kyc_onboarding_screening v1.0.0

name: "kyc_onboarding_screening" description: "Run know-your-customer screening when onboarding a financial customer: identity and document checks, beneficial ownership for business accounts, sanctions and watchlist screening, risk rating with the reasons recorded, and the escalation and review path when a check fails or stays unclear. Use when opening a bank, brokerage, payments, or lending account, onboarding a business customer, clearing a screening hit, or building a small firm KYC worksheet."

KYC Onboarding Screening

Purpose

Run a complete, auditable onboarding check for one financial customer, from first facts to a signed-off decision. The sequence follows the US Customer Identification Program rule under Section 326 of the USA PATRIOT Act (31 CFR 1020.220 for banks, with parallel rules for other sectors), the FinCEN Customer Due Diligence Rule, FATF Recommendations 1, 10, and 12, and the OFAC sanctions compliance framework.

This skill teaches the work for a small firm that has no big rules engine. It produces a screening worksheet and a risk-rating sheet for every customer, plus a clear hold, escalate, or open decision. It is a teaching and workflow aid, not legal advice. A true sanctions match, a suspected fraud case, and any filing decision go to the firm compliance officer and qualified counsel.

Workflow

1. Freeze the case facts before checking anything. Record the customer type (individual or legal entity), the account or product requested, who is opening the account and their authority to do so, the stated purpose of the relationship, expected activity (types, volumes, countries, cash use), and the channel (in person or remote). Give the customer the CIP notice that the firm will ask for information to verify identity. If purpose or expected activity is vague, write down that it is vague. Do not fill gaps with guesses.

1. Collect the CIP minimum. For an individual, collect name, date of birth, residential or business street address, and an identification number. For a US person that number is a taxpayer identification number. For a non-US person use a taxpayer identification number, a passport number and country of issuance, an alien identification card number, or the number and country of issuance of another government-issued document that shows nationality or residence and bears a photograph or similar safeguard. For a legal entity, collect legal name, principal place of business or other physical location, and taxpayer identification number if it is a US person, plus formation documents in step 3. Stop and hold if a required field is missing, rather than opening first and chasing it later. The narrow TIN-applied-for exception and the credit card third-party route exist in the rule, so route any use of them through the compliance officer and record the follow-up date.

1. Verify identity and resolve every discrepancy. Use documentary methods, non-documentary methods, or both, under risk-based procedures that let the firm form a reasonable belief that it knows the true identity of the customer. Documentary route for an individual: review an unexpired government-issued document that shows nationality or residence and bears a photograph or similar safeguard, such as a driver license or passport. Record the document type, number, place of issuance, issue date, and expiry date. Documentary route for an entity: review documents that show legal existence, such as certified articles of incorporation, an unexpired government-issued business license, a partnership agreement, or a trust instrument. Non-documentary route: contact the customer, compare supplied information against a consumer reporting agency, public database, or other independent source, check references with other financial institutions, or obtain a financial statement. Add non-documentary checks when the customer cannot present unexpired photo ID, the firm does not know the document type presented, the account is opened remotely or without documents, or any other fact raises the risk that documents alone will not verify identity. Write the resolution of every substantive discrepancy, for example a name spelling difference, an old address, or a date-of-birth mismatch, in the file. An unresolved substantive discrepancy is a hold, not a footnote.

1. Identify and verify beneficial owners for every legal entity customer. Apply both prongs, every time, unless a documented exclusion in references/beneficial-ownership.md applies. Ownership prong: identify each natural person who, directly or indirectly, owns 25 percent or more of the equity interests. That gives zero to four people. Control prong: identify one natural person with significant responsibility to control, manage, or direct the entity, such as a chief executive, chief financial officer, chief operating officer, managing member, general partner, president, or treasurer. That gives exactly one person. Get a certification from the natural person opening the account that the ownership information is true, or record equivalent information in the same form. Verify each beneficial owner with CIP-style documentary or non-documentary procedures. Photocopies and reproductions are acceptable for beneficial owner verification under the CDD Rule. The firm may rely on the customer supplied ownership information unless it knows facts that call that information into question, and if it does know such facts, it must dig further and record what it did. Worked ownership math is in references/worked-cases.md, case 3.

1. Screen every relevant person and the entity itself. Screen the customer, each beneficial owner, the control person, authorised signatories, and the entity, against the lists the firm program names. At minimum that means the OFAC Specially Designated Nationals and Blocked Persons List, the OFAC consolidated non-SDN lists, and any government list the CIP rule requires the firm to check, plus the firm own PEP and internal watchlists. Screen at onboarding, again before the first high-risk transaction if onboarding was staged, and on the firm re-screening cycle when lists update. Adjudicate a possible hit on identifiers, not on name feel: compare date of birth, address, country, document numbers, and aliases, and record why a hit was cleared as a false positive or kept open. Apply the OFAC 50 Percent Rule to entities: aggregate direct and indirect ownership by all blocked persons, and treat an entity at 50 percent or more blocked ownership as blocked itself, even if its own name appears on no list. Full hit handling is in references/screening-and-hits.md. A confirmed true match is never cleared at desk level.

1. Understand the relationship and rate the risk, with reasons. Record the nature and purpose of the relationship, expected activity, source of funds, and for higher risk cases source of wealth, occupation or business type, and main customers, suppliers, and trade area for a business. Then score the case with the bundled worksheet tool or by hand using references/risk-rating-and-edd.md. Every point in the score must carry a written reason tied to a fact in the file. A score with no reasons is not a risk rating. Rate the case Low, Standard, or High. Politically exposed person status, high-risk geography, cash-intensive activity, complex or layered ownership, unclear source of funds, and activity that does not fit the stated business push a case toward High, but no single label decides it alone. The FFIEC manual makes the same point for PEPs: position, influence, geography, account purpose, and expected activity all change the risk.

1. Decide, and escalate on the stated path. Use only these outcomes in the record: open - standard, open - enhanced due diligence required, hold - information pending, hold - escalation, or decline or close - compliance decision. Rules that force a hold: identity cannot be verified, a required CIP field is missing, a substantive discrepancy is unresolved, no control person has been identified for a legal entity, a screening hit is still potential and unresolved, or source of funds is unclear for a high-risk case. Rules that force escalation to the compliance officer the same day: a true or probable sanctions match, a PEP the firm policy requires approval for, suspected document fraud, or any request from the customer to skip, split, or hide a check. High risk cases need the approval level the firm policy names, normally senior management or the compliance officer, before opening. Never tell a customer how to structure around a check, and never open the account first on a promise to fix a hold later.

1. File the record and set the review clock. Keep identifying information for five years after the account is closed, and keep the description of documents relied on, the non-documentary methods and results, and the resolution of discrepancies for five years after the record is made, under 31 CFR 1020.220(a)(3) and the CDD record rules. Set the next review from the rating: High cases on the firm short cycle, Standard on the normal cycle, Low on the long cycle, with the exact months set in firm policy. Reopen the file early on trigger events: a material change in ownership or control, a significant unexplained change in activity, activity inconsistent with the stated purpose or risk profile, a change in business operation or employment that matters to the profile, a new screening hit, or new adverse information the firm policy treats as material. Updating is event driven first, calendar driven second.

Worksheet tool

Build the worksheet and the risk-rating sheet from a case JSON file:

bash
python3 ~/workspace/skills/kyc-onboarding-screening/bin/kyc-worksheet.py case.json > worksheet.md

Case JSON shape, with an individual example in references/worked-cases.md:

json
{
  "customer_name": "Example Customer",
  "customer_type": "legal_entity",
  "country_risk": "medium",
  "channel": "remote",
  "expected_monthly_volume_usd": 42000,
  "cross_border": true,
  "cash_intensive": false,
  "pep": false,
  "complex_ownership": true,
  "source_of_funds_clear": true,
  "identity_verified": true,
  "unresolved_discrepancy": false,
  "screening": "clear",
  "cip": {"name": true, "date_of_birth_or_formation": true, "address": true, "id_number": true},
  "beneficial_owners": [
    {"name": "Owner One", "ownership_pct": 40, "control": false, "blocked_pct": 0},
    {"name": "Owner Two", "ownership_pct": 35, "control": false, "blocked_pct": 0},
    {"name": "Control Person", "ownership_pct": 0, "control": true, "blocked_pct": 0}
  ]
}

The tool checks CIP completeness, checks that the control prong has exactly one person, lists every owner at or above 25 percent, aggregates blocked ownership for the 50 Percent Rule, scores risk factor by factor with reasons, and prints a disposition. A hold flag in the tool overrides the score. The tool does not clear hits and does not make the final decision. A person does.

Output Contract

Every onboarding run produces:

• A screening worksheet for the customer: facts collected, CIP fields present or missing, documents seen with type, number, issuer, and expiry, non-documentary methods used and their results, and the resolution written for each discrepancy.
• A beneficial ownership record for a legal entity: each owner at or above 25 percent with the percentage, the single control person with their role, the certification status, and the verification method used for each person.
• A screening record: lists searched, date and time of the search, persons and entities screened, each hit and how it was adjudicated, the 50 Percent Rule aggregate for entity cases, and the screener name.
• A risk-rating sheet: the rating, the score if the firm uses one, and one written reason for every factor that moved the rating up or down.
• A decision line: one of the five outcomes from step 7, the name of the person who approved it, the date, any conditions (for example EDD documents due, volume limits, or a short review cycle), and the next review date or trigger list.
• A retention note: where the file is stored and the two retention dates from step 8.

Operating Rules

1. Verify every factual and legal claim against a primary source before relying on it in a live file. Rules, lists, and thresholds change. Lists are checked live at screening time, never from a saved copy.
2. Never invent a document, a percentage, a screening result, or a source of funds. If a fact is not in the file, the worksheet says missing, and the case holds.
3. No anonymous or numbered-only relationships, and no opening on a third party say-so. The customer, the owners, and the control person are named natural persons in the file.
4. Simplified checks are only for cases the firm has properly assessed as lower risk, and never for a case with a sanctions concern, an unverifiable identity, or an unresolved discrepancy.
5. Screening is per customer and per relevant person, at onboarding and again on the firm cycle. A clear result last year is not a clear result today.
6. Record reasons, not just results. An examiner, an auditor, or the next staff member must be able to rebuild the decision from the file alone.
7. This skill does not file suspicious activity reports, block assets, or give legal advice. It routes those calls, the same day, to the compliance officer, with the full file attached.