How to Clear a KYC Review Backlog: Prioritisation, Resourcing and Quality Control

To clear a KYC review backlog, identify urgent cases first, rank the remaining work by risk and evidence gaps, and resource the whole review through to quality control and an authorised decision. Keep cases awaiting evidence or approval visible. A rising count of processed files tells you how much work moved; it does not establish that the firm has met its obligations.

A backlog may contain overdue periodic reviews, event-driven reviews and remediation of known customer due diligence (CDD) defects. Separate those populations before setting a target. A missing ownership link and an administrative record update need different work, even if both appear as one overdue case.

This guide is for compliance and operations leads at funds, administrators, investment firms and other financial institutions. It covers managing the queue, rather than repeating the checks on each file. For those checks, use our UK KYC periodic review checklist, adapted to the relevant jurisdiction.

If you first need to assess whether a missed deadline involves a legal breach or a reporting duty, read Overdue KYC Reviews: Regulatory Risks and What to Do Next. This guide focuses on delivering the review work: prioritisation, capacity and quality control.

Written by AgentKYZ. Sources checked on 31 October 2026. The workflow, priority groups and capacity example below are operational recommendations, not regulatory deadlines or prescribed sampling rules. FATF sets international standards for countries to implement; the FCA and UK legislation cited here provide UK examples. Confirm the obligations of each legal entity before applying the model elsewhere.

Define the population and what completion means

Start with a reconciled case register. Compare the customer population, review schedule, administrator records and known audit or monitoring findings. Explain duplicate records and exclusions rather than deleting them silently. Keep the original review due date when setting a revised delivery target.

For each case, record:

• The customer reference, responsible legal entity, jurisdiction and review trigger.
• The current risk rating, when it was assessed and any new information that could change it.
• The last completed review, original due date and any separate legal or supervisory deadline.
• Known evidence gaps, relevant activity and linked findings from screening or transaction monitoring.
• The assigned reviewer, next action, action owner, target date and escalation reference.
• Separate statuses for evidence, review, quality control and the relationship decision.

Store documents in the approved repository and use references in the register. Restrict sensitive investigation and reporting records to the people who need access.

Agree the exit criteria before counting completions. A completed review should have the required evidence and analysis, a supported risk assessment, the applicable checks and approvals, and a documented outcome. Relationship exit, duplicate removal and transfer to another workstream are different outcomes. None should be reported as successfully refreshed CDD.

FATF Recommendation 10 and its Interpretive Note call for CDD on existing customers according to materiality and risk, taking account of previous checks and the adequacy of the information obtained. They also address ongoing scrutiny of transactions and keeping information current. Completing a review is one part of that continuing work.

Prioritise the KYC review backlog by risk

Use the existing risk rating as an input, not an unquestioned instruction. An old low-risk label may predate a change in ownership or activity. Where the rating or supporting data is missing, assign a triage owner to establish a defensible priority; do not treat an unknown risk as low risk.

The FCA’s FCG 3.2.3 identifies ownership structures, political connections, geography, source of funds and expected activity among relevant risk factors. FCG 7.2.2A specifically identifies low-quality KYC assessments and review backlogs as raising the risk of failing to identify sanctioned people and entities.

The following is a suggested triage model. Enhanced due diligence (EDD) means the additional measures required for the relevant higher-risk situation. Urgent findings can arise in any group and should override routine scheduling.

Illustrative priority groups, not regulatory categories or time limits. Scroll the table horizontally to read all columns.

Add the severity of each gap, the nature of current activity, review age and relevant deadlines to the scheduling decision. Keep effort estimates separate from priority: an easy file should not displace an urgent one merely because it improves output figures. Where practical, run routine work in parallel with specialist reviews rather than leaving all lower-risk cases untouched.

For example, a review three days overdue with a new potential sanctions match needs prompt sanctions assessment ahead of a routine review 180 days overdue with no identified urgent concern. Those ages are illustrative, not acceptable-delay thresholds. The older case still needs an owner and a credible date.

Document overrides and revisit the queue when evidence, alerts or deadlines change. Customer value, a commercial deadline or pressure to hit a weekly target cannot cancel a mandatory check or restriction.

Give urgent and high-risk cases a named escalation route

The project needs a route to the money laundering reporting officer (MLRO) or nominated officer, sanctions lead, relevant specialist and authorised senior approver. Name deputies and agree how urgent matters reach someone outside normal project meetings. Track acknowledgement and the action taken, not just whether an email was sent.

Distinguish three kinds of escalation:

1. Potential suspicion. Refer concerns promptly under the applicable reporting procedure. Do not wait for a complete evidence pack before raising a concern. FATF Recommendations 20 and 21 address prompt reporting to the financial intelligence unit and prohibitions on tipping off; the local legal test and reporting route govern the actual decision. Keep customer communications under appropriate control where further enquiries could tip someone off.
2. Sanctions concerns. Use the sanctions route for match assessment, applicable restrictions and reporting. A possible match is not automatically a confirmed match, but it needs timely assessment. In the UK, OFSI’s general guidance explains asset-freezing and reporting duties. An asset freeze is not a routine account closure or a return of funds. A suspicious activity report does not discharge a separate OFSI reporting obligation.
3. Higher-risk CDD and approval. Refer complex ownership, unexplained source of funds or wealth, and other material issues to staff with the competence and authority to resolve them. Apply the EDD and senior-management approval requirements relevant to the case. A higher-risk rating is not, by itself, proof of suspicion. FCG 3.2.8 and 3.2.9 discuss enhanced checks, challenge and monitoring.

Set internal response targets around the applicable obligation and the potential harm. A project service-level agreement must never extend a legal deadline. Where the backlog reveals a significant control failure, have compliance assess any supervisory notification duty as well. For example, FCG 7.2 on reporting potential sanctions breaches addresses notification to the FCA where a significant systems-and-controls failure may be involved. Recording a recovery plan is not a substitute for required notification.

Resource the bottleneck, not just the first review

Run a pilot across the actual case mix before promising a completion date. Include straightforward reviews, complex entities, EDD and files with missing evidence. Measure active work and elapsed waiting time separately. A reviewer may need two hours of work on a case that takes several weeks to obtain evidence for; those are different planning problems.

Estimate remaining hours for evidence gathering, analysis, checking, expected rework and approval. Include training, policy questions and time to calibrate reviewers on the same examples. Use productive hours available after leave, meetings and business-as-usual commitments, rather than assuming every paid hour produces case work.

Illustrative capacity calculation: 240 routine files at 2 hours each plus 60 complex files at 6 hours each require 840 review hours. Adding an assumed 25% for checking, rework and approval gives 1,050 hours. At 25 productive hours per person per week over six weeks, that is seven full-time-equivalent staff across the work. These are illustrative assumptions, not industry benchmarks or an AgentKYZ delivery estimate.

That aggregate estimate is only a starting point. Test the hours and skills needed at each stage. If analysts prepare 50 files per week but qualified checkers can assess only 30, the work accumulates at quality control. Adding more analysts will not remove that constraint. Approval capacity and specialist availability need their own allocation.

Ring-fence enough capacity for new reviews, ongoing monitoring and urgent cases. Without that allocation, an old backlog can shrink while a new one grows. Reforecast using accepted work, observed rework and evidence response times; show the assumptions behind any target date.

Choose the resourcing model for the work that is short of capacity:

• Use internal staff where decisions depend heavily on firm-specific knowledge, with protected time and clear authority.
• Use temporary specialists or a managed service for a defined review population, with agreed policy, evidence standards, access, escalation and acceptance criteria.
• Use software to support evidence organisation and case work, while retaining the people needed to challenge findings and make decisions. Test its outputs against the pilot rather than assuming automation removes checking effort.

The FCA’s Financial Crime Guide asks whether the MLRO has sufficient resources, experience and authority. Its sanctions guidance also highlights the need for skilled resources to investigate alerts and avoid backlogs. These support planning for specialist capacity, not only a total headcount.

If the file work is the constraint, scope managed KYC support with AgentKYZ. Bring the case count, risk mix, jurisdictions and target date; you do not need to send identity documents to request a quote.

Keep unresolved evidence open and actionable

“Waiting for the customer” is a status, not a resolution. Record exactly what is missing, why it matters, which evidence could address it, who is requesting it and when the case returns for escalation. Preserve the original due date and the history of requests.

Ask for evidence that answers the actual question. If the gap is an unexplained ownership link, another copy of the customer’s passport will not resolve it. Check whether reliable alternative evidence is acceptable under the applicable requirements and approved policy. The FCA’s April 2026 CDD findings criticised policies that did not explain alternatives when customers lacked standard identification documents.

Use separate statuses such as “awaiting evidence”, “under specialist assessment”, “awaiting quality control” and “awaiting authorised decision”. An escalation referral can be complete while the underlying review remains unresolved. Keep that relationship visible in reporting.

An internal risk acceptance or a new target date cannot waive required CDD. As a UK example, where a relevant person cannot apply CDD required by Regulation 28, Regulation 31 requires specified transaction prohibitions, non-establishment or termination of the relationship, and consideration of a disclosure, subject to the regulation’s exceptions. Distinguish a routine evidence refresh from an inability to apply required CDD, and obtain the appropriate compliance or legal assessment. Do not let a project team invent a grace period.

Where continuing the relationship while a matter is resolved is lawful, document the basis, any interim controls, the accountable approver and the next review point. Monitoring cannot substitute for a legal prohibition. A decision to exit also needs lawful implementation, including sanctions and reporting considerations where relevant.

Check reasoning and evidence before accepting the work

Agree the quality standard before the pilot. Give reviewers the same policy version and examples of acceptable analysis. A checker should be able to follow the file from evidence to findings, risk assessment and decision without relying on an undocumented conversation.

Check whether:

• The right customer and connected parties were assessed, with ownership and control supported by evidence.
• Screening outcomes were investigated and explained, rather than cleared solely because a name was common.
• Relevant activity and changes were considered, with EDD and escalation handled where required.
• The risk rating follows the evidence and methodology, including the reason for any override.
• Required approvals are present, evidence references work, and unresolved matters remain visible.

Separate pre-completion quality control from independent assurance. A second reviewer checking production work can identify file errors; that alone is not an independent assessment of the whole AML programme. The FCA’s 2026 findings questioned arrangements where the same staff onboarded customers and performed second-line assurance on those customers. Stronger firms documented and acted on independent testing findings.

Set testing coverage according to risk, reviewer experience, known weaknesses and applicable requirements. One possible approach is full pre-completion checking of defined higher-risk cases and new reviewers’ initial work, with risk-based sampling elsewhere. Include a random element in lower-risk work so selection does not depend entirely on existing labels. Record the population, sample rationale and limitations. A sample pass does not prove that every untested file is sound, and sampling cannot replace mandatory case-level checks or approvals.

Define defects by their effect on the decision. A missed beneficial owner, unsupported screening clearance or absent required approval should block acceptance and trigger an assessment of related files. A minor indexing error may need correction without restarting the whole review. Record severity, root cause, rework and retest results.

When a serious or repeated defect appears, widen testing to the affected reviewer, case type or process, correct the cause and verify the correction. Do not absorb failures into a throughput number. Track both first-pass quality and the severity of defects.

Report the remaining risk and prevent the next backlog

Give management a view of the work still outstanding, including cases that are blocked or awaiting a decision. A useful report separates:

• Open and overdue cases by risk, age and original review trigger.
• Urgent escalations, missed response targets and the action taken, with restricted reporting details kept separate.
• Evidence-blocked cases, the age of requests and the owners of next actions.
• Files awaiting checking or approval, first-pass quality and serious defects.
• Accepted review outcomes, actual relationship exits and administrative corrections as separate counts.
• New work entering the queue, available capacity and the forecast against the agreed plan.

Reconcile movements each reporting period. Start with opening outstanding work, add new and reopened cases, subtract accepted review completions and separately identified exits or corrections, then reconcile to the closing balance. Show transfers into an exception queue as outstanding work, not as disappearance from the problem.

Use a fixed starting population to report the original remediation project alongside a rolling view of new work. Otherwise a project can appear successful while current reviews slip. FCG 3.2.1 and 3.2.5 address informative management reporting and ongoing monitoring; neither is replaced by a one-off clearance exercise.

Before winding down extra capacity, give each recurring failure an owner: late document requests, unavailable administrator records, unclear policy, poor data or slow approvals. Set the next review dates under the approved policy, keep trigger-event routes active and check that ongoing capacity covers incoming work. If it does not, escalate the shortfall while the recovery team is still available.

Scope a KYC backlog project with AgentKYZ

AgentKYZ’s managed KYC service supports periodic reviews and remediation under your approved AML policy. Agents work the cases; qualified compliance reviewers check the files. The agreed handover includes evidence, reasoning and unresolved exceptions for your authorised team. Delivery dates depend on scope, complexity, available evidence and responses to requests, and are agreed before work starts.

If an administrator already performs KYC and you need separately scoped file testing, consider Shadow KYC. Agree the reviewer’s independence and reporting arrangements. A provider’s review of its own production work is not independent assurance, and file testing is not a programme-wide AML audit.

Your firm retains compliance responsibility, customer acceptance and continuation decisions, required high-risk approvals and suspicious activity reporting decisions. Processing or closing a set of files does not, by itself, establish compliance.

For a scoping call, bring the population size, jurisdictions, risk and complexity mix, overdue profile, known gaps and target date. Agree what a completed file means, who owns unresolved cases, and how quality and urgent escalation will be handled. Confirm access and data-transfer arrangements before sending customer documents.