KYC analysts should drill a quiet failure: the company registry connection returns stale director lists, and business customers are onboarded without checks on their current directors. In about 90 minutes, the onboarding team practises pausing the agent to draft-only, escalating to the MLRO and compliance, rescreening affected customers, recording decisions and deciding what to report.
What does an onboarding drill rehearse?
Onboarding is where a firm decides who it will do business with. KYC analysts use agents to gather documents, pull company registry data, screen individuals against sanctions and adverse media lists, and draft a risk rating and recommendation at depth 2. Some firms let an agent approve low-risk files at depth 3 within narrow bounds.
Customer due diligence is a core expectation of the FATF Recommendations, and failures carry regulatory and reputational cost. The MLRO or head of onboarding owns the drill. A senior KYC analyst facilitates. Analysts, a compliance officer and the engineer responsible for the registry connection take part. For the format, see what an incident drill is.
The scenario
Tuesday, 14:00. During periodic review, an analyst sees that a business customer onboarded last week has a director who resigned two years ago and is missing a director appointed last month. She checks the registry directly: the agent's connection has been returning cached data for some companies since a provider change three weeks ago. In that period the agent prepared 220 business files; analysts approved 160, and the agent approved 40 low-risk files at depth 3.
The drill step by step
- Person (facilitator): reads the scenario and starts the clock.
- Person (analyst): escalates to the onboarding team lead.
- Person (team lead): pauses the agent to draft-only. Depth 3 approvals stop; every file is held. The verdicts name the firm's own limits.
- Person (team lead): escalates to the MLRO, compliance and the engineer.
- Person (engineer): fixes or bypasses the cache and confirms which companies were affected and when.
- Person (analysts): rescreen the current directors and beneficial owners of every affected customer. The agent redrafts at depth 2 on fresh data; analysts decide.
- Person (MLRO): decides on any match. Restrict or exit the relationship, consider a suspicious activity report, and keep customer contact free of tipping off.
- Person (compliance): decides on notifying the supervisor of the control failure, if the firm's rules expect it.
- Person (team lead): records decisions; the facilitator runs the debrief.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Alert | Has prepared and approved files | 2 and 3 | Spotting in review |
| Pause | Holds every file | Dropped to 2 | Tightening limits |
| Escalate | Nothing new | 2 | MLRO, compliance, engineer |
| Fix | Nothing | 2 | Engineering |
| Rescreen | Redrafts on fresh registry data | 2 | Analyst decisions |
| Matches | Nothing | 2 | MLRO decisions |
| Report | Nothing | 2 | Supervisor notification decision |
What makes this drill specific to onboarding?
The registry data arrived as signed: a verified issuer stands behind it. Analysts reasonably trusted it. But signed data can be stale, and a cache between the registry and the agent is invisible to the analyst. The debrief should add a freshness requirement: the agent holds any file whose registry data is older than a set period.
It also tests a judgement only onboarding faces. Some of the 200 affected customers are already transacting. Rescreening must be fast, and restrictions on any match must be applied without alerting the customer.
What happens to the agent's certificate after the drill?
The agent approved 40 files at depth 3 on stale data. Its bounds allowed that, because nothing in them tested how old the registry data was. Once the freshness bound is added, the onboarding lead should ask whether the depth 3 capability still rests on good evidence. A sensible step is to run Attest again with cases that include stale and conflicting registry data, so the agent shows it now holds those files. Depth is earned, not configured: if the new run does not clear every gate, the capability stays at depth 2 until it does.
The drill should also credit how the problem was found. Periodic review caught it, not the agent. Analysts should leave the drill knowing that their review of older files is part of incident detection, not a box-ticking exercise.
Which controls does the drill test, and what evidence do they leave?
The pause. Evidence: the limit change in the record.
Rescreening. Evidence: each file with the fresh data version, the analyst's decision and time.
MLRO decisions. Evidence: each decision on a match with reasons.
Freshness bound. Evidence: the new rule and who added it.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What should the head of onboarding measure?
- Time from the analyst's finding to the pause.
- Time to rescreen every affected customer.
- Matches found, and time to restrict each one.
- Whether the freshness bound was in place before depth 3 returned.
Where do onboarding drills go wrong?
Rescreening only agent approvals. Analysts approved four times as many files on the same stale data.
Contacting customers too early. A request for updated director details can be fine; one that hints at suspicion is not.
Fixing the cache without a freshness rule. The next provider change will bring the same risk.
Neighbouring drills cover adjacent angles: the IT team drill covers connection failures, and the credit team drill covers wrong data in decisions about people. New analysts can learn the steps through the reviewer onboarding checklist for an onboarding team. The full approach is in training teams for AI agents.
Questions people ask
Should an agent approve business onboarding files?
Some firms allow depth 3 for low-risk files within narrow bounds. The drill shows those bounds need a data freshness check as well as a risk threshold.
Do we need to re-onboard every affected customer?
Rescreen every affected customer. Full re-onboarding is needed only where rescreening reveals a material change.
How often should onboarding teams drill?
Twice a year, and after any change to data providers, screening lists or the agent's depth.