An audit-ready identity verification program is supported by more than pass or fail results. This checklist explains which KYC and KYB records to retain, how to organize evidence, how often to test controls, and how to prepare for an internal review, external audit, or material program change.
Overview
Auditors and compliance reviewers generally need to understand three things: what your business requires, how the process operates in practice, and whether the controls continue to work. A verification platform’s dashboard can help, but a screenshot of an approval rate is not a complete evidence set.
For a useful audit trail, connect each onboarding decision to the policy, data, checks, reviewer actions, and retention controls that supported it. The exact records you must keep depend on your business model, customers, jurisdictions, risk appetite, and applicable obligations. Treat this article as an operational checklist rather than a substitute for legal or regulatory advice.
A strong evidence library should allow a reviewer to answer the following questions without reconstructing the process from memory:
- What identity, business, ownership, and risk information was required?
- Which checks were performed, when were they performed, and what did they return?
- Who approved, rejected, escalated, or overrode the result?
- How is sensitive information protected, retained, and eventually deleted?
- How does the organization test whether the process is accurate, consistent, and effective?
What to track
Maintain a structured evidence register with an owner, storage location, review date, and status for every control. The following matrix covers the core records commonly needed to demonstrate identity verification compliance.
| Evidence area | Records to retain | What the evidence should show |
|---|---|---|
| Policies and procedures | Approved KYC and KYB policies, risk-rating methodology, escalation rules, exception criteria, version history, and approval records. | The process is defined, authorized, and updated through controlled governance. |
| Notice and consent | Privacy notices, consent or acknowledgment records where required, collection purpose, data fields requested, and notice version. | People and businesses were given appropriate information about data use and verification activity. |
| Identity and business verification | Case ID, timestamps, submitted information, document verification results, liveness or identity-proofing outcomes, business registry results, and source references. | The decision can be traced to the checks actually performed, without retaining unnecessary data. |
| AML and sanctions screening | Screening date, data set or name used, match status, list or source configuration, alert details, disposition, and reviewer rationale. | Potential sanctions, PEP, or other risk alerts were handled consistently and not silently dismissed. |
| UBO and ownership research | Ownership charts, registry extracts, control-person information, source dates, unresolved gaps, and escalation decisions. | The organization identified and assessed relevant beneficial owners and control relationships. |
| Manual reviews and overrides | Queue history, reviewer identity, reason code, supporting notes, second-level approval where required, and final outcome. | Human intervention was authorized, explainable, and subject to quality controls. |
| Access and security logs | Administrative access, case access, exports, configuration changes, failed login events, and privileged-user activity. | Sensitive evidence was available only to appropriate users and material actions were auditable. |
| Retention and deletion | Retention schedule, legal or business justification, deletion jobs, deletion exceptions, backup handling, and data-subject request records where applicable. | Records are retained for a defined reason and removed or restricted when that reason ends. |
| Vendor due diligence | Security reviews, contract terms, service descriptions, subprocessors, incident commitments, business continuity information, and independent assurance reports where available. | Third-party verification providers are monitored as part of the control environment. |
| Periodic testing | Sample reviews, false-positive analysis, reconciliation tests, access reviews, scenario tests, issue logs, remediation plans, and retest results. | The program is tested after launch rather than assumed to work indefinitely. |
For privacy-first authentication and document verification, store the result and relevant metadata where possible instead of creating unnecessary copies of identity documents. Evidence should be sufficient to explain a decision while following data minimization and access-control principles.
Cadence and checkpoints
Use a recurring schedule so audit preparation is a maintenance activity, not a last-minute document hunt. A practical cadence can include the following checkpoints:
Monthly operational review
- Sample recently approved, rejected, and escalated KYC and KYB cases.
- Confirm that sanctions screening, UBO research, and reviewer notes are present where required by policy.
- Review unusual spikes in manual overrides, failed checks, duplicate identities, or incomplete cases.
- Check that access and export activity is explainable.
Quarterly control review
- Test policy-to-workflow alignment after product, market, or risk-model changes.
- Reconcile case counts and outcomes between the verification platform, onboarding system, and compliance records.
- Review vendor performance, incidents, configuration changes, and open service issues.
- Confirm that retention and deletion jobs completed and that exceptions have owners.
Annual or event-driven review
- Obtain current internal approvals for policies, risk rules, and escalation paths.
- Refresh vendor due diligence and confirm that evidence sources still meet operational needs.
- Run deeper sample testing across customer types, countries, entity structures, and risk tiers.
- Review the program after a material incident, regulatory change, new product, acquisition, or major workflow redesign.
The schedule should reflect risk. A business onboarding complex ownership structures or serving higher-risk markets may need more frequent testing than a low-complexity program. Document the rationale for the chosen cadence.
How to interpret changes
Tracking counts alone can produce misleading conclusions. A higher rejection rate may reflect stronger controls, a new customer segment, changed document quality, or an overly restrictive rule. A lower manual-review rate may indicate better automation—or an integration failure that is bypassing a control.
Interpret changes by comparing them with context:
- Volume: Did onboarding volume, country mix, entity type, or product usage change?
- Control configuration: Were thresholds, screening sources, document types, or risk rules changed?
- Outcome quality: Did quality sampling find missed fraud, inconsistent decisions, or unsupported approvals?
- Human behavior: Are the same reviewers using overrides differently, or are queues becoming difficult to manage?
- Data integrity: Are timestamps, case IDs, decision reasons, and source records complete and consistent?
- Privacy impact: Is the program collecting more data than the decision requires, or retaining it longer than intended?
Classify findings as evidence gaps, control failures, process exceptions, or acceptable outcomes. Give each issue an owner, severity, due date, corrective action, and retest requirement. This makes the audit file useful for remediation rather than merely descriptive.
When to revisit
Revisit this checklist at least quarterly and before any scheduled audit or annual compliance review. Also reopen it whenever a recurring data point changes materially: verification volumes, approval or rejection patterns, manual-review rates, screening alerts, override frequency, vendor performance, access activity, or deletion results.
Before an audit, assemble a request-ready folder or controlled workspace containing:
- Current policies, prior versions, approvals, and a change log.
- A process map showing data collection, verification, screening, review, decision, and retention steps.
- Representative case files covering straightforward, failed, escalated, and overridden decisions.
- UBO research and ownership evidence for selected complex business cases.
- Sanctions, PEP, and other screening dispositions with reviewer rationale.
- Access reviews, security logs, retention reports, and deletion exceptions.
- Vendor due-diligence records, contracts, assurance materials, and incident history.
- Testing results, open findings, remediation plans, and evidence that fixes were retested.
Finally, perform a dry run: ask someone who did not operate the workflow to select a case and trace it from intake to final decision. If they cannot determine what happened, why it happened, and who authorized it, the evidence set needs work. Keep the checklist as a living control document, update it when the process changes, and record each review so audit readiness becomes part of normal KYC and KYB operations.
