Customer Onboarding, KYC and Account Lifecycle

Introduction

A bank’s relationship with a customer begins before an account is opened and continues until the relationship is properly closed. Customer onboarding is therefore not merely an administrative exercise. It is a controlled process through which the bank identifies the customer, understands the purpose of the relationship, assesses risk, obtains appropriate approvals, establishes operating instructions and creates a reliable record for future monitoring.

Know Your Customer (KYC) controls are central to this process. They help banks prevent money laundering, terrorist financing, fraud, sanctions breaches, identity theft and misuse of financial services. At the same time, onboarding must be efficient, fair and accessible. Excessive delay can damage customer experience, while weak controls expose the bank to legal, financial and reputational harm.

This chapter presents the customer account lifecycle: identification and verification, customer due diligence, risk classification, beneficial-owner verification, sanctions screening, account opening, mandate maintenance, dormancy management and account closure. Specific legal requirements vary by country, so practitioners must always apply the relevant banking law, AML/CFT legislation, central-bank regulations, sanctions rules and institutional policies.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the purpose and stages of customer onboarding.
2. Distinguish identification, verification, due diligence and enhanced due diligence.
3. Classify customers according to risk and apply proportionate controls.
4. Identify and verify beneficial owners and persons acting on behalf of customers.
5. Describe sanctions screening and escalation procedures.
6. Complete the essential components of an account-opening process.
7. Maintain mandates, signing authorities and customer records accurately.
8. Manage inactive or dormant accounts safely.
9. Close accounts in a controlled manner while preserving records and preventing abuse.
10. Apply ethical, data-protection and governance principles to customer servicing.

1. The Customer Account Lifecycle

The account lifecycle is the sequence of events through which a customer relationship is created, operated, reviewed and ended. A typical lifecycle contains the following stages:

1. Pre-onboarding enquiry: The customer seeks information about products, eligibility, fees and documentation.
2. Application and identification: The bank collects customer information and identity documents.
3. Verification and due diligence: The bank confirms identity, understands the customer’s activities and assesses risk.
4. Approval and account opening: The relationship is approved, account parameters are established and access is provided.
5. Ongoing monitoring and maintenance: Transactions, customer information, mandates and risk indicators are reviewed.
6. Dormancy or inactivity management: Accounts with prolonged inactivity are controlled and periodically reviewed.
7. Closure or exit: The relationship is terminated following appropriate checks, settlement and record retention.

The lifecycle is not strictly linear. A change in ownership, address, business activity, authorised signatory or risk profile may return the relationship to a review or approval stage. KYC is consequently a continuing obligation rather than a one-time form-filling activity.

2. Important Terminology

Customer: A person or legal entity that has applied for, opened or uses a banking relationship.

Customer identification: Collection of information that establishes who the customer claims to be.

Identity verification: Confirmation, using reliable and independent sources, that the identity information is genuine and belongs to the customer.

Customer due diligence (CDD): Measures used to identify and verify the customer, understand the purpose and intended nature of the relationship, and conduct ongoing monitoring where required.

Enhanced due diligence (EDD): Additional measures applied where risk is higher, such as obtaining source-of-wealth information, senior approval or more frequent review.

Simplified due diligence: Reduced measures permitted by applicable law for demonstrably lower-risk situations. It must never be applied where suspicion exists or where law prohibits it.

Beneficial owner: The natural person who ultimately owns or controls a customer, or on whose behalf a transaction or relationship is conducted.

Politically exposed person (PEP): A person entrusted with a prominent public function, together with relevant family members and close associates as defined by applicable law.

Sanctions screening: Comparing customer and transaction information with applicable sanctions, terrorism and restricted-party lists.

Mandate: The authority given to a person to operate an account or perform specified actions for the customer.

Dormant account: An account classified as inactive for the period and under the conditions specified by law or bank policy.

3. Customer Identification and Verification

3.1 Identification information

The information collected depends on the customer type and jurisdiction. For an individual, it commonly includes:

• Full legal name and any former or commonly used names
• Date and place of birth
• Nationality and residential address
• Government-issued identification number
• Telephone number and email address
• Occupation, employer or business activity
• Tax-residency information where applicable
• Purpose of the account and expected transaction activity
• Source of funds and, where relevant, source of wealth

For a company or other legal entity, the bank commonly obtains:

• Legal name, registration number and registered office
• Nature of business and principal place of operation
• Constitutional documents and registration evidence
• Ownership and control structure
• Names of directors, partners, trustees or equivalent officials
• Beneficial-owner information
• Expected account activity and source of funds
• Tax and regulatory information where required

The bank should collect only information that is relevant, lawful and proportionate. It should explain why sensitive information is requested and protect it from unauthorised access.

3.2 Verification standards

Verification should use reliable, independent and current sources. Examples include government identity documents, company registries, regulated credit databases, trusted electronic identity systems and authoritative address evidence. A document should be checked for validity, consistency, alteration and correspondence with the applicant. Electronic verification does not remove the need for judgement; a system match may be false, incomplete or based on outdated data.

A useful control principle is four-eye review: one employee collects or enters information and another employee, supervisor or automated control reviews critical details. This is particularly important for high-risk customers, exceptions and manual overrides.

The bank should not confuse possession of an identity document with proof of identity. A document may be genuine but stolen, used by an impostor or inconsistent with other information. Verification therefore involves comparison among identity evidence, customer statements, independent data and expected account use.

3.3 Customers who cannot be treated as ordinary individuals

Special care is required for:

• Minors and persons lacking legal capacity
• Joint-account holders
• Sole traders and partnerships
• Companies and other legal persons
• Trusts and foundations
• Government bodies and public institutions
• Non-profit organisations
• Correspondent or intermediary relationships
• Customers represented by agents, attorneys or guardians

For a representative, the bank must verify both the customer and the representative, confirm the representative’s legal authority and determine the scope and expiry of that authority. A power of attorney, court order or corporate resolution should be examined according to applicable law and bank policy.

4. Customer Due Diligence and Risk-Based Approach

The risk-based approach allocates greater controls to relationships presenting greater risk. It does not mean that high-risk customers must automatically be rejected, nor that low-risk customers can be ignored. It means that controls, monitoring intensity and review frequency should be proportionate to identified risk and supported by documented reasoning.

A bank may assess risk across several dimensions:

Some institutions use a scoring model. A simple illustrative model may be expressed as:

Here, R is the overall risk score; C, G, P, D and T are customer, geographic, product, delivery-channel and transaction-risk scores; and w_C, w_G, w_P, w_D and w_T are assigned weights. The weights should be non-negative and normally sum to 1 if the score is intended to remain on the same scale as its component scores. This is an illustrative decision-support model, not a universal regulatory formula. Professional judgement, legal requirements and documented overrides remain necessary.

Risk classification should be supported by evidence rather than stereotypes. Nationality, occupation or location may be relevant risk factors, but they should not be used mechanically or discriminatorily. A customer’s risk category may change when new information appears, transactions differ materially from expectations or ownership changes.

4.1 Standard due diligence

Standard CDD generally involves:

1. Identifying and verifying the customer.
2. Identifying persons acting on behalf of the customer.
3. Identifying and taking reasonable measures to verify beneficial owners.
4. Understanding the purpose and intended nature of the relationship.
5. Establishing expected activity, products and transaction channels.
6. Conducting ongoing monitoring and maintaining current records.

4.2 Enhanced due diligence

EDD may be required for PEPs, complex ownership, high-risk jurisdictions, unusually large or complicated transactions, non-face-to-face relationships with additional risk, adverse media or unexplained source of funds. Measures may include:

• Senior management approval
• Detailed source-of-wealth and source-of-funds evidence
• Independent verification of business activity
• More frequent transaction and KYC reviews
• Lower transaction thresholds or restricted products
• Greater use of documentary evidence
• A documented rationale for continuing the relationship

EDD is not a punishment. It is a control response to uncertainty or exposure. Staff must protect customer dignity and confidentiality while obtaining necessary information.

5. Beneficial-Owner Verification

Legal ownership and beneficial ownership are not always the same. A company may be registered in the name of one entity but ultimately controlled by a natural person through shares, voting rights, agreements or other arrangements. The bank must look through the ownership chain to the natural persons who ultimately own or control the customer.

A practical sequence is:

1. Obtain the ownership chart and constitutional documents.
2. Identify direct shareholders, partners or equivalent owners.
3. Trace each legal entity in the chain to natural persons.
4. Assess ownership percentages, voting rights and control arrangements.
5. Identify persons exercising control by other means.
6. If no individual can be identified after reasonable measures, apply the jurisdiction’s prescribed senior-managing-official rule and document the steps taken.
7. Verify the relevant persons using reliable, independent sources.

Beneficial ownership thresholds differ by law and are not always the sole test. A person may control an entity without exceeding a specified percentage through shareholder agreements, veto rights, appointment rights or dominant influence. Nominee shareholders and directors should therefore be examined carefully.

For trusts, the bank normally identifies the settlor, trustee, protector where applicable, beneficiaries or class of beneficiaries, and any person exercising ultimate control. For foundations and similar structures, the equivalent controlling and benefiting persons must be determined under local law.

6. Sanctions Screening and Adverse Information

Sanctions screening is the process of comparing customer, beneficial-owner, representative, beneficiary and relevant transaction information with official sanctions and restricted-party lists. Lists may relate to terrorism, proliferation financing, asset freezes, arms restrictions or country and sector restrictions.

Screening should occur:

• Before account opening
• When a customer or beneficial owner is added or changed
• During periodic rescreening
• When sanctions lists are updated
• Before or during relevant transactions
• When unusual information or a possible match emerges

A possible match is not automatically a confirmed match. Names may be common, transliterated differently or incomplete. The institution should compare identifiers such as date of birth, nationality, address, registration number and ownership information. Staff must not dismiss a match merely because the name is unfamiliar, nor confirm it without sufficient evidence.

A sensible escalation sequence is:

1. Pause or control the relevant activity where required by law and policy.
2. Record the alert and preserve evidence.
3. Compare available identifiers and investigate false-positive indicators.
4. Escalate potential true matches to the sanctions or compliance function.
5. Obtain legal or senior compliance advice where necessary.
6. Freeze, reject, block, report or permit the activity only as authorised by applicable law.
7. Document the decision and notify the customer only where legally permitted.

Adverse media is not proof of wrongdoing. It is an indicator requiring assessment of source reliability, recency, relevance and connection to the customer. Confidentiality and protection against defamation are important.

7. Account Opening and Customer Acceptance

Once due diligence is complete, the bank determines whether to accept the relationship, accept it with conditions, defer it pending information or decline it. The decision should be based on law, risk appetite, evidence and fair treatment—not on informal preferences.

An account-opening file normally contains:

• Completed application and customer declarations
• Identity and verification evidence
• Beneficial-owner and representative information
• Risk classification and approval record
• Sanctions-screening results and disposition of alerts
• Purpose, expected activity and source-of-funds information
• Product terms, fees and disclosures
• Tax, privacy and consent information where relevant
• Mandate and signing instructions
• Evidence of account activation and delivery of access credentials

The maker-checker principle reduces errors and fraud. The employee entering or preparing the account should not be the only person approving it. System controls should prevent activation where mandatory fields, approvals or screening steps are incomplete.

Customer communication must be clear. Customers should understand minimum balances, fees, interest, transaction limits, complaint channels, data use, security responsibilities and the consequences of inactivity. A bank should not hide essential terms in complicated language.

8. Mandates, Authorities and Account Maintenance

A mandate defines who may operate an account and what each person may do. Common arrangements include:

• Single signing authority
• Joint authority requiring two or more signatures
• Several authority allowing any one of specified persons
• Limited authority for particular transactions
• Temporary authority with an expiry date
• Attorney, guardian or agent authority
• Corporate authority based on a board resolution

The bank must encode the mandate accurately in its systems. A mandate should specify transaction limits, permitted channels, approval requirements and expiry conditions where applicable. Staff should never rely solely on informal instructions or a customer’s verbal claim that authority has changed.

Mandate changes require appropriate authentication and documentation. For companies, the bank may need updated registry information, a board resolution, constitutional documents and identification of new signatories. For individuals, the bank may require a new mandate, identity verification and confirmation from the account holder. A deceased customer, insolvency event, court order or incapacity may suspend or alter authority according to law.

The bank should periodically review:

• Expired identification documents
• Dormant or inactive mandates
• Changes in ownership or directors
• Unusual use by an authorised person
• Conflicts between account records and external registry data
• Revoked powers of attorney
• Changes in customer address, tax status or contact details

A common operational risk is an “orphaned” mandate: a person remains authorised in the system after leaving a business or after the authority has expired. Strong diary controls, expiry alerts and reconciliation with customer records reduce this risk.

9. Ongoing Monitoring and Periodic Review

KYC information must remain accurate and useful. Ongoing monitoring compares actual activity with the customer’s expected profile. The review may be automated, manual or hybrid. Indicators include rapid in-and-out movement, unexplained cash deposits, transactions inconsistent with occupation or business, unusual third-party payments, activity involving high-risk jurisdictions and sudden changes in volume.

A transaction alert is not equivalent to a suspicious-transaction finding. It is a prompt for investigation. The investigator should understand the customer’s profile, obtain an explanation and supporting documents where appropriate, document the reasoning and escalate if suspicion remains.

Periodic review frequency should reflect risk. High-risk relationships generally require more frequent review than low-risk relationships, but event-driven reviews are equally important. Trigger events include:

• Change of beneficial owner
• Significant change in business activity
• New adverse information
• Sanctions-list update
• Unusual transaction pattern
• Change in legal status
• Long period of inactivity followed by substantial activity

Confidentiality is essential. Employees must not disclose the existence of a suspicious-transaction report or internal investigation where “tipping off” is prohibited.

10. Dormancy and Inactive Accounts

An account becomes inactive when it has no customer-initiated activity for a defined period. The exact period and legal treatment vary by jurisdiction and product. Bank-generated interest, fees or system entries may not count as customer activity under applicable rules.

Dormancy management should include:

1. Defining inactivity periods clearly.
2. Sending notices through approved channels before classification where required.
3. Reviewing restrictions, balances, liens, legal orders and pending items.
4. Applying appropriate system status codes.
5. Preventing unauthorised withdrawals while preserving lawful customer access.
6. Continuing sanctions, fraud and legal controls.
7. Requiring verified customer contact and identity confirmation for reactivation.
8. Transferring unclaimed balances to the authority or account prescribed by law.
9. Maintaining records and audit trails.

Dormant accounts are vulnerable to fraud because customers may not notice unauthorised activity. Reactivation must not be based solely on a telephone request or an unverified email. The bank should confirm identity, update KYC information, examine the reason for reactivation and review unusual transactions.

Dormancy is not the same as closure. The customer may retain legal rights to the balance, and the bank must follow statutory procedures before transferring or extinguishing any claim.

11. Account Closure and Exit Management

Account closure may be initiated by the customer, the bank, a court, a regulator or an event such as death, insolvency or dissolution. Closure should be controlled because it can be used to conceal funds, destroy evidence or avoid monitoring.

A standard closure process includes:

1. Authenticate the closure request.
2. Confirm the authority of the requester.
3. Review pending transactions, cheques, cards, standing orders and direct debits.
4. Identify liens, holds, legal orders, complaints and unresolved investigations.
5. Complete required sanctions, AML and fraud checks.
6. Settle fees, interest, overdrafts and other liabilities.
7. Return or destroy instruments according to policy.
8. Transfer the remaining balance through an approved method.
9. Disable digital access, cards and payment instructions.
10. Mark the account closed in all relevant systems.
11. Retain records for the legally required period.

The bank may need to delay or restrict closure where law requires preservation of assets, reporting or cooperation with authorities. It should explain permissible reasons to the customer without disclosing confidential investigations.

A closure must be complete across the relationship. Closing a current account while leaving a linked card, overdraft, standing order or digital wallet active creates operational and security risk. Reconciliation between core banking, card, payments, customer relationship and document systems is therefore important.

12. Applied Case: The Complex Small Business Account

This is an illustrative case.

Background

Riverstone Trading Ltd applies for a business current account. It imports household goods and expects monthly turnover equivalent to 300,000 currency units. The company is registered locally, but its shares are held by another company registered abroad. The local director is also the proposed signatory. The applicant requests internet banking and international transfers.

Problem

The application appears complete, but the ownership chart stops at the foreign holding company. The proposed activity is partly cash-based and the company expects payments to several countries. A sanctions-screening alert produces a similar name to a person associated with the foreign entity.

Analysis

The relationship presents several risk factors: layered ownership, cross-border transfers, cash activity, remote foreign connections and a possible sanctions match. These factors do not automatically require rejection, but they require additional investigation.

The bank requests certified corporate documents for both entities, traces the ownership chain to natural persons, verifies the director and signatory, obtains the business purpose and supplier information, and requests evidence supporting expected turnover and source of funds. It checks the foreign entity and relevant individuals against sanctions and adverse-information sources. The similar-name alert is compared using date of birth, nationality, address and corporate identifiers.

Approach and solution

The bank’s compliance function determines that the alert is a false positive because the identifiers do not match. However, one natural person ultimately controls the foreign holding company and was not named in the original application. The bank verifies that person, obtains senior approval for the higher-risk relationship and applies EDD. International transfers are permitted, but the account is subject to enhanced monitoring and a twelve-month review cycle. The mandate is configured so that two authorised persons must approve transfers above a specified internal threshold.

Outcome

The account is opened after all required information and approvals are complete. Later, transaction monitoring identifies payments materially exceeding the expected profile. The bank requests updated invoices and shipping evidence. The customer provides satisfactory documents, and the profile is updated. The review demonstrates that onboarding is not a substitute for ongoing monitoring.

Learning points

• Ownership must be traced beyond the first legal entity.
• A sanctions alert requires investigation, not automatic acceptance or rejection.
• Risk classification should influence approval, monitoring and review frequency.
• Mandates must reflect actual governance and be encoded accurately.
• Expected activity is a monitoring benchmark, not a permanent guarantee of behaviour.

13. Technology, Digital Onboarding and Artificial Intelligence

Digital onboarding can improve access and reduce manual errors through electronic identity verification, biometric comparison, optical character recognition, registry connectivity, sanctions screening and workflow controls. However, technology introduces risks including identity spoofing, deepfakes, data breaches, model error, poor-quality data and exclusion of customers who lack digital access.

Artificial intelligence may assist with document extraction, name matching, anomaly detection and prioritisation of alerts. It should not be treated as an unquestionable decision-maker. Banks need human oversight, explainable escalation criteria, testing for bias, access controls, model validation and a process for correcting inaccurate data. Automated decisions should be reviewable and subject to applicable privacy, consumer-protection and financial-crime requirements.

A strong digital control environment includes secure authentication, encryption, device and session monitoring, audit logs, segregation of duties, exception reporting and tested business continuity. Convenience must not replace verification.

14. Ethical, Regulatory and Governance Considerations

KYC involves sensitive personal and commercial information. Banks must balance financial-crime prevention with privacy, proportionality, non-discrimination, accessibility and customer rights. Important governance principles include:

• Accountability: Responsibilities for collection, approval, monitoring and escalation are clear.
• Proportionality: Controls correspond to risk and legal requirements.
• Confidentiality: Customer and investigation information is disclosed only to authorised persons.
• Data quality: Records are accurate, current and traceable to sources.
• Record retention: Records are retained for the legally required period and securely disposed of afterward.
• Auditability: Decisions, overrides and approvals can be reconstructed.
• Training: Employees understand both procedures and the reasons behind them.
• Speak-up culture: Staff can report concerns without retaliation.

Weak KYC may cause regulatory penalties, asset losses, correspondent-banking restrictions and reputational damage. Overly rigid KYC may cause unjustified exclusion, especially for migrants, small businesses, elderly customers and people with limited documentation. Good banking practice seeks controlled inclusion rather than either careless access or arbitrary denial.

Best-Practice Checklist

Before opening an account, confirm that:

• The customer’s identity has been verified independently.
• Representatives and beneficial owners have been identified and verified.
• The purpose and expected activity are documented.
• Risk classification is supported by evidence.
• Sanctions screening alerts have been resolved appropriately.
• Required approvals and EDD measures are complete.
• The mandate is legally valid and accurately recorded.
• Terms, fees and security responsibilities have been communicated.
• Records are complete, secure and retrievable.

For an existing account, confirm that:

• KYC information remains current.
• Mandates and signatories are valid.
• Monitoring is consistent with the risk category.
• Dormancy controls and reactivation procedures are followed.
• Closure is reconciled across all linked products and systems.

Chapter Summary

Customer onboarding establishes the foundation of a safe and effective banking relationship. It requires more than collecting documents: the bank must understand who the customer is, who ultimately owns or controls the relationship, why the account is needed and what activity should reasonably be expected.

CDD combines identification, verification, purpose assessment, beneficial-owner analysis and ongoing monitoring. A risk-based approach applies stronger controls where customer, geographic, product, delivery-channel or transaction risk is higher. EDD may involve senior approval, source-of-wealth evidence and more frequent review. Sanctions screening requires careful investigation of possible matches and lawful escalation.

The account lifecycle continues after opening. Mandates must be accurate and current; customer information must be reviewed; dormant accounts must be protected and reactivated only after proper verification; and account closure must settle obligations, disable access, preserve records and comply with legal restrictions. Technology can improve effectiveness, but automated tools require governance, human oversight and data protection. The central professional responsibility is to protect the integrity of the financial system while treating customers fairly and respectfully.

Key Terms

Customer onboarding: The process of establishing and approving a new customer relationship.

KYC: Know Your Customer controls used to identify and understand customers.

Customer identification: Collection of information about the claimed identity of a customer.

Identity verification: Confirmation that identity information is genuine and belongs to the customer.

Customer due diligence: Measures for identification, verification, purpose assessment and monitoring.

Enhanced due diligence: Additional controls for higher-risk relationships.

Simplified due diligence: Reduced lawful controls for qualifying lower-risk situations.

Beneficial owner: The natural person who ultimately owns or controls a customer or transaction.

PEP: A person entrusted with a prominent public function, as defined by applicable law.

Sanctions screening: Comparison with official restricted-party and sanctions lists.

Adverse media: Negative public information that may require risk assessment.

Risk-based approach: Allocation of controls in proportion to identified risk.

Mandate: Authority granted to operate an account or perform specified actions.

Authorised signatory: A person permitted to act under an account mandate.

Ongoing monitoring: Continuing review of customer information and activity.

Dormant account: An account inactive for the legally or contractually defined period.

Reactivation: Restoration of permitted operation after an account becomes inactive or dormant.

Account closure: Controlled termination of a banking relationship.

Maker-checker control: Separation between preparation and independent review or approval.

Tipping off: Improperly informing a person about a suspicious-activity investigation or report.

Review Questions

Short Answer Questions

1. Why is KYC considered a continuing obligation rather than a one-time activity?
2. Distinguish customer identification from identity verification.
3. What is the purpose of identifying a beneficial owner?
4. State two circumstances in which enhanced due diligence may be required.
5. Why must dormant-account reactivation involve identity verification?

Long Answer Questions

1. Explain the main stages of the customer account lifecycle and the controls required at each stage.
2. Discuss how a bank should apply a risk-based approach to customer due diligence.
3. Describe the process of identifying and verifying beneficial owners of a company with layered ownership.
4. Explain the purpose, operation and escalation of sanctions screening.
5. Discuss the operational, legal and ethical requirements for account closure.

Analytical / Application Questions

1. A company provides registration documents but refuses to disclose the natural persons who ultimately control it. Analyse the risks and recommend an appropriate bank response.
2. A dormant account is suddenly reactivated and receives several international transfers inconsistent with the old customer profile. Identify the controls and escalation steps that should follow.
3. A sanctions-screening system produces a possible match based only on a similar name. Explain how the bank should distinguish a false positive from a true match and document its decision.

Multiple Choice Questions with Answers

Question 1

Which statement best describes customer due diligence?

A. It is limited to collecting a customer’s signature.

B. It includes identification, verification, understanding the relationship and appropriate monitoring.

C. It is performed only after an account is closed.

D. It applies only to corporate customers.

Correct Answer: B. It includes identification, verification, understanding the relationship and appropriate monitoring.

Question 2

Who is normally the beneficial owner of a legal entity?

A. The employee who submits the account application

B. The bank officer who approves the account

C. The natural person who ultimately owns or controls the entity

D. Any person who deposits money into the account

Correct Answer: C. The natural person who ultimately owns or controls the entity

Question 3

Which situation most clearly supports enhanced due diligence?

A. A routine low-value salary account with consistent activity

B. A customer with complex ownership and cross-border transactions

C. A customer requesting a printed statement

D. A customer changing a telephone number after verification

Correct Answer: B. A customer with complex ownership and cross-border transactions

Question 4

What is the correct response to a possible sanctions-screening match?

A. Ignore it if the customer’s name is common

B. Automatically accuse the customer of a sanctions violation

C. Compare additional identifiers and escalate according to policy

D. Delete the alert to prevent inconvenience

Correct Answer: C. Compare additional identifiers and escalate according to policy

Question 5

What is the main purpose of a mandate?

A. To define who may operate an account and within what authority

B. To calculate interest on a deposit

C. To replace beneficial-owner verification

D. To determine the bank’s tax rate

Correct Answer: A. To define who may operate an account and within what authority

Question 6

Which principle means that stronger controls should be applied where risk is higher?

A. First-in, first-out principle

B. Risk-based approach

C. Dormancy principle

D. Equal-signature principle

Correct Answer: B. Risk-based approach

Question 7

Which statement about a dormant account is correct?

A. Dormancy always means the balance belongs to the bank.

B. Dormant accounts require no further controls.

C. Dormancy is distinct from closure and reactivation requires proper verification.

D. A dormant account may be reactivated solely through an unverified email.

Correct Answer: C. Dormancy is distinct from closure and reactivation requires proper verification.

Question 8

Why is a maker-checker control useful during account opening?

A. It eliminates the need for customer identification.

B. It separates preparation from independent review or approval.

C. It guarantees that no customer will ever commit fraud.

D. It permits staff to bypass mandatory fields.

Correct Answer: B. It separates preparation from independent review or approval.

Question 9

Which action is appropriate before closing an account?

A. Ignore pending payments because closure ends all obligations.

B. Disable only the customer’s debit card.

C. Review pending transactions, liabilities, holds and linked services.

D. Destroy all records immediately.

Correct Answer: C. Review pending transactions, liabilities, holds and linked services.

Question 10

Why should AI-based KYC tools remain subject to human oversight?

A. Automated tools can never process any customer information.

B. Models may produce errors, biased outcomes or false matches.

C. Human oversight makes sanctions screening unnecessary.

D. AI tools are legally required to approve every account.

Correct Answer: B. Models may produce errors, biased outcomes or false matches.