Compliance guide
The KYC file: structure, contents, auditability
Updated: · Leutrim Miftaraj, FLIORE · Editorial standards · Other languages: Deutsch · Español · Français
Short answer
The KYC file contains everything a family office uses to show that it has fulfilled its due diligence obligations: identification of the contracting party, establishment of the beneficial owners, risk profile, evidence of the source of wealth, screening results, clarifications and decisions. It is audit-proof when a qualified third party can follow, without asking, what was checked and decided and when.
The benchmark: the qualified third party
Anti-money laundering documentation has a clear aim: an audit firm, a self-regulatory organisation or an authority should be able to form a reliable judgement without explanations from those involved. The Swiss AMLA expressly requires records to be kept in such a way that qualified third parties can form a reliable judgement (Art. 7 AMLA). The same logic applies in Germany and Austria.
A proven outline
- Cover sheet with mandate, risk rating, responsible person and next review date.
- Identification of the contracting party: copies of identity documents, register extracts, powers of attorney.
- Beneficial owners: structure chart, declarations, evidence for each level.
- Risk profile with the reasoning for the rating.
- Source of wealth and of funds, with derivation and evidence.
- Screening: PEP, sanctions, media – with date, result and assessment of hits.
- Clarifications, correspondence and decisions, in chronological order.
- Periodic reviews with their results.
Keeping it current is an obligation
A file that was complete at onboarding is often outdated after a few years: expired passports, beneficiaries who have moved, new companies. Since the 2023 revision, the Swiss AMLA expressly requires the currency of client data to be reviewed periodically; in Germany updating is part of ongoing monitoring under section 10 GwG. Expiry dates of identity documents therefore belong in a deadline list, not in the heads of individual staff.
Retention
- Switzerland: at least ten years after the end of the business relationship or completion of the transaction (Art. 7 para. 3 AMLA).
- Germany: five years, starting at the end of the calendar year in which the business relationship ends (section 8 GwG).
- Austria: five years after the end of the business relationship under the FM-GwG.
- Tax and commercial-law retention periods can be longer and apply in parallel.
Typical gaps in audits
Missing assessment of screening hits, structure charts without a date, declarations on the beneficial owner without a signature, risk ratings without reasoning, source-of-wealth evidence without a derivation, and files in which no one can tell which version applies. Almost all of these gaps arise not from carelessness but because documents are spread across emails, network drives and paper folders.
A useful test before any audit is to hand one file to a colleague who has never worked on the mandate and ask them to explain the rating. Wherever they need to ask, the file has a gap.
In FLIORE
FLIORE keeps the file on the mandate: persons with identity data and expiry warnings, structure, risk assessment, screening and encrypted documents with versions. The KYC package compiles the selected documents at the push of a button into a PDF with a cover sheet and an index of enclosures – for a bank or an audit, for example.
At a glance
| Benchmark | Comprehensible to qualified third parties without queries |
|---|---|
| Retention | CH at least 10 years, DE and AT 5 years after the end of the relationship |
| Most frequent gap | Evidence without assessment or reasoning |
Terms on this page
- Beneficial owner
- The natural person who ultimately owns or controls a company, foundation or trust, or on whose behalf a transaction is carried out.
- Forms A, K, S and T
- Standardised forms used by Swiss banks to establish the beneficial owner: A in general, K for controlling persons, S for foundations and T for trusts.
- Source of wealth
- How a person's total wealth came about, for example through entrepreneurship, inheritance or employment.
- Ongoing monitoring
- Continuous review of a business relationship and updating of client data throughout its duration.
Frequently asked questions
May the KYC file be kept purely electronically?
Yes, in Switzerland, Germany and Austria. The prerequisite is that the documents are complete, legible, protected against later alteration and available throughout the retention period.
What does not belong in the KYC file?
Documents unrelated to due diligence, such as irrelevant private correspondence. Under data protection law the principle of data minimisation applies: collect what the obligations require.
Who may see the file?
Only persons who need it for their task, plus the audit firm and the supervisor. An access concept with roles and a log of access protects the family's sensitive data.
Must the file be handed over when changing provider?
The retention obligation stays with the obliged family office. When changing software, it must be possible to export the file completely and legibly so that the retention period continues to be met.
Sources
- Swiss Anti-Money Laundering Act (AMLA/GwG, SR 955.0) – Fedlex
- German Money Laundering Act (GwG), section 8 – Recording and retention obligation
- Austrian Financial Markets Anti-Money Laundering Act (FM-GwG) – Legal Information System (RIS)
- FATF Recommendations – Financial Action Task Force
This page provides orientation and does not replace legal or tax advice. The cited legal sources in their applicable version are authoritative.
Read more
More on Compliance in practice
FLIORE in your family office
See structures, compliance and consolidated wealth with your own questions – in a personal demo.