewed files, proposed risk assessments and an exception log for its decisions.

For teams evaluating KYC review software or a managed service, use a sample case to test whether evidence, screening rationale, changes in risk and outstanding actions can be followed through to the decision. Agree scheduling, data feeds, integrations, access controls, human review and record export within the proposed scope. Ask who handles transaction-monitoring findings and urgent escalations.

If your fund administrator already performs the work and you need a separate file review, Shadow KYC supports oversight and remediation. Your firm retains compliance responsibility, customer acceptance, required approvals and reporting decisions.

Bring the case count, customer types, risk mix, overdue profile and target date to a scoping call. AgentKYZ can agree the review scope, deliverables and price before you transfer customer documents through an agreed secure channel.