KYC remediation project — tips for managing a massive backlog?

We just scoped a KYC remediation project and the numbers are terrifying: ~12,000 customer files need to be brought up to current standards. Many were onboarded years ago with minimal documentation that wouldn't pass today's requirements.

The KYC remediation process is straightforward on paper — review each file, identify gaps, reach out to customers, collect missing documents, update risk ratings. But at this scale it feels impossible without a massive temp workforce.

Anyone who's been through a large KYC remediation exercise: how did you prioritize? How long did it take? What was the customer attrition like? And did your regulator give you a fixed timeline or let you set your own?

KYC remediation at scale is one of the most operationally demanding compliance projects. Here's a proven approach:

Triage ruthlessly. Not all 12,000 files have the same risk. Segment by risk rating: do high-risk customers first (they have the biggest regulatory exposure), then medium, then low. Within each tier, prioritize by relationship value and activity level. Dormant accounts with low risk can go to the back of the queue.

Automate what you can. A lot of the remediation work involves collecting information that's available from external sources — company registries, sanctions lists, adverse media. If you can pre-populate files from external data before analyst review, you dramatically reduce the per-file effort.

Customer outreach strategy matters. The biggest bottleneck is getting customers to respond. A multi-channel approach works best: email first, then follow-up call, then formal letter. Give customers a simple portal to upload documents rather than asking them to email attachments.

Set a realistic timeline. For 12,000 files with a dedicated team, plan for 12-18 months. Regulators typically accept a credible plan with milestones rather than demanding instant completion. What they won't accept is no plan at all.

Track and report. Weekly dashboards showing files reviewed, gaps identified, outreach sent, documents received, files closed. Your regulator will ask for progress reports and your board will too.

These large-scale projects typically see 5-15% customer attrition from clients who can't or won't provide the requested documentation. That attrition isn't necessarily bad — some of those customers were high-risk to begin with.