An overdue KYC review is a warning that needs assessment, not proof on its own of a legal breach. The questions are which deadline was missed, whether required customer due diligence (CDD) and ongoing monitoring remain effective, and what risks went unaddressed. In the UK, for example, Regulation 28 requires current CDD information and risk-sensitive ongoing monitoring. It does not set one review anniversary for every customer.
That distinction is not permission to ignore the queue. The FCA’s CDD findings published in April 2026 identify firms failing to follow their own periodic-review policies as poor practice. Repeated delays can expose a control failure even where the calendar interval came from the firm’s policy.
This article is for compliance leaders, money laundering reporting officers (MLROs) and operations teams managing overdue customer or investor files. It focuses on assessing the backlog and recovering control. For the checks within an individual UK file, use our UK KYC periodic-review checklist and editable template.
Sources checked: 30 October 2026. This is general information, not legal advice. Consequences depend on the jurisdiction, regulated entity, applicable requirements and facts. The remediation workflow below is AgentKYZ’s practical recommendation, not a regulator-issued timetable.
Already know the scope and need review capacity? Explore AgentKYZ’s managed KYC and remediation services.
Which deadline did you miss?
Before labelling every overdue periodic file a regulatory breach, identify the source of its due date:
- An internal policy deadline. Your policy may require a review at a chosen interval based on risk. Missing it is a policy exception to investigate and escalate. Assess whether it also means the firm failed an underlying CDD or systems-and-controls obligation; do not assume either conclusion from the date alone.
- A legal or regulatory review requirement. Some frameworks specify a minimum frequency for particular customers. A firm cannot replace that requirement with a longer internal cycle. The Hong Kong example below shows why “all review dates are discretionary” is wrong.
- A firm-specific requirement or remediation commitment. Check any supervisory direction, licence condition, enforceable requirement or agreed action plan. Their legal status differs. Compliance or legal counsel should establish what the deadline requires and what happens if it is missed.
The condition of the file matters as much as its age. A review awaiting final sign-off, with current evidence and working monitoring, raises different questions from a file where a change in beneficial ownership has gone unchecked. Neither should be marked complete without the required decision.
HMRC’s ongoing-monitoring guidance tells supervisors to examine review frequency, evidence that information remains current and whether the firm does what its policies describe. It also gives an example of missed ownership changes involving a potential politically exposed person (PEP). An old “low risk” label cannot answer whether the customer is still low risk today.
What regulatory consequences can follow?
There is no single fine or enforcement outcome attached to the words “overdue KYC”. The applicable duty and the wider control failure determine the exposure. A published enforcement case shows how serious a backlog can become without suggesting that each late file attracts the same penalty.
In June 2020, the FCA fined Commerzbank AG’s London branch £37,805,400 for AML systems-and-controls failures between October 2012 and September 2017. By 1 March 2017, 1,772 clients were overdue updated due diligence checks. The FCA criticised an inadequately controlled exceptions process that allowed a material number of those clients to continue transacting.
The penalty addressed a wider breach of Principle 3, including transaction-monitoring and policy failings. It was not a tariff for 1,772 late reviews. The same FCA account records extensive remediation, a look-back for suspicious transactions, Skilled Person testing and voluntary restrictions on new high-risk customers and new trade-finance business.
For a firm assessing its own backlog, separate these possible consequences:
- Supervisory scrutiny and remedial work. Be prepared to explain the population, risk exposure, root cause and response. In its 2026 findings, the FCA says it is working with firms where weaknesses were identified to strengthen controls. Commerzbank illustrates how remediation can extend beyond refreshing documents to historical activity and independent testing.
- Financial penalties and public enforcement. These can follow established regulatory failures, as the Commerzbank case demonstrates. Its amount and outcome do not predict what another firm will face.
- Restrictions on a customer relationship. Where a UK firm is unable to apply CDD as required by Regulation 28, Regulation 31 requires specified transaction restrictions, termination of an existing relationship and consideration of a disclosure, subject to its exceptions. Being late on a workflow task and being unable to apply required CDD are not interchangeable findings.
- Potential criminal exposure for the underlying failure. UK Regulation 86 makes contravention of a relevant requirement an offence and provides a defence where the person took all reasonable steps and exercised all due diligence. Criminal liability requires analysis of the relevant requirement, facts and defence; a red dashboard entry does not establish it.
Completing the files addresses current gaps. It does not erase any breach during the overdue period or remove the need to assess what happened during it.
Review obligations differ by jurisdiction
Use the framework for the entity responsible for the relationship. A manager, fund and administrator may need separate assessments even when they hold copies of the same investor documents. These examples explain why one global deadline rule is unsafe; they are not a complete jurisdictional survey.
United Kingdom. Regulation 28(11) requires scrutiny of transactions and reviews of existing records to keep CDD information up to date. Paragraphs 12 and 16 make the measures risk-sensitive and require the firm to demonstrate their appropriateness. The provision does not impose one annual, three-year or five-year cycle across all customers. Read our UK AML requirements guide for the wider framework, and use the UK periodic-review checklist for file execution.
Hong Kong, for licensed corporations and SFC-licensed virtual asset service providers. Paragraph 5.3 of the SFC AML/CFT Guideline specifies at least an annual review for customers presenting high money-laundering or terrorist-financing risk, more frequently where necessary. Paragraph 1.8 says both “must” and “should” indicate mandatory requirements in that guideline. This is not merely a firm-selected anniversary.
The guideline also distinguishes its regulatory status from liability in proceedings. Paragraph 1.10 says non-compliance does not by itself render a person liable to judicial or other proceedings, but the guideline is admissible in relevant proceedings. Paragraph 1.11 says failures may affect fitness and properness and be considered misconduct. See our SFC AML requirements guide for scope and related duties; do not apply this framework indiscriminately to every Hong Kong institution.
United States, for institutions covered by the CDD Rule. FinCEN FAQ F.6 says there is no categorical requirement to update customer information on a continuous or periodic schedule. Updating is risk-based: when normal monitoring reveals a change relevant to assessing the customer’s risk, the institution must update the information. Institutions may choose periodic reviews based on risk. This does not make monitoring optional, and the rule does not apply to every business calling itself a fund or adviser. Our US AML requirements guide explains the scope distinctions.
For other entities in a cross-border structure, start with the relevant Singapore MAS AML/CFT guide or Cayman CIMA AML Rule guide. Check current primary requirements before assigning deadlines or deciding whether a breach occurred.
What to do next with an overdue KYC backlog
Start urgent escalations as soon as you identify them. Do not wait for a complete inventory or project plan. For the remaining work, the following approach separates risk decisions from review production.
Establish the population and preserve the dates
Reconcile the review queue with the customer or investor register and the files held by any administrator. Include cases waiting for evidence, quality review or approval. Record the responsible entity, policy version, last completed review, original due date, overdue age, current risk rating, known triggers, missing evidence and owner.
Keep the original due date when setting a recovery target. If a date was entered incorrectly, retain the correction and its basis. Replacing all dates with next month’s deadline makes progress harder to assess and hides the original failure.
Prioritise exposure, not just the oldest file
Use overdue age alongside the reliability of the existing CDD, risk indicators and activity during the gap. We recommend distinguishing:
- Cases needing immediate compliance assessment, such as potential sanctions restrictions, suspicion, material identity or ownership doubts, or inability to apply mandatory CDD.
- Higher-risk or materially changed relationships needing accelerated review, including unresolved enhanced due diligence (EDD) gaps and relevant new PEP information.
- Other overdue reviews, scheduled by risk, age and evidence needs, with an earlier escalation route if new information emerges.
Illustrative comparison: a file two days late with an unexplained ownership change and an imminent payment may need attention before an older file whose information is confirmed current. This is a prioritisation example, not a grace period for the older case. Record why one case takes priority and who will complete the other.
Decide what may continue while work is open
Ask the authorised compliance or legal decision-maker to assess whether the relationship and proposed activity can lawfully continue. Where permitted, record interim measures, their owner, the evidence supporting the decision and when it must be revisited. Measures might include closer monitoring or limits on activity, depending on the applicable rules and facts.
Do not treat these measures as substitutes for CDD that the law requires. In particular, an internal extension cannot override Regulation 31 where it applies. Nor should a blanket offboarding instruction replace the case-specific assessment. Customer communications and any handling of funds need to follow the relevant legal and confidentiality requirements.
Set a delivery plan that includes decisions
Assign reviewers, evidence-request owners, quality reviewers and approvers. Estimate capacity using representative cases from your population, including complex structures and missing information. A plan based only on easy files will not tell you when the difficult cases can close.
Set milestones by risk group, with dependencies and escalation dates. Protect capacity for new reviews and trigger events so the recovery project does not create the next backlog. If you need operational support, AgentKYZ’s managed KYC service can be scoped around the agreed population, policy and handover standard; your team retains the decisions.
There is no assumed 30-day or 90-day grace period in this workflow. A recovery target is a delivery commitment, not an extension of a legal or regulatory obligation.
Complete the evidence and test the outcome
Use the applicable jurisdictional standard to perform the review. For UK relationships, the existing 12-step checklist covers the file checks; they are not repeated here.
Keep “reviewer finished”, “awaiting approval”, “missing mandatory evidence” and “closed with an authorised outcome” distinct. Validate completed cases against the evidence and decision standard, with quality checks proportionate to risk. If testing exposes a repeated defect, assess the rest of the affected population rather than correcting only the sampled files. The FCA’s 2026 findings distinguish effective independent testing and follow-up from weak assurance arrangements.
Assess notifications and suspicious activity separately
Do not wait until the project finishes to decide whether a notification is due. For firms within the relevant FCA rules, SUP 15.3 addresses matters with serious regulatory impact, significant rule breaches and notifications under Principle 11. Its guidance includes significant systems-or-controls failures. Some notifications are required immediately once the specified awareness threshold is met.
Have compliance or legal counsel assess the applicable trigger, timing, recipient and information required. Record that assessment and revisit it as facts emerge. There is no universal rule that every late file must be individually reported to every supervisor.
A suspicious activity report (SAR) is a separate question. Overdue status alone does not establish money-laundering suspicion; the review may uncover facts that require escalation and reporting. The NCA’s SAR guidance explains the reporting regime, tipping-off risks and why a SAR does not replace reporting to another relevant authority. Follow the applicable local reporting test and timing, involve the MLRO through the approved route, and keep sensitive reporting details out of the general backlog tracker.
Show whether the backlog is actually shrinking
Report enough detail for management to challenge progress. Our recommended dashboard distinguishes:
- Opening overdue population, newly overdue cases and evidence-supported closures.
- Overdue age and risk distribution, including the oldest higher-risk cases.
- Cases blocked by missing information, quality findings or pending approval.
- Interim restrictions, expiring exceptions and unresolved escalation decisions.
- Delivery against the agreed milestones and changes to the forecast.
Reconcile the figures: opening backlog plus new overdue cases, minus verified closures and separately explained adjustments, should equal the closing backlog. Do not count a customer email sent, a reassigned case or an extended due date as a completed review.
Then address the cause. Was the schedule unsuitable for the actual risk? Were files inaccessible, responsibilities unclear, evidence requests ineffective or approvers under-resourced? Record the correction and test whether it works over subsequent review cycles. The FCA findings specifically call out unclear review cycles, failures to follow policies and missing version control. A lower backlog count alone does not demonstrate that those weaknesses have been fixed.
Scope the overdue reviews with AgentKYZ
AgentKYZ supports periodic reviews and KYC remediation under your approved AML policy. Your team can use the review software, or engage our managed KYC specialists to work the agreed files. In the managed service, agents organise evidence and prepare the first pass; qualified compliance reviewers check the work before handover.
Agree the population, priority groups, evidence standard, escalation route and completion criteria before work starts. The handover should make resolved findings and remaining exceptions visible to your authorised team. If another provider holds the files and you need a separately scoped review of its work, Shadow KYC can support that oversight; it does not replace a programme-wide independent AML audit.
Your firm retains compliance responsibility, customer acceptance, required approvals and reporting decisions. AgentKYZ does not certify that a backlog was lawful or guarantee regulatory acceptance. Delivery dates depend on scope, evidence availability and case complexity, and are agreed for the engagement.
Bring the case count, jurisdictions, risk mix, overdue-age profile and target date to a scoping call. No identity documents are needed to start that conversation. Agree the work and secure-transfer arrangements before sending customer files.