Customer Identification and KYC Lifecycle

Introduction and Context

Customer identification and Know Your Customer (KYC) processes are the operational foundation of an effective anti-money laundering and counter-terrorist financing (AML/CFT) framework. In investment banking, KYC is not limited to collecting a passport and proof of address. It is a risk-based process through which an institution establishes who a customer is, who controls or benefits from a relationship, why the relationship exists, how it is expected to operate, and whether the relationship remains consistent with the customer’s profile over time.

Investment banks face distinctive KYC challenges. Their customers may include multinational corporations, regulated financial institutions, private investment vehicles, sovereign entities, partnerships, trusts, charities, family offices, high-net-worth individuals and complex ownership structures. Relationships may involve underwriting, mergers and acquisitions, securities trading, custody, prime brokerage, private banking or correspondent banking. Each activity creates different exposure to money laundering, sanctions evasion, fraud, bribery, tax crime and terrorist financing.

KYC therefore serves several connected purposes:

• identifying and verifying customers and relevant associated persons;
• understanding ownership, control, purpose and expected activity;
• assessing the customer’s money-laundering and financial-crime risk;
• screening customers and transactions against sanctions and other risk databases;
• maintaining reliable records and an auditable decision trail;
• detecting material changes through periodic and event-driven review; and
• exiting relationships that cannot be managed within the institution’s risk appetite.

The precise legal requirements vary by jurisdiction. Institutions must therefore apply the law, regulatory guidance and internal policy applicable to the relationship, booking location, product and customer type. International standards, including those associated with the Financial Action Task Force (FATF), provide an important reference point, but they do not eliminate local legal differences.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the purpose and elements of customer due diligence (CDD), KYC and enhanced due diligence (EDD).
2. Design an onboarding process for individuals and legal entities.
3. Identify beneficial owners, controllers, authorised representatives and persons acting on behalf of customers.
4. Distinguish documentary verification from non-documentary and corroborative verification.
5. Apply risk-based screening, risk classification, periodic review and trigger-based refresh.
6. Apply privacy, proportionality, data-minimisation and retention principles.
7. Recognise weaknesses in KYC files and determine when escalation or offboarding is appropriate.

1. The KYC Lifecycle as a Control System

KYC is best understood as a lifecycle rather than a one-time event. The lifecycle begins before account opening and continues until the relationship is closed and records are retained for the legally prescribed period.

A practical lifecycle contains the following stages:

1. Pre-onboarding and acceptance: Determine whether the customer, product, geography and proposed activity fall within the institution’s risk appetite.
2. Identification: Collect information that establishes the customer’s identity and legal existence.
3. Verification: Test the reliability of the information using appropriate independent or reliable sources.
4. Ownership and control analysis: Identify beneficial owners, controllers and persons authorised to act.
5. Purpose and expected activity: Establish why the relationship is being opened and how it is expected to operate.
6. Risk assessment and approval: Assign a risk classification and obtain appropriate approval.
7. Ongoing monitoring: Compare actual activity and external information with the customer profile.
8. Periodic review and trigger-based refresh: Reassess information at scheduled intervals or when events indicate that it may be outdated.
9. Restriction, remediation or offboarding: Manage unresolved risk, including limits, enhanced controls, suspension or exit.
10. Record retention and destruction: Preserve necessary evidence securely and dispose of it lawfully when retention obligations expire.

The lifecycle is iterative. Information obtained during transaction monitoring may reveal that the original customer understanding was incomplete. Conversely, a corporate restructuring, change in ownership or adverse media event may require a new risk assessment even if no suspicious transaction has yet occurred.

A risk-based model

A risk-based approach does not mean applying fewer controls to every customer. It means allocating control intensity according to relevant risk factors. A simple conceptual model is:

Here, f denotes an institution-approved method for combining risk factors. It is not necessarily an arithmetic sum. Institutions may use scoring models, rules, expert judgement or hybrid methods. The model must be documented, validated and subject to governance. A low numerical score must not override a mandatory legal prohibition or a clear sanctions match.

2. Customer Identification and Verification

2.1 Individuals

For an individual, identification normally includes:

• full legal name and any relevant former or alternative names;
• date and place of birth;
• nationality or nationalities, where legally appropriate;
• residential address and, where relevant, correspondence address;
• occupation, employer or nature of business;
• tax residence information where required;
• identification document details; and
• contact information and relationship purpose.

Verification requires more than recording these details. The institution should examine the document’s validity, integrity, expiry, photograph, security features and consistency with other information. Depending on risk and law, verification may use government databases, regulated third-party databases, electronic identity services, biometric comparison, certified copies or reliable independent documents.

No single method is universally sufficient. For example, an identity document may establish identity but not current residence, source of wealth or authority to act. A customer’s address may be corroborated by a utility bill, bank statement, government correspondence or reliable electronic source, subject to legal and policy requirements.

2.2 Legal entities

A legal entity’s identity is distinct from the identities of its owners and representatives. The file should normally establish:

• legal name and trading names;
• legal form and registration number;
• date and jurisdiction of incorporation or formation;
• registered office and principal place of business;
• nature and purpose of business;
• constitutional documents;
• directors, partners, trustees or equivalent governing persons;
• ownership structure and control rights;
• authorised signatories and representatives;
• tax and regulatory status where relevant; and
• expected products, jurisdictions, volumes and counterparties.

Typical sources include corporate registries, constitutional documents, audited financial statements, regulatory registers, licensing authorities, stock-exchange disclosures and information obtained directly from the customer. Registry information is useful but may be incomplete, outdated or unavailable in some jurisdictions. A professional KYC assessment therefore tests registry information against other reliable evidence.

2.3 Persons acting on behalf of customers

The institution must verify not only the customer but also the authority of anyone acting for it. This may include an attorney, investment manager, director, trustee, employee, broker or authorised signatory. Relevant evidence may include board resolutions, mandates, powers of attorney, partnership authorities, trust instruments or digital authorisation records.

The representative’s identity should be verified, and the institution should understand whether the person acts in a personal capacity, for an employer, under a fiduciary arrangement or for another undisclosed principal. A representative’s authority does not remove the need to identify the underlying customer or beneficial owner.

3. Beneficial Ownership and Control

Beneficial ownership is central to KYC because criminals may conceal proceeds behind companies, nominees, trusts, foundations or layered ownership chains. A beneficial owner is generally the natural person or persons who ultimately own or control a customer, or the natural person on whose behalf a transaction or relationship is conducted. The exact statutory definition must be checked in the relevant jurisdiction.

Ownership and control should be analysed separately. A person may control an entity through voting rights, the power to appoint senior management, contractual rights, veto rights, dominant influence or other arrangements without holding a majority of shares.

A practical analysis proceeds as follows:

1. Obtain a current ownership chart reaching through intermediate entities to natural persons.
2. Identify direct and indirect ownership percentages and voting rights.
3. Examine shareholder agreements, nominee arrangements, options, trusts and control rights.
4. Identify persons exercising control by other means.
5. Where no natural person can be identified through ownership or control, apply the legally prescribed senior-managing-official or equivalent fallback, documenting the analysis.
6. Verify each relevant person according to the applicable risk level.

A simplified indirect ownership calculation can be useful. If Person P owns 60% of Company A and Company A owns 70% of Company B, P’s indirect economic interest in Company B through that chain is:

This calculation assumes a straightforward ownership chain and does not by itself determine legal control. Voting agreements, multiple classes of shares, cross-holdings and other arrangements may produce control that differs from the economic percentage.

Special structures

Trusts: The institution commonly needs to identify the settlor, trustee, protector where applicable, beneficiaries or class of beneficiaries, and any person exercising ultimate control. The trust deed and amendments are important evidence.

Partnerships: Relevant persons may include general partners, limited partners with significant rights, managers and beneficial owners behind partner entities.

Foundations and charities: The institution should understand founders, council or board members, beneficiaries, governing officials, donors where relevant to risk, and the purpose and geographic reach of the organisation.

Listed companies and regulated entities: Simplified procedures may be permitted in some frameworks where ownership and control are subject to reliable public disclosure or regulatory supervision. Such treatment must never be assumed automatically; the institution must document the basis and identify relevant controllers where required.

4. Customer Purpose, Profile and Source of Funds

Identity alone does not explain whether a relationship makes sense. KYC should establish the purpose and intended nature of the relationship. Questions may cover:

• the products and services required;
• expected transaction types, frequency and value;
• expected source and destination of funds;
• operating countries and counterparties;
• financing, investment or treasury objectives;
• the customer’s business model and revenue sources; and
• the reason for using the institution, particularly where the structure is complex or cross-border.

Source of funds (SoF) means the origin of the particular funds involved in a transaction or relationship. It may be a salary, sale of an asset, business income, loan, dividend, inheritance or investment redemption. Source of wealth (SoW) concerns how the customer accumulated overall wealth, such as entrepreneurship, employment, inheritance or investments. The distinction is important: a customer may have substantial legitimate wealth but an unexplained payment may still require investigation.

Evidence should be proportionate to risk. Examples include bank statements, sale agreements, audited accounts, tax records, probate documents, loan agreements, investment statements and reliable public information. The institution should avoid treating a customer’s unsupported explanation as conclusive where independent corroboration is reasonably necessary.

5. Screening and Risk Assessment

5.1 Screening domains

KYC screening commonly covers:

• sanctions and restrictive-measures lists;
• politically exposed persons (PEPs), including relevant family members and close associates as defined by applicable law;
• adverse media and credible public information;
• internal watchlists and previous relationship records;
• regulatory, licensing and enforcement databases; and
• high-risk jurisdictions or sectors.

Screening produces potential matches, not automatic conclusions. A name match must be resolved using identifiers such as date of birth, nationality, address, registration number, occupation or ownership information. A false positive should be documented sufficiently to demonstrate why it was discounted. A potential true match must be escalated under the applicable sanctions, AML or compliance procedure.

PEP status is not evidence of criminality. It is a risk factor that may justify enhanced measures, senior approval, establishment of source of wealth and funds, and enhanced ongoing monitoring. Controls should be proportionate and should not become discriminatory or indefinite without legal basis.

5.2 Risk classification

Risk assessment should consider customer, product, geographic, channel and behavioural factors. Examples of higher-risk indicators include:

• opaque or unnecessarily complex ownership;
• unexplained use of nominees or multiple intermediaries;
• exposure to corruption-sensitive public functions;
• connections to jurisdictions with serious AML weaknesses or sanctions exposure;
• cash-intensive or highly anonymous business models;
• unusual cross-border activity;
• rapid movement of assets without an apparent economic purpose; and
• reluctance to provide information or repeated inconsistencies.

A risk classification should not be based on one indicator in isolation. A locally regulated financial institution with cross-border activity may be higher risk for one product and lower risk for another. The assessment should record both risk-increasing and risk-reducing factors, the rationale for the outcome, approval authority and required controls.

5.3 Enhanced and simplified due diligence

Enhanced due diligence (EDD) involves additional information, stronger verification, senior approval, more frequent review or closer monitoring. It is appropriate where risk is elevated and the relationship is legally permissible.

Simplified due diligence (SDD) may be available for demonstrably lower-risk situations under applicable law. It does not mean omitting mandatory identification, sanctions screening or beneficial-owner analysis. SDD should be supported by a documented risk rationale and withdrawn if circumstances change.

6. Documentation, Data Quality and Privacy

A defensible KYC file should allow an independent reviewer to understand what was known, when it was known, how it was verified, what risks were identified, who approved the relationship and what remains outstanding. Documentation should include source references, dates, reviewer identity, decisions, exceptions and escalation outcomes.

Data-minimisation principles

Privacy is not opposed to AML compliance. Good governance requires the institution to collect and process information that is necessary, relevant, accurate and proportionate to a defined purpose. Key principles include:

• define the lawful purpose before collecting information;
• collect only information necessary for identification, risk assessment and legal obligations;
• distinguish mandatory data from optional information;
• maintain accuracy and promptly correct outdated records;
• restrict access according to role and need;
• encrypt or otherwise protect sensitive information;
• record disclosures and cross-border transfers where required;
• establish retention and secure-destruction schedules; and
• avoid copying or retaining sensitive documents when a compliant alternative is sufficient.

Data minimisation does not mean retaining only a customer’s name. If an ownership chart, source-of-funds evidence or representative mandate is necessary to establish risk and legal compliance, it should be obtained and retained. The test is necessity and proportionality, not convenience.

KYC information is highly sensitive. Unauthorised disclosure can create privacy, safety and tipping-off risks. Staff should not reveal that a suspicious transaction report or equivalent regulatory disclosure has been made, except as permitted by law and policy.

7. Periodic Review and Trigger-Based Refresh

Periodic review is a scheduled reassessment of the customer file. Review frequency should reflect risk, product complexity and legal requirements. A higher-risk relationship may require annual or more frequent review, while a lower-risk relationship may be reviewed less frequently where permitted. The schedule must not replace event-driven review.

Trigger events include:

• change in ownership, control, directors or authorised signatories;
• merger, acquisition, restructuring or change in legal form;
• material change in business activity or geography;
• unusual transaction behaviour;
• new adverse media or enforcement information;
• sanctions or PEP status change;
• expired identity documents or failed address verification;
• unexplained change in source of wealth or funds;
• dormant account reactivation; and
• changes in applicable law or risk classification.

A refresh should update the customer profile, re-screen relevant parties, reassess risk, verify changed information and determine whether controls remain adequate. It should not be a mechanical request for every document again. The institution should identify what changed and collect evidence proportionate to that change.

8. Offboarding and Remediation

A customer should not be exited solely because the file is inconvenient to maintain or because a broad category has been labelled high risk. Offboarding should be based on law, documented risk, inability to complete required due diligence, prohibited activity, material misrepresentation, unacceptable conduct or a relationship that cannot be managed within risk appetite.

Before exit, the institution should consider whether remediation is possible. Remediation may include obtaining missing documents, clarifying ownership, restricting products, increasing monitoring or obtaining senior approval. If the relationship presents an immediate legal or sanctions concern, restrictions may be required without waiting for ordinary remediation.

The offboarding process should address:

1. the reason and authority for the decision;
2. legal, contractual and operational constraints;
3. treatment of pending transactions and assets;
4. suspicious-activity or regulatory reporting obligations;
5. preservation of relevant records;
6. communications that avoid tipping off; and
7. safe return or transfer of assets where legally permitted.

“De-risking” can create unintended consequences if entire sectors or communities are excluded without an individualised assessment. A proportionate, documented approach is generally stronger than indiscriminate closure.

9. Technology, Automation and Artificial Intelligence

Digital onboarding can improve speed, consistency and auditability through electronic identity verification, document authentication, biometric comparison, corporate-ownership data, workflow controls and automated screening. However, automation does not transfer accountability from the institution to a vendor or algorithm.

Important controls include:

• vendor due diligence and service-level oversight;
• testing for accuracy, bias and unequal error rates;
• human review of material exceptions;
• explainable decision rules and version control;
• protection against synthetic identities and document manipulation;
• monitoring of data quality and model drift;
• secure handling of biometric and identity data; and
• independent validation of risk-scoring models.

AI may assist with entity resolution, adverse-media classification, document extraction and prioritisation. It should not automatically reject a customer or declare a sanctions match without appropriate verification and human governance. Institutions must also consider privacy law, explainability, records of automated decision-making and the risk that training data contain inaccurate or discriminatory information.

10. Applied Case: Meridian Capital and a Complex Investment Vehicle

The following is an illustrative case, not a real customer or institution.

Background

Meridian Capital, an investment bank, receives an application from Northshore Strategic Opportunities Fund, a private investment vehicle incorporated in Jurisdiction A. The fund requests prime brokerage and securities financing services. Its investment manager is incorporated in Jurisdiction B, its administrator in Jurisdiction C, and its investors include several family offices and a charitable foundation.

The application provides a certificate of incorporation, fund documents, an ownership chart and identification documents for two directors. The chart shows that a holding company owns 55% of the investment manager. The holding company is owned by another company in Jurisdiction D. No natural person is shown at the top of the structure. The proposed activity includes leveraged trading in emerging-market securities and transfers through several correspondent banks.

Problem

The documentation establishes legal existence but does not adequately establish ultimate ownership and control. The cross-border structure, leveraged product, opaque ownership and multiple intermediaries create elevated risk. One director is also identified by screening as a possible close associate of a foreign PEP, although the match is not yet confirmed.

Analysis

Meridian separates the issues rather than treating them as one conclusion:

• The fund’s identity and regulatory status must be verified.
• The investment manager’s authority and licensing must be confirmed.
• The ownership chain must be traced through the holding companies.
• Shareholder agreements and voting rights must be reviewed for control arrangements.
• The foundation’s trustees, controllers and beneficial interests must be understood.
• The source of capital committed to the fund and expected trading flows must be established.
• The possible PEP association must be resolved using additional identifiers.
• The proposed activity must be compared with the fund’s strategy, financial statements and expected volumes.

Approach and solution

Meridian requests a current group chart, constitutional documents, shareholder agreements, trust or foundation records, audited financial statements, evidence of the investment manager’s licence, details of authorised traders and source-of-funds evidence for major investors. It verifies corporate records through official registers and obtains senior compliance approval for the elevated-risk relationship.

The PEP screening alert is resolved as a false positive after comparing date of birth and nationality. However, one indirect controller is identified as a senior public official in another jurisdiction. Meridian therefore applies EDD, establishes source of wealth and funds, increases review frequency and imposes enhanced monitoring on transfers involving higher-risk jurisdictions.

The final decision is to accept the relationship with documented conditions: no trading before all required documents are verified, restricted transaction permissions until source-of-funds evidence is complete, annual senior review and immediate refresh upon ownership or strategy change.

Outcome and learning points

The case demonstrates that legal existence is not the same as transparency. It also shows why beneficial ownership, authority, source of funds, PEP screening and product risk must be assessed together. The false-positive alert should be resolved with evidence rather than ignored, while the confirmed risk factor should lead to proportionate controls rather than automatic rejection.

Professional Governance and Quality Assurance

KYC effectiveness depends on governance as much as on forms and databases. Senior management should establish risk appetite, approve policies, allocate resources and receive meaningful reporting. The compliance function should define standards, advise on escalations and test implementation. Business teams remain responsible for obtaining accurate customer information; compliance should not become a substitute for first-line ownership.

Quality assurance should test whether files contain sufficient evidence, whether beneficial ownership was correctly analysed, whether risk ratings are supported, whether screening alerts were resolved consistently and whether overdue reviews are controlled. Internal audit should assess the design and operating effectiveness of the framework independently.

Useful management information includes onboarding turnaround time, overdue reviews, unresolved ownership cases, screening false-positive rates, EDD volumes, remediation ageing, offboarding causes and quality-assurance findings. Speed metrics should never be used alone: rapid onboarding with weak evidence is a control failure, not an efficiency gain.

Challenges and Limitations

Several structural limitations affect KYC:

• company registries may be incomplete or inaccurate;
• identity documents and digital credentials can be forged;
• beneficial ownership may be obscured through legal arrangements;
• names may produce high volumes of false screening alerts;
• adverse media may be unreliable, inaccessible or biased;
• cross-border privacy and data-transfer rules may conflict with operational expectations;
• customer information becomes outdated quickly in dynamic businesses; and
• risk models can create false precision and conceal judgement.

These limitations require layered controls, professional scepticism, escalation routes and continuous improvement. KYC is not a guarantee that all illicit activity will be detected. It is a structured control process designed to reduce uncertainty and support informed decisions.

Chapter Summary

Customer identification and KYC form a continuing lifecycle covering pre-onboarding, identification, verification, beneficial-ownership analysis, purpose and expected activity, screening, risk classification, monitoring, periodic review, trigger-based refresh, remediation and offboarding. Individuals, legal entities and representatives require different but connected evidence.

The central professional task is to understand who the customer is, who ultimately owns or controls the relationship, why the relationship exists and whether activity remains consistent with that understanding. A risk-based approach adjusts control intensity without abandoning mandatory legal requirements. EDD may be required for elevated risk, while simplified measures, where lawful, must remain documented and proportionate.

Privacy and AML obligations must be integrated. Institutions should collect necessary information, protect it, maintain accuracy, restrict access and retain it only for legally justified periods. Technology can improve efficiency but requires vendor governance, model validation, human oversight and safeguards against bias and error. Effective KYC is therefore a governance discipline involving business staff, compliance, operations, technology, senior management and audit.

Key Terms

Customer due diligence (CDD): Measures used to identify and understand a customer and assess related financial-crime risk.

Know Your Customer (KYC): The broader process of identifying, verifying and understanding customers throughout a relationship.

Enhanced due diligence (EDD): Additional controls applied where risk is elevated.

Simplified due diligence (SDD): Proportionate reduced measures permitted for demonstrably lower-risk relationships under applicable law.

Beneficial owner: The natural person who ultimately owns or controls a customer or for whom a relationship is conducted.

Control: The ability to direct decisions or management, whether through ownership, voting rights, agreements or other means.

Source of funds: The origin of particular money used in a transaction or relationship.

Source of wealth: The origin of a customer’s overall accumulated wealth.

Politically exposed person (PEP): A person entrusted with a prominent public function, together with related categories defined by applicable law.

Adverse media: Credible negative public information relevant to financial-crime or integrity risk.

Screening: Comparing customer or transaction information against risk, sanctions or regulatory databases.

False positive: An apparent match that is resolved as not relating to the customer.

Trigger event: A change or occurrence requiring KYC reassessment outside the normal review schedule.

Periodic review: A scheduled reassessment of a customer relationship.

Offboarding: Restricting or ending a customer relationship under documented legal, risk or policy grounds.

Data minimisation: Collecting and processing no more personal data than is necessary for a defined legitimate purpose.

Risk appetite: The types and levels of risk an institution is prepared to accept.

Tipping off: Improperly revealing a suspicion or regulatory report in a manner prohibited by law.

Review Questions

5 Short Answer Questions

1. Why is KYC described as a lifecycle rather than a one-time onboarding exercise?
2. Distinguish source of funds from source of wealth.
3. What is the difference between identification and verification?
4. Name four events that may trigger an out-of-cycle KYC refresh.
5. Why is a sanctions screening alert not automatically proof of a true match?

5 Long Answer Questions

1. Explain the stages of a risk-based KYC lifecycle for an investment-bank customer.
2. Describe a systematic approach to identifying beneficial ownership in a complex corporate structure.
3. Compare standard due diligence, enhanced due diligence and simplified due diligence.
4. Discuss how privacy and data-minimisation requirements should influence KYC documentation and retention.
5. Evaluate the governance requirements for using automated onboarding and AI-supported screening.

3 Analytical / Application Questions

1. A company provides a valid incorporation certificate but refuses to disclose its ultimate owners, citing commercial confidentiality. Analyse the risks, additional steps and possible decision outcomes.
2. A long-standing low-risk customer begins sending high-value payments to a new high-risk jurisdiction after a change in directors. Design a trigger-based refresh and escalation plan.
3. An electronic screening tool generates many alerts for a common name shared by a customer and several sanctioned persons. Propose a control framework that manages false positives without weakening sanctions compliance.

Multiple Choice Questions with Answers

Question 1

Which statement best describes the KYC lifecycle?

A. It ends once an identity document is collected.

B. It is a continuing process from pre-onboarding through review and possible offboarding.

C. It applies only when a suspicious transaction has occurred.

D. It is limited to sanctions screening.

Correct Answer: B. It is a continuing process from pre-onboarding through review and possible offboarding.

Question 2

Who is generally the primary focus of beneficial-ownership analysis?

A. The customer’s external auditor only

B. The natural person or persons who ultimately own or control the customer

C. Any employee who submits an account application

D. The institution’s relationship manager

Correct Answer: B. The natural person or persons who ultimately own or control the customer

Question 3

Person P owns 60% of Company A, and Company A owns 70% of Company B. What is P’s indirect economic interest through that chain, assuming no other arrangements?

A. 13%

B. 42%

C. 60%

D. 70%

Correct Answer: B. 42%

Question 4

Which item most directly establishes a person’s authority to act for a legal entity?

A. A marketing brochure

B. A board resolution or valid mandate

C. A general internet search

D. The entity’s trading history alone

Correct Answer: B. A board resolution or valid mandate

Question 5

What is the appropriate interpretation of a potential PEP match?

A. It automatically proves criminal conduct.

B. It is irrelevant once identity has been verified.

C. It is a risk factor requiring resolution and potentially enhanced controls.

D. It requires automatic account closure in every case.

Correct Answer: C. It is a risk factor requiring resolution and potentially enhanced controls.

Question 6

Which is an example of a trigger-based KYC refresh?

A. A scheduled annual review only

B. A change in beneficial ownership

C. Routine filing of an unchanged internal form

D. Deletion of all historical records

Correct Answer: B. A change in beneficial ownership

Question 7

What does data minimisation require?

A. Collecting every available item of customer information

B. Collecting only information necessary and proportionate to a defined legitimate purpose

C. Avoiding all documentation

D. Retaining personal data permanently

Correct Answer: B. Collecting only information necessary and proportionate to a defined legitimate purpose

Question 8

Which situation most strongly supports enhanced due diligence?

A. A transparent, regulated customer with stable activity

B. An opaque ownership structure combined with high-risk cross-border activity

C. A customer who provides complete and consistent information

D. A relationship with no products or transactions

Correct Answer: B. An opaque ownership structure combined with high-risk cross-border activity

Question 9

What should an institution do when a screening alert may be a false positive?

A. Ignore the alert immediately

B. Close every account with the same surname

C. Resolve it using relevant identifiers and document the conclusion

D. Treat it as a confirmed sanctions match without review

Correct Answer: C. Resolve it using relevant identifiers and document the conclusion

Question 10

Which statement about offboarding is most appropriate?

A. Every high-risk customer must be rejected automatically.

B. Offboarding should be documented, proportionate and consistent with law and risk appetite.

C. Offboarding eliminates all record-retention duties.

D. A business team may close a relationship without considering reporting obligations.

Correct Answer: B. Offboarding should be documented, proportionate and consistent with law and risk appetite.