KYC and onboarding guide

This guide covers customer due diligence in FlowSentry from first contact to periodic review: onboarding new customers, keeping KYC records accurate under maker-checker, and enhanced due diligence for higher-risk relationships. It is written for relationship managers (RMs), KYC reviewers and senior approvers, and is useful for risk managers and the MLRO.

1. Who does what

Task	Relationship manager	KYC reviewer	Senior approver	MLRO / Deputy
Capture an onboarding application	Yes	—	—	—
Review an application, decide identity checks	—	Yes	—	Yes
Approve or decline an application (high-risk with step-up)	—	—	Yes	Yes
Read customers, accounts and profiles	Yes	Yes	Yes	Yes
Propose a KYC change	Yes	Yes	—	Yes
Approve a KYC change (step-up)	—	—	Yes	Yes
Work an EDD checklist	—	Yes	—	Yes
Approve an EDD case	—	—	Yes	Yes
Answer information requests	Yes	—	—	—

Risk managers can also review applications and work EDD checklists. Senior analysts can propose KYC changes. In every case, the person who made an item cannot approve it.

Note: Relationship managers never see alerts, cases, investigations or STR material. This protects you and the institution from tipping-off risk.

2. Onboarding new customers

Client onboarding is an optional module. If Applications does not appear under Customers, it is not switched on for your institution.

The journey

Your institution defines onboarding journeys — for individuals and for corporates — with the documents and checks each requires, on Onboarding setup (/onboarding/configuration, administrators). Each application keeps the journey version it started on.

An application moves through Draft, Submitted, In review, Pending approval and finally Approved, Declined or Withdrawn.

Capture (relationship manager)

1. Customers › Applications (/onboarding) › Start an application.
2. Capture the customer's details. Every change saves as you leave a field.
3. Consent: present the Privacy notice and consent and Record consent.
4. Parties and checks: add the applicant and, for a company, its directors, signatories and owners, with identifiers (national ID, passport, KRA PIN, registration number). Run the identity checks the journey requires.
5. Ownership: add each ownership or control link with evidence or attestation, then Determine beneficial owners. If no natural person reaches the threshold, Record senior managing official.
6. Screening: Screen all parties now. A potential match puts the application on hold until the hit is resolved.
7. Submit for review.

Review (KYC reviewer)

1. Start review on a submitted application.
2. Check identifiers and identity check results. Inconclusive checks — for example a face match below your threshold — wait in the IDV review queue (/onboarding/reviews) for Accept or Reject. You cannot decide checks on an application you captured.
3. Check ownership: effective percentages are calculated through every layer; every link needs evidence or an attestation.
4. Confirm screening outcomes.
5. Preview risk on Risk and decision. It shows the band, the factor contributions, any floor rules that raised the band and anything outstanding.
6. Return to RM with a reason if something is missing, or Send for approval.

Decide (senior approver)

Open the application from My approvals. Review the file and the risk preview, then Approve (with a decision note) or Decline (with a reason). High-risk approvals need step-up — this is the senior management sign-off required for higher-risk and PEP relationships.

Approved customers are handed into the customer register and rated under your risk model. Declined applications are recorded in the declined-business register.

See Onboard a corporate customer for a worked example.

3. The customer register

Customers (/customers) lists every customer on file, whichever way they arrived — onboarding, the core banking feed or a file run.

• Figures: Customers, High risk, Incomplete KYC, IDs expiring, PEPs and Reviews overdue. Select one to filter.
• Search: the start of any name, or an exact identifier — national ID, KRA PIN, phone, account or customer number.
• Filters: risk band, KYC status, PEP, sanctions, country, branch, onboarding date, reviews due and IDs expiring.
• Export CSV: the filtered list, with identifiers masked; the export is recorded in the audit trail.

Accounts (/accounts) is the account register, searchable by account number or owner.

KYC status

Status	Meaning
Complete	Every required item is on file, no current ID has expired and no review is due
Incomplete	One or more required items are missing — the profile lists which
ID expired	The current document of at least one identification type has expired
Review due	Complete, but the periodic review date has passed

Required items are set per institution for individuals and organisations in Tenant settings.

The customer profile

A profile (/customers/{id}) shows KYC details — identity, identification documents with issue and expiry dates, addresses, phone and e-mail, PEP self-declaration, occupation, employer, business activity, expected turnover and purpose — plus accounts, the risk breakdown, screening, alerts and cases (for roles that may see them), transactions, related parties and the KYC history.

Numbers are masked. Reveal shows one in full and is recorded in the audit trail. Only reveal what you need.

4. Changing KYC on a live customer

KYC changes are governed: nothing changes on the customer until a second person approves.

1. On the profile, select Edit KYC details or Edit on a section (identity, documents, addresses, contacts, PEP self-declaration).
2. Enter the change and the Reason for the change. The approver sees it.
3. Select Send for approval. "Your change is sent for approval. It applies only when another authorised person approves it."
4. The approver opens KYC changes (/customers/kyc-changes) or My approvals, sees each field On file against Proposed with your reason, can use Review with AI for a checklist of what to verify, and selects Approve (step-up) or Reject with a decision note.
5. You can Withdraw a change until it is decided.

An approved change triggers re-screening. A field changed in FlowSentry is then locked against later updates from the core system, so the correction is not overwritten; the profile lists Fields maintained by FlowSentry. Return to source releases the lock, through the same approval.

See Propose and approve a KYC change.

5. Enhanced due diligence

A customer whose effective risk band becomes High gets an EDD case automatically.

1. Customers › EDD workbench (/risk/edd) lists cases as Open, Awaiting approval, Approved or Rejected.
2. Open a case and work the Checklist — source of funds, source of wealth, purpose and intended nature of the relationship, enhanced monitoring and any items your institution adds. For each, record the evidence seen and Mark complete.
3. Submit for approval.
4. A senior approver who did not submit it selects Approve relationship or Reject with a reason.

6. PEPs

• Customers declare PEP status during onboarding and on their profile (PEP self-declaration).
• Screening against PEP lists finds undeclared PEPs. A confirmed PEP match or a PEP designation feeds the risk rating; domestic PEPs are never rated below Medium.
• The PEP register (/screening/pep) holds designations of PEPs and their relatives and close associates, with periodic re-review of designations older than 12 months. Declassification is a maker-checker decision.

7. Information requests (relationship managers)

Investigators may ask you factual questions about your customers. They appear in Information requests (/requests) with a due date. Answer from what you know about the customer with Send answer; your answer is recorded with your name. You will not see why the question was asked — that is deliberate.

Warning: Never tell a customer that they are being looked at, or that a question came from compliance. Tipping-off is an offence.

8. Good practice

• Capture identifiers exactly as on the document; registers search on exact identifiers.
• Keep ID expiry dates current — expired IDs drive the ID expired status and the dashboard's expiring-ID figures.
• Give reasons an approver can verify ("New passport seen in branch on 10 October; copy attached") rather than "update".
• Use the Customer risk dashboard (/dashboards/customers) to plan reviews: overdue and due reviews, IDs expiring in 30, 60 and 90 days.

Related

• KYC reviewer, relationship manager and senior approver
• Run a customer risk review
• Screening and risk FAQ