Automating periodic KYC reviews: requirements and implementation

Periodic KYC reviews are a fixed part of every portfolio manager's AML duties. Most of the time goes into gathering master data, documents, notes and transactions, not into the assessment. This article sets out the requirements under AMLA, the structure of a review, an example of a mismatch list and the decisions that remain with a responsible person.

The law sets the duty, the firm sets the cycle

The Anti-Money Laundering Act requires financial intermediaries to verify the identity of the contracting party (Art. 3 AMLA), establish the beneficial owner (Art. 4 AMLA), clarify unusual transactions and relationships with increased risk (Art. 6 AMLA) and document all of it (Art. 7 AMLA). The law does not prescribe a fixed review cycle for every relationship. It requires client information to stay current and higher-risk relationships to be monitored more closely. The portfolio manager sets the frequency in its internal directives. In practice, annual reviews for increased-risk relationships and intervals of three to five years for the rest are common, supplemented by event-driven reviews.

Under Art. 7 para. 3 AMLA, the documents must be retained for at least ten years after the business relationship ends or the transaction is completed. A review that is not documented therefore does not exist for the audit. Portfolio management adds the suitability assessment under Art. 12 FinSA, and many firms combine both checks in one review.

Reading and comparing can be automated, assessing cannot

A review checks whether the identity documents are valid, whether the domicile and beneficial owner are unchanged, whether inflows and outflows fit the documented source of wealth, whether screening results are current and whether the investment profile still matches the mandate. Each of these points has an answer somewhere, but rarely in the same system.

In practice, event-driven reviews are triggered by a change of domicile or nationality, a new beneficial owner, an inflow that does not fit the documented source of wealth, or negative press about the client. Most of these signals already sit in the firm's systems, in an email, a meeting note or a transaction. The difficulty is not detecting them but connecting them to the right client file in time. Reading, comparing and listing can be automated. The assessment cannot.

A mismatch list asks questions; it does not answer them

Before the review, the system compares actual activity with the documented profile and lists deviations above defined thresholds. An excerpt for a fictitious client:

• ID document expired. Passport valid until 14 March 2026, no newer document on file. Source: document store.
• Inflow outside the profile. CHF 850,000 on 2 July 2026 from a company in Cyprus. Documented source of wealth: inheritance and salary. Source: PMS transaction.
• Change of domicile not recorded. Meeting note of 18 May 2026 mentions a move to Monaco, master data still shows Zurich. Source: meeting note, PMS master data.
• Investment profile and mandate diverge. Profile «conservative», equity allocation above 55% for six months. Source: PMS.

The list contains no assessment. It does not say whether the Cyprus inflow is plausible. It ensures that the question is asked and shows where the answer can be found. In our view, a useful list is short; if it regularly runs to dozens of entries per client, the thresholds need calibration.

Four decisions stay with a responsible person

Whether a deviation is plausible, whether the risk rating holds, whether a relationship needs further clarification, and whether there is a well-founded suspicion that triggers a report to the Money Laundering Reporting Office under Art. 9 AMLA: these decisions belong to a responsible person, who signs them. The risk rating must be confirmed actively, not adopted from the draft by default.

Three errors that make a review worthless

Thresholds set too low flag every transfer above CHF 10,000, and reviewers learn to ignore the flags. Thresholds should be calibrated by client segment and revisited after the first quarter. Automation also reproduces data quality at scale, so master data in the PMS should be cleaned up before the first run. Finally, a review note that says «no changes» without evidence will not satisfy an audit firm. The note needs linked sources, a named reviewer, a date and a clear decision. The use case also belongs in the AI inventory, as described in our article on FINMA Guidance 08/2024.

How it works

With Unplex, the review file is assembled automatically: master data and transactions from the PMS, documents from the file store, notes from Microsoft 365. The system produces the mismatch list and a draft review note in your template, with a source for every statement. Missing documents become tasks. The responsible person decides and signs, and the audit trail records each step.

Conclusion

Automating KYC reviews does not transfer the assessment to a system. The reviewer starts with a complete file and a list of open questions, and the decision remains with a responsible person in the firm.

Request a demo