Contents
Key points
- A KYC file is review-ready when it is complete, contradictions are resolved or flagged, every data point has a source and open points are listed.
- Each file ends as a review pack with sources, reconciled data, open points and a log of every review step, built so that a second person can follow it without asking.
- AI agents read every document in every file instead of a sample. The decision on the client relationship stays with the people who are licensed and responsible for it.
- A provider that prepares files takes no decisions on client relationships, files no reports with authorities and accesses no client data without a written mandate.
- Documentation and independent review, two points of FINMA Guidance 08/2024, are built into the review pack from the start.
When many files have to be review-ready at short notice
- Remediation
- An institution closes gaps in existing client files, for example after an internal review or when its directives have changed. Every affected file is brought up to the required standard.
- Wind-down
- A business line or a client portfolio is given up or transferred. Before client relationships move or end, every file has to be right.
- Liquidation
- A company is dissolved. Every client relationship is closed, and every decision about it has to be provable later.
All three follow the same pattern. The documents were filed over years in different systems, partly by people who have since left. Few specialists are allowed to decide. Every hour they spend searching is an hour missing from their judgement.
What review-ready means
A file is review-ready when the responsible person can decide without searching. Five features make that checkable.
- Complete
- Every document that the institution's directives require is in the file, or its absence is recorded. Typical items are the identification of the contracting party, the details of the beneficial owner, the purpose of the business relationship and, where required, the origin of the assets.
- Consistent or flagged
- Data points that contradict each other are resolved or flagged as a contradiction, with both sources. Example: the client profile gives one place of residence, while the latest correspondence goes to an address in another country.
- Every data point sourced
- Every data point in the file shows which document and which page it comes from. A data point without a source counts as open.
- Open points as a list
- Whatever is missing, expired or inconsistent is on a list, with the reason and the source. The person who decides reads this list first.
- Traceable without asking
- A second person who has never seen the file can follow every step without having to ask anyone.
These features add up to one review pack per file, in four parts.
| Part | Content | Purpose |
|---|---|---|
| Sources | Every document read, with system, storage location and date | Shows what the pack rests on and what is missing |
| Reconciled data | Every data point from the client profile next to the documents that confirm or contradict it | Makes each data point checkable on its own |
| Open points | Gaps, contradictions and expired documents, with reason and source | Serves as the work list for the person who decides |
| Log | Every review step: which document, which rule, which result, who approved it and when | Keeps the review path traceable later on |
Why read everything rather than a sample
A sample answers the question of how good a portfolio is on average. In a remediation, wind-down or liquidation, every single client relationship needs a judgement. A contradiction in a file that was not in the sample stays where it is until someone stumbles on it.
Reading everything by hand is expensive. Worked example with round assumptions: 100 files with 30 documents each and 5 minutes of reading per document come to 250 hours of reading alone, before any reconciliation or judgement. Put in your own figures. That reading is the work agents take over.
Agents read every document in every file, assign it to the right client relationship and check it against the client profile using rules written in plain language. Anything that does not fit is flagged with its source and never silently corrected. The sample gets a new job: the responsible people check every flag and, in addition, a sample of the unremarkable files, to check the agents themselves. In Guidance 08/2024, FINMA explicitly names sampling as one way to check the quality of AI outputs on an ongoing basis.
The principle behind it, fix the reference first and read every document against it second, is described in detail for dossier review on the Services page: what goes in, who approves and what is recorded.
Six steps, from mandate to log
- 01Mandate and accessThe institution issues a written mandate: which files, which systems, who has access and where the data is processed. The data processing agreement is signed before the first file is opened.
- 02Rules in plain languageThe institution's directives are translated into review rules any specialist can read: which documents a file needs, which data points must match, what counts as an open point. Before the review starts, the institution approves the rules.
- 03Bring togetherAgents collect the documents for each client relationship from the approved sources and assign every document.
- 04Reconcile and flagEvery data point is checked against the client profile and the other documents. Gaps and contradictions are flagged with their source, and each file ends as a review pack.
- 05ApprovalThe people who are licensed and responsible for it check every review pack, every flag and a sample of the unremarkable files. They approve, reject or ask for further clarification. Decisions on the client relationship are theirs alone.
- 06LogEvery step is in the replay log: which document, which rule, who approved it and when. Questions about the review path can be answered from the log.
It starts with a limited number of files and a measured result: how long a file used to take, how long it takes with a review pack, and how many flags proved justified. Only then is the rest decided. How the steps follow one another at Grow Amplified is described under Approach.
What a provider does not do
- It takes no decisions on client relationships, neither on continuing them nor on ending them.
- No report goes from the provider to an authority, including on the institution's behalf. Whether a report is needed is for the responsible people to judge.
- It takes on no activity that requires a FINMA licence or membership of a self-regulatory organisation.
- Without the institution's written mandate, it accesses no client data.
- Nothing is corrected silently. Every discrepancy stays visible until a responsible person has assessed it.
These limits apply to Grow Amplified without exception and are also set out on the Services page. Whether a specific engagement counts as outsourcing under supervisory law, and which requirements then apply, is for the institution to assess with its legal advisers.
For the data, Grow Amplified works as follows: processing in Switzerland, a data processing agreement before the first access, only the data the engagement needs, and every access logged. Confidentiality obligations are passed on contractually to everyone involved.
How this relates to FINMA Guidance 08/2024
In Guidance 08/2024, FINMA describes what it looks at when supervised institutions use AI. The seven points are explained in FINMA Guidance 08/2024 explained simply. Two of them bear directly on file review.
Documentation. FINMA observed that documentation was sometimes not detailed enough and not written for its recipients. In a review pack, the documentation is written step by step during the work: rules in plain language, a source for every data point, a log entry for every step. It is written for the person who decides and for anyone who checks later.
Independent review. FINMA did not see a clear separation between the development of an AI application and its independent review in all cases. Approval by the responsible people does not replace that review. It does make it possible: because every rule is in plain language and every step is in the log, a function that did not build the lane, such as internal audit or an audit firm, can follow the review path in full.
How work is divided between agent and person is described in The four-eyes principle with AI agents. Timon Wick, Founder and CEO of Grow Amplified, spent 15 years in banking and consulting, where among other things he simplified the onboarding of legal entities at a major bank (profile).
Frequently asked questions
When is a KYC file review-ready?
When it is complete or its gaps are recorded, contradictions are resolved or flagged, every data point has a source and open points are on a list. On top of that comes a log of every review step, so that a second person can follow the file without asking.
Does the AI decide on client relationships?
No. Agents read, assign and flag. Decisions on client relationships are taken only by the people who are licensed and responsible for them.
Does a provider preparing KYC files need a FINMA licence?
That depends on what it does. Grow Amplified takes on no activity that requires a FINMA licence or membership of a self-regulatory organisation: no decisions on client relationships, no reports to authorities, no access without a written mandate. How a specific engagement is classified is for the institution to clarify with its legal advisers.
Where is the client data processed?
At Grow Amplified, in Switzerland. Before the first access there is a written mandate and a data processing agreement, only the data the engagement needs is processed, and every access is logged.
Does the review pack replace review by specialists?
No. It takes over the searching, collecting and reconciling. The specialists check every flag and a sample of the unremarkable files, and they decide.
How does it start?
With a limited number of files and a measured result: time per file before and after, and how many flags were justified. Only then is the rest decided.
15 years in banking and consulting, in transformation and finance operations. Today he builds review lanes with Grow Amplified: agents read and reconcile, a person approves, and a replay log records who decided what.