Know the risk you actually hold with KYC remediation
Existing customers were checked against the requirements of the day they joined. KYC remediation brings those files up to today's standard, and shows what has changed since.
Why KYC remediation is on your desk now
Nobody reviews a customer base for the pleasure of it. It follows something: a supervisory finding, a portfolio you inherited, a risk model you changed, or a rule that moved.
The rule moving next is AMLR, which enters into force on 10 July 2027 and replaces the current directive-based approach with one directly applicable European rulebook. Among other changes, it expands the data set required for each beneficial owner: all first names and surnames, all nationalities, national identification numbers, identity document references, residential address, date of birth, and the ownership percentages down the chain. Files verified against today's requirements will not all carry that set.
Whatever the trigger, the work is the same shape: a defined population, a standard to bring it to, and evidence that you did.
One flow across the whole population
KYC remediation fails on the joins. Data lives in one system, documents in a mailbox, screening results in a PDF, and the progress report in a spreadsheet somebody rebuilds every Friday. Harmoney runs all of it as one flow, on one record per customer. Six components make up that flow.
Population and gap analysis
Existing data is imported, normalised and de-duplicated, and every file is scored against your standard, so you know the size of the problem before the programme starts.
Data enrichment
Files are completed from business registries, UBO registers and credit data across 35+ native integrations, including GraydonCreditsafe, Bureau van Dijk and Dun & Bradstreet, before you ask the customer anything. Providers swap by configuration, not re-integration.
Customer outreach
What cannot be enriched is requested through the channel that fits the customer and the relationship manager who owns them. Structured requests, not a free-text email chain.
Identity and document checks
Identity verification routes to your existing provider or one of ours, with the result and its evidence on the file. Document validity, expiry and consistency are checked on intake.
Screening and risk scoring
Sanctions, PEP and adverse-media screening on every file, each carrying a risk score with a full breakdown of the factors behind it.
Case handling and evidence
Escalation, four-eyes validation and enhanced due diligence where the score calls for it. Every action, rule and decision timestamped in the audit trail.
How a KYC remediation programme runs
Five steps, in the order they actually happen. The first one is the one most programmes skip and then regret.
Step 1: assess and plan
Your current files are analysed against your standard, the gaps are quantified per segment, and the KYC remediation strategy is designed around what the data actually shows: which populations need what, in what order, through which channel.
Step 2: migrate and configure
Customer data is imported and structured. Workflows are configured for individuals and for companies, with their own screening, due diligence and document requirements. Configuration, not custom code, which is why this takes weeks rather than quarters.
Step 3: enrich and verify
External sources first, the customer only for what is left. That order is what keeps outreach volume down and completion rates up, and every response lands on the file rather than in an inbox.
Step 4: monitor and report
Live dashboards on coverage, completion and risk distribution, so you can answer where the programme stands without anyone rebuilding a spreadsheet. Compliance, relationship managers and customers work the same record, each seeing their own part of it.
Step 5: move to continuous compliance
Once the files meet the standard, the same configuration keeps them there: periodic review cycles, continuous screening and automatic rescoring when your risk model changes. For customers who will not comply, the file holds the documented decision and the evidence an exit has to rest on.
What the platform does at scale
At Ayvens, KYC decisions moved from hours to minutes and released significant team capacity.
"We chose Harmoney because of their focus, availability and efficiency. They told us that they could solve our problem within three months, and we were surprised to see they could meet the deadline."
Three roles, clearly separated
A KYC remediation programme needs analysts as well as software, and institutions split that work differently.
The programme ends. The configuration stays.
Most KYC remediation is bought as a project and then quietly repeats, because a customer base brought up to standard drifts out of it again within a year or two.
What was built during the programme, the risk model, the workflows, the outreach templates, the integrations, is configuration you keep. When the campaign closes, the same environment runs periodic reviews and continuous screening on the same population, and the next regulatory change is a configuration change rather than another campaign.
If you leave, the data leaves with you. Exports are in standard formats, JSON, CSV, XML and PDF, with no proprietary format creating lock-in.
Tell us the population, the standard you need to reach and the deadline. We will come back with what can be enriched, what has to be requested, and how long it runs.
Frequently asked questions
How long does a KYC remediation programme take to start?
Weeks rather than quarters. Across Harmoney implementations, the median from requirements sign-off to UAT is 27 business days, and typical total duration is 7 to 17 weeks excluding custom integration work. KYC remediation builds on existing modules, so the work is configuring your standard and your workflow rather than building a platform.
How many customers can be remediated at once?
Population size is a volume question, not a technical limit. Across the client base the platform screens 100 million companies and persons a year. Scoping starts from the population, the standard you need to reach and the deadline.
What happens to customers who never respond?
Digital outreach typically lifts completion rates well above paper-based campaigns, though the final rate depends on segment, product mix and outreach cadence. Non-responders are escalated on your rules, through the relationship manager where there is one, and the file records every attempt. If the outcome is an exit, the documented decision and the evidence behind it are already on the file.
Who is accountable to the regulator?
You are. Regulatory accountability for AML and KYC obligations stays with the regulated institution and cannot be outsourced, whether the operation runs in house or through a partner. What the platform supplies is the evidence: every action, every rule that triggered it, and every decision, timestamped.
Where is my data hosted?
In the European Union. Two models are available, shared infrastructure in Belgian data centres and a dedicated cloud on Microsoft Azure with fully isolated environments. No production data leaves the European Economic Area, and the platform is ISO 27001 certified.
Do I have to replace my existing systems?
No. Harmoney connects to what you already run, through 35+ native integrations and open APIs, and writes clean data back. Providers and source systems are swapped by configuration rather than by re-integration.
What does KYC remediation cost?
It depends on the population, the standard and how much can be enriched rather than requested. Scoping is one conversation, and it starts from your numbers rather than a package.