In-depth guide · Compliance
The KYC process in a family office: from onboarding to periodic review
Updated: · Leutrim Miftaraj, FLIORE · Editorial standards · Other languages: Deutsch · Français · Español
Short answer
A family office's KYC process has eight phases: pre-screening, identification and establishment of beneficial owners, clarifying the source of wealth, risk rating, approval, ongoing monitoring, event-driven review and periodic review through to termination. Each phase needs a responsible person, clear outputs and a documented close, so that an audit firm can follow the process without asking.
Why an end-to-end process
Many family offices fulfil individual obligations carefully but without a connecting process: identity documents are on file, the risk profile is missing; the rating is reasoned, but no one reviews it again after two years. Audits rarely criticise individual documents – they criticise the gaps between the steps. An end-to-end process with fixed hand-overs closes these gaps and makes the work independent of individual people.
The eight phases
- Pre-screening: purpose of the relationship, initial structure, screening for sanctions and PEPs, decision on whether to start the clarifications.
- Identification: identify and verify the contracting party and the beneficial owners, record the structure with its roles.
- Source: ask about, evidence and check the plausibility of the source of wealth and the source of funds.
- Risk rating: assess the factors, set the rating, record the reasons.
- Approval: decision on accepting the relationship – for high risk by a member of senior management.
- Ongoing monitoring: transactions, screening when lists change, expiry dates of identity documents and powers of attorney.
- Event-driven review: new beneficiaries, change of residence, political office, a screening hit.
- Periodic review and termination: updates according to the risk rating, documented end of the relationship.
Roles and responsibilities
| Phase | Relationship manager | Compliance | Senior management |
|---|---|---|---|
| Pre-screening | Carries out | Is informed | – |
| Identification and source | Carries out | Checks completeness | – |
| Risk rating | Proposes | Confirms for medium and high risk | – |
| Approval | Requests | Approves for low and medium risk | Approves for high risk |
| Monitoring and events | Reports anomalies | Investigates, decides on reporting | Is informed in case of suspicion |
| Periodic review | Updates | Checks and closes | Confirms for high risk |
Outputs per phase
Each phase ends with an auditable output: pre-screening with an acceptance decision, identification with complete personal data and a structure chart, the source clarification with a derivation of the wealth, the risk rating with rating and reasons, approval with date and name, the review with a note on changed or confirmed information. A process step only counts as done once its output is in the file.
A few clearly defined indicators help: lead time from pre-screening to approval, share of overdue periodic reviews, number of open screening hits and number of identity documents expiring in the next 60 days.
Worked example (simplified)
A multi family office takes on a business family with a holding company, a family foundation and two private portfolios. During pre-screening, the screening shows no hit. During identification it emerges that a son was recently elected to the municipal council of a Swiss town – as a municipal office not a PEP case, but a factor that is mentioned in the reasoning. The source of wealth can be evidenced through the sale of part of a business. The rating is "medium" because of a structure spanning two countries; compliance confirms, and approval follows after eight working days. A year later the family reports that the daughter has moved to Dubai – an event that triggers a new review.
Common weaknesses
- Approval before the source clarification is complete, "because the family is known".
- Events are noticed but do not trigger a documented reassessment.
- Periodic reviews without a fixed date and without a responsible person.
- Screening hits are cleared verbally but not recorded.
- Terminated relationships without documentation of where the assets went.
Hand-overs between the phases
Most gaps arise at the transitions. Between identification and risk rating, what stood out in the first meeting gets lost; between approval and monitoring, the expected transactions are missing as a benchmark; between an event and the reassessment, too much time passes.
Three simple rules help. First, every phase ends with a status in the file – open, under review, closed – and the next phase only starts once the previous one is closed. Second, at approval the risk profile is translated into concrete monitoring parameters, such as expected amounts, countries and counterparties. Third, every event has a deadline for reassessment, for example ten working days. This turns individual obligations into a closed loop that keeps working when staff change. What is documented is not only the result but also who decided what and when – often the first question in an audit.
In FLIORE
In FLIORE the mandate covers the whole process: persons and roles, structure, screening, risk assessment, documents and approvals under the four-eyes principle. Due reviews and expiring identity documents appear in the compliance calendar, every change in the audit trail, and the KYC package compiles the file for banks or audits.
At a glance
| Phases | Eight, from pre-screening to termination |
|---|---|
| Standard | Every phase with an auditable output in the file |
| Indicators | Lead time, overdue reviews, open hits, expiring identity documents |
Terms on this page
- Beneficial owner
- The natural person who ultimately owns or controls a company, foundation or trust, or on whose behalf a transaction is carried out.
- Source of wealth
- How a person's total wealth came about, for example through entrepreneurship, inheritance or employment.
- Source of funds
- The origin of the specific assets brought into a business relationship or transaction.
- Ongoing monitoring
- Continuous review of a business relationship and updating of client data throughout its duration.
- Multi family office
- A service provider that looks after the wealth and affairs of several unrelated families.
- Family foundation
- A foundation whose purpose lies predominantly in the interest of one or more families.
Frequently asked questions
How long does a KYC process take?
That depends on the structure and the risk. Simple cases are done in days; complex structures with source clarification across several countries can take weeks. What matters is that no approval is given before the clarifications are complete.
May a family office start working before the clarifications are complete?
As a rule, no. Due diligence obligations must be fulfilled before the business relationship begins; exceptions are narrow and must be justified.
Who approves a high-risk relationship?
A member of senior management, after preparation by the relationship manager and compliance. This is what the rules on enhanced due diligence require.
What counts as an event that triggers a new review?
Among others: new beneficial owners or beneficiaries, a change of residence, a political office, screening hits, inflows significantly higher than expected and changes to country lists.
How is the end of a relationship documented?
With date, reason, destination of the assets and, where applicable, a reference to a report. The file remains available for the retention period.
Does a small family office need all eight phases?
Yes, but to a proportionate extent. The phases can be lean, but they must exist and be documented.
How is the process safeguarded when staff change?
Through uniform statuses per phase, a deputy for every role and a file that can be understood without explanations from the previous person. A central system instead of personal folders is the most important prerequisite.
Sources
- Swiss Anti-Money Laundering Act (AMLA/GwG, SR 955.0) – Fedlex
- German Money Laundering Act (GwG), section 10 – General due diligence obligations
- German Money Laundering Act (GwG), section 15 – Enhanced due diligence obligations
- Austrian Financial Markets Anti-Money Laundering Act (FM-GwG) – Legal Information System (RIS)
- FATF Recommendations and Guidance on Beneficial Ownership
- FINMA – Anti-Money Laundering Ordinance FINMA (AMLO-FINMA)
This page provides orientation and does not replace legal or tax advice. The cited legal sources in their applicable version are authoritative.
Read more
More on Compliance in practice
FLIORE in your family office
See structures, compliance and consolidated wealth with your own questions – in a personal demo.