Purpose of the Template
You're conducting enhanced due diligence on a prospective client who triggers red flags during initial screening. Your team needs a structured conversation guide that meets the Financial Conduct Authority (FCA) expectations for robust Know Your Customer (KYC) processes while gathering the information required under the Financial Action Task Force (FATF) Recommendations.
The FCA warns of serious gaps in financial crime controls among U.K. financial services firms. These gaps persist even when firms believe they've strengthened their checks. This script addresses that disconnect by standardizing how your front-line staff handle the most challenging part of KYC: getting complete, verifiable information from clients who don't fit standard risk profiles.
Use this when your screening flags:
- Complex ownership structures with multiple layers
- Beneficial owners in high-risk jurisdictions
- Business activities that don't match the stated purpose
- Politically exposed persons or their associates
- Source of funds that requires deeper verification
Prerequisites
Before using this script, confirm:
Your risk rating methodology is documented. You can't apply enhanced due diligence consistently if you haven't defined what triggers it. Your policy should specify the indicators that move a client from standard to enhanced review.
You've completed initial screening. This script assumes you've already run sanctions checks, adverse media searches, and PEP screening. The conversation addresses gaps and inconsistencies in what you found, not first-pass information gathering.
The relationship manager understands the regulatory basis. Your staff needs to know they're asking these questions because the law requires it, not because they're personally suspicious. That framing changes how clients respond.
You have a secure method for collecting supporting documents. You'll request identity documents, corporate filings, and financial statements during this conversation. Your document handling must comply with the General Data Protection Regulation (GDPR) storage and retention requirements.
The Onboarding Script
Opening (set expectations)
"Thank you for your interest in establishing a relationship with us. As part of our regulatory obligations, I need to ask you some detailed questions about your business and the structure of your organization. This is standard practice for all clients in your industry sector. The conversation typically takes 30 to 45 minutes. Is now a good time?"
Section 1: Beneficial Ownership Verification
"Your corporate registry filing shows [name] as a shareholder with [percentage] ownership. Can you walk me through the complete ownership chain from this entity up to the natural persons who ultimately control it?"
[Listen for evasion or complexity. Note any hesitation.]
"For each beneficial owner holding 25% or more, I need to verify:
- Full legal name and any previous names
- Date and place of birth
- Current residential address
- Nationality and any additional citizenships
- Whether they hold or have held any public office in the past 12 months"
[If the client mentions trusts or nominee arrangements:]
"Who are the settlors, trustees, and beneficiaries of this trust? I'll need identity documentation for each person with the power to appoint or remove trustees."
Section 2: Source of Wealth and Funds
"You've indicated the initial deposit will be [amount]. Can you describe how you accumulated this capital?"
[Good answers are specific: "I sold my manufacturing business in 2024" or "These are retained earnings from our logistics operation." Vague answers like "business profits" or "investments" require follow-up.]
"What documentation can you provide to verify this? We typically accept:
- Audited financial statements
- Sale agreements for business or property
- Investment account statements covering the relevant period
- Tax returns showing the income"
[If the source involves multiple steps:]
"Let me make sure I understand the flow of funds. The money originated from [source], moved to [intermediary], and will come to us from [account]. Is that correct? I'll need documentation for each step in that chain."
Section 3: Purpose and Nature of the Relationship
"What's the primary purpose of this account? What types of transactions do you expect to conduct, and what's the anticipated monthly volume?"
[Compare the answer to your initial risk assessment. Mismatches are red flags.]
"You mentioned [activity]. Can you give me a specific example of a typical transaction? Who are your counterparties, and which jurisdictions do you operate in?"
[If the business involves high-risk jurisdictions:]
"Your business has operations in [country]. What controls do you have in place to ensure compliance with anti-money laundering requirements in that jurisdiction? Do you have a Money Laundering Reporting Officer or equivalent?"
Section 4: Ongoing Monitoring Expectations
"Our regulatory obligations require us to monitor this relationship on an ongoing basis. That means:
- Annual reviews of your ownership structure and business activities
- Transaction monitoring that may generate questions about specific payments
- Requests for updated documentation when circumstances change
"Are you comfortable with this level of oversight?"
Closing
"I'm going to summarize what you've told me and the documents you'll provide. Please correct me if I've misunderstood anything."
[Recap the key points. This serves as verification and creates a record.]
"I'll submit this information to our compliance team for review. The decision typically takes [timeframe]. If we need clarification on any point, who's the best person to contact?"
Customizing the Script
Adjust the detail level based on your risk appetite. If you serve exclusively high-net-worth individuals in complex structures, you might make Section 1 even more granular. If you rarely encounter beneficial ownership chains beyond two layers, you can simplify.
Add industry-specific questions. If you specialize in payments firms, ask about their transaction monitoring systems. For investment managers, ask about their approach to client due diligence. The script should reflect the risks specific to your client base.
Translate the regulatory language into your firm's voice. The phrases here are direct and compliance-focused. If your culture is more relationship-oriented, soften the tone without losing the substance. You still need the same information; you're just asking for it differently.
Create decision trees for common responses. When a client says "it's complicated" about ownership structure, what's your next question? When they can't provide documentation for the source of funds, do you proceed with alternative verification or decline the relationship? Document these decision points so different staff members handle them consistently.
Integrate with your CRM or case management system. The answers to these questions should populate specific fields in your client record. Design the script so it maps directly to your data structure. That makes ongoing monitoring feasible.
Validation Steps
Test the script with your relationship managers before deploying it. Have them role-play both sides of the conversation. You'll discover ambiguous questions and missing follow-ups.
Review a sample of completed onboarding files. Did the script generate the documentation you need? Can you reconstruct the client's ownership structure and source of funds from what's in the file? If not, the script needs refinement.
Compare outcomes across different staff members. If one relationship manager consistently gets complete information while another doesn't, the problem isn't the script, it's training or confidence. Observe their conversations and identify where they're deviating from the approach.
Audit against the FCA's expectations. When the regulator reviews your files, they're looking for evidence that you understood the client's risk profile and took appropriate steps to verify their identity and activities. This script should produce that evidence. If it doesn't, you've identified the gap before the regulator does.
Update the script when you encounter new evasion patterns. Sophisticated clients develop ways to avoid answering uncomfortable questions. When you notice a pattern, "my accountant handles that" or "that information is confidential", add a follow-up question that addresses it directly.
The script isn't a substitute for judgment. It's a framework that ensures your team asks the right questions in a consistent way. Your relationship managers still need to recognize when an answer doesn't make sense and probe deeper.
