How perpetual KYC can save time and resources
What happens next when the name of a customer or supplier appears on a watchlist? How a company answers that question can have a major influence on its performance. In this article Neil Isherwood, Compliance Subject Matter Expert at Dun & Bradstreet, outlines data’s role in a rapid, effective response.
Know your customer (KYC) can be a painstaking process. The first step, collecting identity information from customers or third parties and verifying it against public records, is often laborious because those records may be fragmented across registries in multiple jurisdictions.
When verified, identities must also be checked against various watchlists that range from sanctions to politically exposed persons (PEPS) and adverse media. After that, individuals are assigned a risk category that determines how often they are subject to a KYC review. Those allocated a high risk might be re-checked annually, but those on lower bands may not be scrutinised for years at a time.
This poses a fundamental problem. If a log of directors and ultimate beneficial owners (UBO) is out of date, it could be that the wrong people are being screened. Following a change in directors or owners, months or even years may elapse before an institution realises it is doing business with a company now owned by someone subject to sanctions or suspected of criminal activity.
“Most institutions probably opt for a one year, three year or five-year cycle, depending on the level of risk,” says Neil Isherwood, Compliance Subject Matter Expert, Dun & Bradstreet. “But three or five years is a long time. A lot can change.”
Moreover, when a major risk event occurs, such as the Russian invasion of Ukraine in 2022, it can trigger the wholesale re-evaluation of a KYC database in a way that strains internal resources, especially when it comes to the beneficial ownership of companies. Even under normal circumstances, periodic reviews create peaks and troughs in activity that can be a struggle to manage.
“A significant portion of the feedback we receive highlights the inefficiency of periodic reviews, as the entire record has to be re-evaluated,” Isherwood notes. “It becomes a wasted effort when only one thing has changed, yet the entire process is repeated. Customers approach us, expressing concerns about the reviews scheduled for the next year, and they doubt whether they can address them with their current resources.”
Perpetual motion
For companies that have made KYC a continuous practice, however, the burden eases significantly. The idea behind perpetual KYC (P-KYC) “is that if a single director changes, it’s flagged automatically, and once you're aware of it, you can accept it,” says Isherwood. “If there are no sanctions, no PEPs or anything, it's still green. You don't have to go off and rediscover the full ownership again. You just evaluate that one piece.”
This makes screening much swifter and more effective. It means that an event such as the Russian invasion of Ukraine no longer risks rendering KYC information seriously out of date, or triggers a disruptive wholesale review, because important changes have been logged as they occur, and can be addressed via screening as sanctions and other watchlists are updated.
P-KYC is not simply a matter of automation. Regardless of how intelligent an automated system is, if the data it processes is of low quality or not sufficiently comprehensive, the results are unlikely to be fit for purpose. Data feeds ingested from an Application Programming Interface (API) such as Dun & Bradstreet’s are often fundamental to success, as manually scraping data from a wide variety of different sources may be too slow, error-prone and piecemeal to meet requirements, or to match the pace of change.
Nor does P-KYC dispense with human adjudication, although it can do much to help expedite it. For instance, when a name is flagged against a watchlist, it remains the task of compliance analysts to check whether there is a genuine cause for concern, or whether the alert is the result of a name that merely resembles that of someone else – a false positive.
KYC automation becomes a platform for faster decisions around false positives when it’s paired with enhanced data. Dun & Bradstreet research indicates a potential decline in false positives of up to 75% when name analysis is enriched with additional biographical information. As the scope of companies obligated to undertake KYC expands beyond banks to an ever-wider array of financial and non-financial businesses, more and more are turning to external providers to bolster their data resources.
Speed, efficiency and customer value
Turning KYC into a rolling process, rather than a stop-start one, takes pressure off a compliance department. It means that KYC reviews are only applied to companies where a material change has taken place. Risk ratings can be continuously updated and thus rendered more accurate, and information around ultimate beneficial ownership remains current. All this significantly reduces the amount of time and manual effort required, as well as the probability of errors and oversights.
For financial institutions in particular, P-KYC can also radically speed up the onboarding process for new clients. Challenger banks with digital-only platforms have much faster onboarding processes than their conventional rivals. This is a competitive advantage, given tangled KYC processes are a significant pain point for new customers, while false positives also pose risks to existing business relationships.
P-KYC is not merely a fusion of high-quality data providers and automation. It also entails mapping out what can be automated, what must remain a human task and establishing new patterns of work. Nevertheless, as data providers refine their offerings, making them easier to use and integrate into existing systems and workflows, the opportunity to shift to a form of KYC that balances rigour and risk mitigation with the need for every business to move quickly and responsively in service to customers is steadily expanding.
