Source of wealth remediation updates an existing KYC file so the bank can support its understanding of how a customer or beneficial owner accumulated wealth. Start with the anti-money laundering (AML) requirements that apply to the relationship today, assess the evidence already held and resolve the gaps that matter to the risk decision.
An old file is not automatically a failed file. A record that met the requirements at onboarding may need updating because the customer’s circumstances, applicable rules or the bank’s policy have changed. Equally, a long relationship does not excuse an unresolved obligation. Keep the assessment of past compliance separate from the work needed now.
This guide is for bank compliance leaders, remediation teams and relationship managers reviewing legacy know your customer (KYC) records. It focuses on scoping the existing book, reconstructing wealth histories and deciding when a file can close. For document selection, use our source of wealth evidence examples. Our investment AML due diligence guide explains the distinction between source of wealth and source of funds, with evidence examples for investment money.
Written by AgentKYZ. Sources reviewed on 1 November 2026. The workflow below is our operational recommendation, not a regulator-issued checklist. If you need capacity for an agreed review population, explore AgentKYZ’s managed source of wealth remediation service.
Which AML requirements apply to legacy files?
Identify the booking entity, jurisdiction, customer type and service before deciding which standard to apply. A bank, a fund manager and a trustee may have different obligations even when they hold copies of the same documents. Map each requirement to its legal or supervisory source, effective date, affected population and required action. Record stricter group-policy requirements separately.
Check transitional provisions and any firm-specific supervisory directions. A new rule does not necessarily require a blanket retrospective document exercise, and a future application date is not a current deadline. Conversely, existing-customer and ongoing-monitoring duties can require action without a new rule.
FATF provides the baseline, not a single global checklist
FATF Recommendation 10 calls for customer due diligence (CDD) on existing customers according to materiality and risk, at appropriate times. It also calls for ongoing due diligence on the relationship and scrutiny of transactions, including the source of funds where necessary.
FATF standards are implemented through local frameworks. They do not create one directly applicable source-of-wealth document list for every bank. The local rules and the relationship’s risks determine what the bank must do.
United Kingdom: ongoing CDD and relevant enhanced measures
For UK banks within scope, Regulation 27(8) and (9) requires risk-based CDD at appropriate times for existing customers and when relevant circumstances change. It also contains specific triggers involving legally required contacts about beneficial ownership or international tax compliance. Suspicion and doubts about identification evidence trigger CDD under Regulation 27(1).
Regulation 28(11) requires ongoing transaction scrutiny, including source of funds where necessary, and reviews that keep CDD records current. Enhanced due diligence (EDD) and enhanced monitoring apply under Regulation 33 where its triggers are met. For relevant politically exposed person (PEP) relationships, Regulation 35 expressly requires adequate measures to establish source of wealth and funds, senior-management approval and enhanced monitoring. Its lower-risk starting point for domestic PEPs affects the extent of EDD, not the existence of those obligations.
Source-of-wealth duties are not confined to PEPs. For cases within Regulation 33(1)(b)’s country trigger, paragraph (3A) expressly requires source-of-wealth and source-of-funds information. Regulation 33(6)(b)(i) also lists private banking as a risk factor the firm must consider; paragraph (7) cautions that a risk factor does not always establish high risk by itself.
Read these duties with JMLSG Part II, sector 5 on wealth management, checking the current-guidance page for revisions. Paragraph 5.10 says diligence will ordinarily be greater than in normal retail banking. Paragraph 5.16 addresses periodic and material-change reviews and says firms should consider reviewing higher-risk clients at least annually. Separately, paragraph 5.19 says appropriate senior personnel should independently review the conduct and development of higher-risk relationships at least annually. Preserve that distinction when setting the review policy; neither paragraph creates a statutory annual refresh rule for every customer.
Singapore: use the banking framework
MAS Notice 626 sets AML/CFT requirements for banks in Singapore, including CDD, risk assessment, ongoing reviews and records. Do not substitute the separate notices for capital markets intermediaries or variable capital companies.
For source-of-wealth work, the 26 July 2024 MAS circular provides guidance to financial institutions in the wealth-management sector. It addresses the risk principles for designing policies and procedures to establish customers’ wealth in a risk-proportionate and reasonable manner. Distinguish the binding Notice from this guidance, and map the bank’s review standard to both.
Hong Kong: proportionality includes using information already held
For Hong Kong authorized institutions, read the applicable AML/CFT framework with the HKMA’s private-banking circular and Smart Tips. The tips describe collection, clarification and corroboration, with reasonable measures commensurate with risk. They warn against mechanically using the same checklist for everyone, seeking decades-old records excessively or repeating CDD while disregarding information already supplied.
These examples do not replace a jurisdiction-by-jurisdiction assessment for a multinational bank. A proportionate approach in one booking centre is not permission to bypass another centre’s requirements.
Separate an update from a historical failure
Before counting “deficient files”, classify the reason for work. Use categories that preserve what the review has actually established:
- Evidence remains adequate. The file supports the relevant current requirements and risk assessment. Record why it can be reused and the next review or trigger; do not request a replacement merely because the template changed.
- Current update needed. New circumstances, an applicable requirement or a revised policy call for more information. Identify the change and effective date without assuming the earlier decision was wrong.
- Evidence or reasoning gap. A material assertion cannot be supported, or the connection between documents and the conclusion is missing. Investigate the gap and whether it reflects an earlier failure.
- Potential historical breach. Evidence suggests the bank did not meet an obligation applicable at the time, including an ongoing duty after onboarding. Escalate for a separate compliance or legal assessment and any required notification.
Preserve original narratives, approvals and dates. Add a dated remediation assessment rather than rewriting history to make the file appear complete from inception. If the earlier requirements or evidence cannot yet be established, record that uncertainty instead of declaring either compliance or breach.
Prioritise the bank’s client book by risk
Define the population before allocating cases: which entities, relationships, beneficial owners, review periods and known issues are covered? Record exclusions and their rationale. A sample can help estimate workload and calibrate reviewers, but it does not automatically resolve the rest of the population.
Prioritisation should combine the current customer risk with the seriousness of the unresolved question. An unexplained recent inflow may need faster attention than an old document that still reliably supports a historical event. Consider:
- PEP exposure, credible adverse information and relevant geographic or business risks.
- Large inconsistencies between declared wealth, known income and observed activity.
- Opaque ownership, unexplained third-party payments or changes in beneficial owners.
- Material wealth sources with weak corroboration, especially where the activity presents higher risk.
- Overdue high-risk reviews, previous unresolved exceptions and supervisory deadlines.
Urgent sanctions concerns and suspicion need their established escalation routes immediately. They should not wait behind the remediation queue. Commercial value or a relationship manager’s confidence must not displace legal restrictions or the assessment of risk.
A source-of-wealth remediation workflow
1. Agree the review standard and closure test
Have the bank approve the applicable requirements, evidence standard, risk methodology and escalation roles before production work starts. Specify what counts as sufficient corroboration, who can approve an alternative evidence approach and what prevents closure. Calibrate reviewers on a small, varied set of files before applying the standard across the book.
2. Reconstruct the existing record
Bring together the original wealth narrative, supporting records, subsequent reviews, relationship-manager notes and relevant monitoring findings. Check information held by other teams or permitted group repositories before contacting the customer again. Respect access and cross-border data-sharing restrictions.
Identify whose wealth needs assessment. A personal investment company or trust can require analysis of relevant underlying individuals and wealth contributors under the applicable framework. A group structure chart does not by itself explain who generated the wealth or how the customer became entitled to it.
3. Build a dated wealth narrative
Record the material wealth-generating events, approximate amounts, dates, countries and the customer’s role or entitlement. Connect those events to the present financial position. Distinguish realised proceeds from asset valuations and company value from personal wealth. Mark estimates and their basis rather than presenting them as verified facts.
Illustrative example: a customer attributes £30 million of personal wealth to a business sold for £40 million. The file shows a 25% holding. The headline sale price does not establish £30 million of personal proceeds. Clarify the customer’s entitlement, debt, taxes and other material wealth sources before accepting the explanation.
For source-specific documents, use the source of wealth evidence examples guide. The remediation task is to decide what the existing evidence supports and what remains unproven, rather than collecting every document on a generic list.
4. Test corroboration and plausibility separately
Corroboration connects a material claim to reliable supporting information. Plausibility asks whether the explanation makes sense given the amounts, dates, industry, ownership and wider customer profile. A credible occupation may make wealth plausible without establishing the claimed amount; a sale document may establish a transaction without showing the customer’s entitlement.
Keep evidence references beside the claims they support. Record source, date and relevant passage, along with limitations or contradictions. Check whether apparently independent articles merely repeat the customer’s own account. AI-generated summaries and inferred values need verification against the underlying material; they are not independent evidence.
5. Ask targeted questions and reassess risk
Give the relationship manager one consolidated request identifying the unresolved claim, why it matters and acceptable evidence options under the bank’s policy. Avoid sending the full onboarding pack again when only one material change needs explanation. Route possible suspicion through compliance before outreach that could create tipping-off risk.
Reassess the relationship using the new findings. Compare the wealth narrative with current source-of-funds information and activity; an adequate explanation of historical wealth does not explain every subsequent transfer. For investment subscriptions and transaction-side checks, see our UK investment AML due diligence guide.
6. Review, approve and hand back to monitoring
A reviewer should challenge unsupported conclusions, arithmetic and unresolved contradictions before the case goes to the authorised approver. Record the decision, conditions, responsible owner and next review or event trigger. Update the relevant customer and monitoring records so the new assessment does not remain isolated in a project folder.
For the broader recurring review process, use our UK KYC periodic review checklist. A completed remediation project does not replace ongoing monitoring.
When historical evidence is unavailable
Start by recording what is missing, why it is unavailable and how material it is to the conclusion. A decades-old inheritance document and a missing record of a recent high-risk sale raise different questions. Neither should be resolved by an automatic “pass” or “fail”.
The HKMA Smart Tips support using public information to corroborate key facts and warn against excessive requests for employment or bank records dating back decades. They also emphasise focusing periodic reviews on updated information. That guidance does not remove the obligation to address material doubts.
Consider reliable alternative records and information already held, assess their limitations and document why the combined evidence is sufficient or insufficient for the applicable standard. A customer declaration or relationship manager’s recollection can inform the inquiry; neither automatically resolves a material inconsistency.
If required CDD cannot be completed, apply the relevant legal consequences. In the UK, where a firm cannot apply CDD required by Regulation 28, Regulation 31 prohibits specified transactions and requires termination of an existing relationship, subject to its terms and exceptions. It also requires consideration of a suspicious activity disclosure. Do not use a project extension or internal risk acceptance to override that duty. Missing evidence alone does not prove money laundering; the bank must assess the facts and any reporting obligation.
What a closed remediation file should contain
Define closure as an evidenced decision under the approved standard. “Documents uploaded” and “customer contacted” are progress events, not closure tests. A practical handover record should contain:
- The responsible entity, review trigger and applicable requirement or policy version.
- The dated wealth narrative, with material sources, amounts and relevant individuals identified.
- An evidence index linking assertions to corroboration, with estimates and limitations visible.
- The gap log, follow-up history and explanation of how each material issue was resolved or escalated.
- The revised risk assessment and reasons for the proposed outcome.
- Reviewer and approver records, required senior-management approval, and any lawful conditions with owners and deadlines.
- The next review date or triggers and confirmation that relevant monitoring information was updated.
Keep case outcomes separate: closed with sufficient evidence, awaiting information, awaiting approval, and escalated for a relationship or reporting decision. A case with an unresolved requirement is not complete because its service-provider work package has ended. Where a lawful policy exception remains, make it visible rather than describing the file as unconditionally clear.
Quality assurance should test evidence sufficiency and reasoning across different case types, including alternative-evidence decisions and files closed without new customer contact. Track overdue material gaps, approval queues, rework and recurring causes alongside throughput. Retain records under the applicable retention and data-protection requirements, including investigation holds where relevant.
Scope your remediation with AgentKYZ
AgentKYZ’s managed KYC service supports agreed remediation populations under your bank’s approved AML policy. Agents organise documents and perform the first pass; qualified compliance reviewers check the work. The agreed handover can include indexed evidence, reviewer reasoning, a proposed risk assessment and an exception log showing what remains unresolved.
Your bank retains compliance responsibility, customer acceptance, required high-risk approvals and suspicious activity reporting decisions. Agree outsourcing oversight, permitted data access, hosting, transfer and retention arrangements before sending customer files. A file-review engagement is not a regulator’s approval or a programme-wide independent AML audit.
For a scoping discussion, bring the booking jurisdictions, approximate case count, principal wealth sources, known gaps and target dates. Ask to agree the evidence standard, deliverables, treatment of unresolved cases and price before work begins. Book a source-of-wealth remediation scoping call with those non-sensitive details; do not send identity documents or customer wealth records with the initial enquiry.