IN TODAY’S INTENSE REGULATORY

ENVIRONMENT, WHAT IS THE BEST WAY

FOR GLOBAL BANKS TO MANAGE KYC?
An In-Depth Look at The Cost/Benefits of a
Transformative Approach to KYC Managed Service
By Lee Forsyth

The views and opinions expressed in this paper are those of the author and do not
necessarily reflect the official policy or position of Thomson Reuters.
 CONTENTS
EXECUTIVE SUMMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

SHARED UTILITY OR MANAGED SERVICES: WHAT IS RIGHT FOR YOUR

FINANCIAL INSTITUTION? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

A CLEAR TREND TOWARD OPTIMIZING KYC. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

THE SHARED UTILITY MODEL FOR KYC. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

THE MANAGED SERVICES MODEL:

THE TRANSFORMATION OF KYC AND ON-BOARDING. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

SUMMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

2 WHAT IS THE BEST WAY FOR GLOBAL BANKS TO MANAGE KYC?

EXECUTIVE SUMMARY
Despite its rather innocuous title, Know
Your Customer (KYC) is serious business for
financial institutions. It’s not an option, nor is
it a “nice to have.” Since the financial crisis of
2008, the mandate to know whom you are
doing business with – and to fully ensure those
parties are operating in a lawful, compliant
manner – is more urgent, more tightly
regulated, and more complex than ever before.
At the same time, the costs and stakes for non-
compliance have never been higher – for your
bank, your shareholders and your reputation.
Consider: in roughly the last two years,
financial institutions have been fined more
than $10 billion globally for activities involving
money laundering, or doing business with
persona non grata.
Fines are just the tip of the iceberg. There
is also often a need to fix the underlying
problems in a timely manner. Such large-scale
remediations cost millions and affect multiple
areas, including sales, trading, compliance and
the global on-boarding and control functions.
Even if you are fortunate enough to
avoid regulatory censure, you still have
to invest millions to avoid being the next
big story splashed across the front pages.
Unfortunately, there is no sign that any of
these trends are going away any time soon.
In fact, in the Thomson Reuters Cost of
Compliance 2014 Survey, two-thirds of
the respondents thought that their total
compliance team budget would increase in
2014-15. There are also opportunity costs in
that your front office has to concentrate on
activities such as document collection and
on-boarding as opposed to differentiating and
profit-inducing activities.
The question, then, becomes how do you
evolve your existing KYC on-boarding
3 WHAT IS THE BEST WAY FOR GLOBAL BANKS TO MANAGE KYC?
function to deal with the increased regulatory
obligations? And what process is best suited to
your specific needs?
In this paper, we’ll examine why banks have
started to look at outsourcing parts of their
KYC functions, then go into detail about KYC
managed service, one of the most significant
approaches that has emerged in 2014.
SHARED UTILITY OR MANAGED SERVICES:
WHAT IS RIGHT FOR YOUR FINANCIAL
INSTITUTION?
In the last 12 to 18 months, there has been
much written and discussed about two
options for outsourcing KYC: shared utility and
managed service models. First a definition
of each.
The shared utility service model
Several utility options have cropped up since
mid-2013, many of them joint efforts between
banks and third parties.
Rather than each financial institution
managing their own client document
collection, they participate in a utility service
provided by a third party, and pay for the
services and data they use. The financial
institution provides pertinent customer
information into a single portal that is then
shared with participating financial institutions.
New bank customers (also called end-clients)
provide all required documents to one portal.
And banks can access all the necessary
information from the same portal.
The managed service model
A managed service model transforms the
entire function by going far beyond collecting,
storing and distributing customer data. It
enables financial institutions to outsource a
significant part of the process to a third party,
and reduce and standardize the costs involved
with KYC. By one estimate, a managed service
model can cut internal KYC costs by 30-40%*
In return, they get a true end-to-end solution
driven by dedicated teams of KYC experts
and analysts. A managed service provider
typically delivers identity collection verification,
identification of the Ultimate Beneficial
Owners (UBO’s), screening of the end-clients
and all relevant related parties.
The result is the financial institution receives
screened and validated KYC records of
their end-clients in accordance with a
comprehensive KYC policy. These KYC records,
or profiles (one managed service provider calls
them Passports) are stored and maintained
on a secure portal, where financial institutions
can access them. These KYC records are then
subject to on-going monitoring, screening and
periodic review.
End-clients get something they really desire:
true control over their own documents
Unlike many utility models, end-clients
have complete visibility and control over the
documents they provide, allowing permission
and access only to the financial institutions
they choose. End-clients know exactly who
is viewing their profiles, and whom they are
being shared with.
The biggest difference between the two
models is that managed service providers
continuously screen and monitor client data
from internal and external sources, and
provide timely updates to all subscribing
institutions. Real-time refresh and proactive
monitoring dramatically enhance the
institutions’ ability to mitigate risk outside of
the standard client refresh cycle.
In turn, this reduces the need for expensive,
labor-intensive remediation projects and
ensures that “red flag” events within their
client population are addressed proactively
and on a continuous basis.
In addition, as truly independent third parties
4 WHAT IS THE BEST WAY FOR GLOBAL BANKS TO MANAGE KYC?
not connected to any particular financial
institution, they tend to deliver greater data
security and privacy as a core business
strength is managing data.
KYC managed services – is it right for your
bank?
For today’s complex KYC requirements, an
end-to-end managed service is the right
approach for many financial institutions.
Managed service providers can deliver this
vision — or at the very least, put financial
institutions on the journey towards this vision
by enabling them to evaluate their current KYC
systems, products and processes.
A CLEAR TREND TOWARD OPTIMIZING KYC
KYC is at the center of several developments,
all of which point to a new way of thinking on
how to implement and operate KYC functions.
Those trends include:
• More regulation and greater complexity
• Increased outsourcing of non-core, non-
revenue functions
• Continued squeeze on technology and
infrastructure costs
• Front office personnel concentrating on non-
revenue based activities
A new world order
Until fairly recently, most banks performed
KYC functions internally, investing in
technologies, systems and expertise as
needed. It gave them complete end-to-end
control over the process, but also required
enormous capital outlays and personnel costs.
As the regulatory obligations grow in number
and complexity, it compounds the problem of
staying compliant.
In short, those unrestrained days and deep
pockets are long gone. The financial world
pivoted in 2008, and today, the focus is on
controlling technology and infrastructure
costs, while maintaining full compliance across
the business, locally and globally.
Today, the increasing (and competing)
demands on internal IT functions are
stretching resources to the breaking point.
This directly affects a bank’s ability to generate
revenue, as their focus is being directed
towards mitigating risk and avoiding censure.
Keeping pace with the changing requirements
everywhere they do business is no longer
sustainable for many banks. Increasingly,
they are looking for external solutions across a
broad spectrum of needs, including KYC rules
engines, screening and workflow management
tools.
As with any fundamental shift, this is creating
new opportunities, new ways of doing business
and new ways to enhance the KYC.
In other words, budgets are
shrinking, while regulatory
compliance requirements are
expanding, and growing in
complexity.
Why are regulators cracking down on KYC?
No doubt you’ve already felt the pressure
of increased regulation in the area of Anti-
Money Laundering (AML) and Counter-
Terrorism Financing. Regulators expect you
to know – and document – your clients and
the sources of their income, as well as the tax
consequences of their activities.
In addition they expect you to be able to
present a single view of your customer across
all products and markets, a cohesive “KYC file
upon request and be able to demonstrate that
you have followed your detailed policy and
procedures.
The regulatory pressure does not stop
there. You need to be able to provide clear
evidence at a transactional level. The tight
correlation between the KYC record and the
5 WHAT IS THE BEST WAY FOR GLOBAL BANKS TO MANAGE KYC?
underlying trade/transactional level of data
needs to be sufficiently robust to ensure total
transparency when filling suspicious activity
reports to the authorities. Given the diverse
nature of the business and the global reach
of many institutions, this becomes extremely
challenging to do to a high degree of accuracy.
Several forces are at play
Why now? The root of this really reaches
back to the financial crisis of 2008, and even
further, to the after effects of 9/11. Regulators
are trying to get behind where the money is
coming from, and getting more aggressive in
efforts to stop the funding of terrorism and
money laundering activities.
Another factor is the drive to clamp down
on tax evasion. The Foreign Account Tax
Compliance Act (FATCA), is US legislation that
went into effect in July of 2014. Since then, 60
other jurisdictions have signed up to exchange
documents, all in an effort for countries to
get their tax revenue. FATCA and the need to
positively identify individual beneficial owners
provide a direct line into the KYC process –
increasing complexity exponentially.
In addition, the most recent Financial Action
Task Force (FATF) recommendations (2012),
state firms should hold information on
their Ultimate Beneficial Owners, further
tightening the ongoing efforts to combat
money laundering, terrorist financing and
other related threats to the integrity of the
international financial system.
KYC systems built for a different time, and
for a simpler set of rules
Many current KYC practices simply have not
kept up with the rigors of today’s requirements.
In many financial institutions, KYC solutions
originated in an era when compliance was
nothing more than checking boxes on a
standard form. As regulations increased, a
patchwork of fixes and add-ons has added
layers of complexity, cost and redundancy.
Today, regulations are changing so fast that
IT and Operations often don’t have time to
react effectively, creating additional manual
processes and further weakening the control
framework.
Is this any way to treat a new customer?
Equally important, current KYC practices
create suboptimal customer experiences.
Currently your customers have to submit
paperwork to every bank they do business with,
one at a time. In some cases, this document
collection and verification can contribute to
the on-boarding process taking as long as six
months. In addition they need to update the
information on a regular basis. What other
industry would ask this of their clients?
In this challenging environment, it makes
sound financial sense to consider moving non-
core, non-differentiating functions to third-
party partners. In fact, it’s already happening.
The time is right to seriously consider
optimizing KYC
Regulators are clear in their expectations: KYC
remains the responsibility of the banks. But
you can outsource many KYC components
whilst still retaining ownership of the overall
function.
Isolating and outsourcing some of your KYC
function delivers several benefits: it cuts costs
of maintaining a full in-house team, system
and process and it takes pressure off your
already overextended infrastructure. It gives
you flexibility as needs and requirements
change. Closely related to that, it also scales to
your organization as it grows and enters new
global markets.
The question, then, becomes: what
are your options for outsourcing, and
what is the best fit for your needs?
Most outsourcing models also eliminate
parts of the on-boarding process for your new
6 WHAT IS THE BEST WAY FOR GLOBAL BANKS TO MANAGE KYC?
clients – creating a much more positive and
streamlined customer experience.
And perhaps most important, when you
optimize KYC, it frees you and your team to
focus on heightened areas of risk and perform
enhanced due-diligence. You can direct your
intellectual capital and resources to such
business-critical core functions as expanding
your footprint in new markets and instruments,
strengthening client relationships, and
establishing your enterprise as best-in-class.
THE SHARED UTILITY MODEL FOR KYC
Given the expense, complexity and centrality
of KYC functions, it’s no surprise that a utility-
shared service model has emerged over the
last 18 months. Current practices are complex
and redundant, requiring every customer to
exchange information with every financial
institution they deal with.
Rather than each financial institution creating
its own solution, they participate in a utility
service provided by a third party, and pay for
the services and data they use.
While there are differences and nuances
among providers in this space, all offer the
same essential core services. They gather
pertinent customer information in a single
portal that is then shared with participating
financial institutions. End-clients in this model
can upload all required documents to one,
or a few, utility provider(s); similarly, financial
institutions can access all the necessary
information from one, or a few, providers.
But for many financial institutions,
shared utilities simply don’t go far
enough.
THE MANAGED SERVICES MODEL:
THE TRANSFORMATION OF KYC AND
ON-BOARDING
Managed service models provide true end-
to-end solutions from a dedicated team of
KYC specialists and analysts. This third-party
expertise is something many banks are coming
to trust and value today.
Whereas utility providers collect, control and
distribute customer data to banks, managed
services go far beyond this to cover the full
range of customer lifecycle management, from
on-boarding all the way through refresh and
remediation.
Constantly monitored, continuously updated
With a managed service, client data is
monitored daily, in real time. Things constantly
change with your clients: Executives and board
members come and go, suppliers are added
and dropped, and firms go from public to
private. Each personal or entity event could
present a potential risk to your business.
Being proactive enables you to monitor
key changes to your client base that would
otherwise remain hidden in the regimented
rolling review cycles that has become the
standard in the industry.
In addition, as their status changes, documents
expire, or key information surfaces, your
customers will be alerted to update their
information and assess any incremental risk
to the organization. This advanced way of
monitoring your clients dramatically minimizes
your exposure to sanctioned entities, Politically
Exposed Persons and other key changes such
as de-listing/de-regulation. You can react in
real time to mitigate the increased risks to your
business.
Delivering a full spectrum of protection
When you consider who your clients are, be
they corporations, private companies, hedge
funds or other financial institutions, it’s
clear your relationship is complex and ever-
changing. The opportunity for falling out of
compliance is dangerously easy.
7 WHAT IS THE BEST WAY FOR GLOBAL BANKS TO MANAGE KYC?
Managed services are uniquely equal to
the task, providing full spectrum coverage
including:
• In-depth verification of client identity
information by a dedicated team of
KYC experts and analysts (conducted to a
comprehensive KYC standard)
• This KYC team is also responsible for
continuously monitoring client data so if
things change, the data is reviewed and
updated to reflect it
• Comprehensive client on-boarding, not just
data collection and storage
• Identifying all relevant ultimate beneficial
owners and senior management
officials in an entity
• Validating the information from independent,
public third party sources as well as screening
the legal entity to ensure that there are no
issues around the client, which should be
flagged
• Constant global tracking of new KYC
requirements, and updating data and
processes accordingly
Another plus for your customers
As mentioned, managed services give your
customers a vastly improved user experience
as they streamline the process for providing
client identity documentation. And the time to
on-board can be sufficiently reduced.
Managed services providers also give your
customers control and visibility over their own
data. This has been an issue with utilities,
because once clients deposit information, they
may not know who can access the information,
or who it gets shared with.
Using managed services, clients can store,
disseminate, and control permissions for
access to their data in a secure environment,
eliminating duplicative, time consuming
processes. End-clients always maintain control
over who is viewing their information.
By some estimates, Managed
Services can reduce a financial
institution’s KYC operations expense
by 30–40%*
Lastly, managed service models are free for
end-clients of financial institutions.
* Research from Thomson Reuters
A checklist: Questions to ask a potential
managed services KYC provider
As you explore options, keep these crucial
questions in mind.
Does the managed service provider:
• Verify clients’ identity through collection
and validation to a common market-leading
standard?
• Screen clients’ names and associated parties
against sanction lists, politically exposed
person (PEP), adverse information and
adverse media?
• Identify the Ultimate Beneficial Owner (UBO)
and senior management officials?
• Publish clients’ records with risk rankings
based on a rigorous process of verification,
screening and validation?
•Automatically rescreen clients and related
parties on a daily basis?
• Monitor identity and status on a daily basis
for any changes to trigger a refresh of the
clients’ records?
• Provide you with a secure portal to share
other non-KYC documents between
trading counterparties?
• Does their system integrate seamlessly with
your existing internal systems?

Full Managed Service

Monitoring

Screening Screening

Client Outreach Client Outreach Client Outreach

Public Domain Public Domain Public Domain Public Domain

search search search search

1 2 3 4

A managed service does not imply a one size-fits-all approach. Based on the firm’s need, size and scope, the access can be
modular randomly or progressive with module 4 being the full KYC managed service. In addition, firms can also add specific
requirements into any module to customize to their need e.g legal, credit, tax etc.

8 WHAT IS THE BEST WAY FOR GLOBAL BANKS TO MANAGE KYC?

SUMMARY
Know your managed service options
Ironically or not, evaluating a managed
service model should be part of any financial
institution’s due diligence. The potential
benefits in terms of cost savings and better
quality KYC coverage simply cannot be
ignored. In fact, all indications are that this is
the best model for helping financial institutions
perform the delicate balance of staying in full
compliance without breaking the bank.
In a classic win-win scenario, both financial
institutions and their end-clients are moving
to this transformative approach – for good
reasons.
Financial institutions, a managed service
model:
• Saves infrastructure and personnel cost
• Delivers a much more comprehensive and
rigorous KYC function
9 WHAT IS THE BEST WAY FOR GLOBAL BANKS TO MANAGE KYC?
• Ensures that end-client data is always
current, always accurate, even as
people and entity events change
• Allows flexibility to scale up or down – and
easily do global business
• Delivers confidence that their KYC process is
fully compliant, even as regulations change
• Finally, a truly independent third party
provider can help ensure data is secure and
remains private
For end-clients, this approach:
• Enables a vastly improved customer
experience to end-clients
• Allows end-clients to enter their data once for
all banks they do business with
• Provides visibility and control over that data
Today, when it comes to know your customer,
it’s time to know your options.
ABOUT THE AUTHOR
Lee Forsyth is the Global Lead KYC Consultant for Accelus Org ID at Thomson Reuters. Lee
and his team of KYC consultants work with the clients’ in-house Compliance and Operations
functions to define the most effective solution to complement their existing KYC programs.
Lee’s foray into the KYC space dates back to 1998 with Merrill Lynch. Lee has held a number of
regional and global leadership roles in Compliance/Operations with UBS, Goldman Sachs and
Nomura where he helped redefine and develop the end-to-end business processes to minimize
operational risk and increase transparency on KYC records.

10 WHAT IS THE BEST WAY FOR GLOBAL BANKS TO MANAGE KYC?

THOMSON REUTERS ACCELUS™
The Thomson Reuters Governance, Risk & Compliance (GRC) business delivers a comprehensive set
of solutions designed to empower audit, risk and compliance professionals, business leaders, and the
Boards they serve to reliably achieve business objectives, address uncertainty, and act with integrity.
Thomson Reuters Accelus connects business transactions, strategy and operations to the ever-
changing regulatory environment, enabling firms to manage business risk. A comprehensive
platform supported by a range of applications and trusted regulatory and risk intelligence data,
Accelus brings together market-leading solutions for governance, risk and compliance management,
global regulatory intelligence, financial crime, anti-bribery and corruption, enhanced due diligence,
training and e-learning, and board of director solutions.
For more information, visit accelus.thomsonreuters.com

© 2015 Thomson Reuters  GRC02197/2-15