KYC friction raises cost and loses customers

Where this pressure most often appears in the customer lifecycle

OnboardingPrimary

Ongoing monitoring

Exit & de-risking

In April 2026, the FCA’s review of customer due diligence found firms unable to demonstrate basic evidence of effective control, including what due diligence had been undertaken and recorded, when periodic reviews should take place, why the customer relationship existed, when senior sign-off was required, and whether onboarding and review were sufficiently independent.

This is not only a UK regulatory concern. AMLA has made a single CDD rulebook and greater supervisory convergence across Europe a core priority for 2026 – 2028.

Different regulators are moving in the same direction: away from asking whether a policy exists, towards asking whether the firm can demonstrate that it works in practice.

The consequence is bigger than a compliance finding. Weak onboarding and review controls create friction for new business, leave the back-book exposed and make it difficult for management to know which risks are genuinely being managed.

How this pressure tends to show up in practice

It often starts at onboarding. A relationship manager has promised a new client access within days, but the file requires Enhanced Due Diligence (EDD) and approval, not because the risk demands it, but because the firm’s own standard is asking for more information than the risk-based rules actually require. The commercial pressure is immediate; the control weakness (over-collection, ill-defined thresholds, and no clear line between what reduces risk and what just adds onboarding friction) is harder to see.

Then the same problem moves into the existing book. A periodic review becomes overdue, not because the customer necessarily represents higher risk, but because the firm is still running a calendar-based cycle instead of an events-based monitoring framework, reviewing files on the anniversary rather than when something in the relationship has actually changed. Overdue files build as a backlog statistic, and operational capacity, already stretched by an onboarding standard that asks for more than it needs to, is pulled in to clear them. By the time it is reviewed, the customer’s circumstances may have changed significantly.

That is how a risk-based control becomes a calendar exercise.

The problem does not stop at CDD. Onboarding and periodic review provide the information other financial-crime controls rely on. If that information is incomplete, outdated or poorly evidenced, the weakness travels, affecting everything from screening and higher-risk customer management to the firm’s wider view of economic-crime risk.

At the end of the day, the regulator doesn’t see the reasons why things aren’t as they should be. All they see is an outdated or incomplete file, and a risk nobody can prove is under control.

How we support you

We work across the customer lifecycle, from onboarding through to periodic review, to understand where the process is breaking down, what the firm’s actual exposure is, and what needs to change.

A typical engagement might involve:

Complete a short diagnostic

Review a sample of CDD and EDD files to test file quality, identify overdue reviews and spot where the process creates risk or customer friction.

Establish what’s actually required

We can also review and assess your current operating model, process, customer risk assessment, policies and CDD standards against the regulations and guidance, identifying potential gaps and where they go beyond what is required, separating due diligence that reduces risk, from activity that adds friction and is not required as part of a risk based approach.

Prioritise what needs fixing

Risk-rank the gaps and potential simplification opportunities against that standard and agree what needs attention first, alongside strategic opportunities to enhance onboarding and ongoing monitoring.

Redesign the operating model

Recommend how the operating model across people, process and technology needs to change to deliver an events-based, risk-proportionate approach, removing duplicated steps, defining the triggers that drive review, and building ownership, escalation and challenge into the way the model runs day to day.

Support transformation and make it sustainable

Mobilise the change through the first and second lines, embed the new approach into policy, procedures, playbooks and training, and stand up the MI and reporting management needs to know the control is working. Deploy Compass to keep country risk and jurisdictional exposure current, so information stays current in the run of business, not just in a periodic refresh.

The aim is not simply to clear a backlog. It is to leave the firm with a control framework that determines which customer needs attention, why, when and what evidence is sufficient, and gives management a clear view of whether the control is actually working.

See our full list of services

Where we’ve done this

UK challenger bank

Why we were brought on: an FCA skilled person review had identified gaps in the bank’s financial crime controls.

What we did: rebuilt onboarding, ongoing monitoring and screening procedures, and the underlying customer risk assessment methodology, from the ground up.

Outcome: those procedures are now live and version-controlled, replacing what the review had found inadequate.

UK retail bank

Why we were brought on: needed SME support to assess the feasibility of its customer risk assessment methodology and review its identity-verification journey.

What we did: delivered that assessment, then extended into anti-impersonation checks and control redesign as further gaps surfaced.

Outcome: the engagement scope expanded significantly as the work uncovered more that needed fixing than originally scoped.

UK asset manager

Why we were brought on: internal audit had identified gaps against FCC standards across AML/CTF, CDD, screening, fraud and transaction monitoring.

What we did: led the standards-implementation workstream to close those gaps, aligned to the firm’s CRA methodology.

Outcome: FCC standards uplifted and the audit gaps closed.

These engagements span different operating models, but the underlying challenge is consistent: making customer risk assessment and review processes proportionate, operationally workable, and defensible.

Why this matters

The commercial and regulatory consequences of getting this wrong are increasingly difficult to separate.

70%

Fenergo’s 2025 Financial Crime Industry Trends Report found that 70% of financial institutions lost clients to inefficient onboarding in 2025, up from 67% the previous year, and that automation of periodic KYC reviews averages only around a third of workloads industry-wide.

12 months

pause on onboarding new EDD clients

4,700

existing EDD clients, with a separate pause on inflows

£60m

two-year remediation and redress programme, net of insurance

A recent industry example shows what’s at stake beyond customer friction.

In one FCA section 166 case involving a UK wealth manager, the review found weaknesses in compliance, oversight and assurance. The firm agreed a twelve-month pause on onboarding new EDD clients, a separate pause on inflows from around 4,700 existing EDD clients, and a two-year remediation and redress programme costing approximately £60 million, net of insurance.

Our experience sits at both ends of that problem: diagnosing where controls are failing and rebuilding them so that risk, operations and commercial priorities can work together.