TL;DR: Automating customer due diligence assigns CIP collection, screening, UBO resolution, risk rating, and the evidence pack to a workflow, and leaves source-of-wealth judgment, high-risk approval, and SAR suspicion with a named person. 1LoD's 2025 Financial Crime Benchmarking Survey found that 94% of the banks it covered still name high manual workload as the key operating challenge in AML and KYC. The four outcomes are settled. The desk that performs every step by hand is what breaks.
The Same Desk Does Both Jobs
Customer due diligence automation is an operating split. A workflow collects identifiers, runs screens, resolves an ownership chain, applies a written risk matrix, and assembles the pack a reviewer will read. A person judges whether wealth is explained, approves a high-risk relationship, and decides whether activity is suspicious.
Customer due diligence requirements for banks set the four outcomes. FinCEN's CDD rule requires procedures to identify and verify the customer, identify and verify beneficial owners of legal entity customers, understand the nature and purpose of the relationship well enough to build a risk profile, and monitor so the institution can report suspicious transactions and update customer information on a risk basis. FATF Recommendation 10 states the same four measures and tells each institution to set their extent according to risk.
The file breaks when those measures share one queue. The analyst who should test a source-of-wealth story is also pulling a registry extract, clearing a name that was never a match, and pasting excerpts into a memo. 1LoD's 2025 survey covered more than 25 Tier 1 and Tier 2 firms in the US, Europe, and Asia. For 60% of those banks, more than half of AML and KYC processes still depend on manual intervention. Fenergo's 2024 survey of 453 executives at banks with more than $50 billion in assets, in the UK, the US, and Singapore, put the average KYC review at 90 days. Among the US firms in that survey, 54% still ran 70% of corporate client onboarding by hand.
A faster screen inside that queue shortens one task. The memo still waits on facts that were never gathered into one place.
The Rules Name the Outcome
FinCEN and FATF specify what the file has to establish. The procedure belongs to the institution, and the depth follows risk.
Recommendation 10 applies at the start of a relationship, above USD 15,000 or EUR 15,000 for an occasional transaction or a wire under Recommendation 16, when suspicion arises, and when the institution doubts identification data it already holds. If the measures cannot be completed, the institution refuses the account, the relationship, or the transaction, or it exits, and it considers a suspicious transaction report. That refusal is a decision. The workflow's job is to show whether the file is complete before anyone makes it.
FinCEN guidance FIN-2020-G002 leaves the mechanics to the institution. The risk-rating method is the institution's to design, with enough detail to separate customers who share a category and still present different risk. A product or customer type named in government guidance can sit at any point on that scale. Customer information, including beneficial ownership, updates when monitoring surfaces a fact relevant to the risk, and the profile is reassessed under the institution's own procedures. A periodic calendar is available as a choice. The legal duty tracks the facts monitoring produces.
On February 13, 2026, FinCEN issued order FIN-2026-R001. Beneficial-owner identification and verification is required when a legal entity first opens an account, when facts reasonably call the earlier information into question, and when risk-based ongoing due diligence requires it. The order removes the duty to repeat that identification at every later account opening. Ongoing monitoring, and updates on a risk basis, remain. An unchanged ownership pull on every new product is assembly. Rebuilding the chain when the facts move is the control.
Five Steps a Workflow Can Close
Five pieces of the file have a checkable output. A written procedure, a source, and a definition of done are enough to close them. A person enters when the output is a conclusion the procedure cannot make.
CIP collection ends when the identifiers are stored and any failed field has gone back to the applicant. Screening ends when a non-match closes under a written rule because date of birth, nationality, or an identifier conflicts. A plausible match stays open, with the list entry attached.
UBO identification asks whether a natural person meets the ownership test or the control test. The ownership prong is each individual who directly or indirectly owns 25% or more, and the control prong is one individual with significant responsibility to control, manage, or direct the entity. Where a trust holds 25% or more, the ownership prong names the trustee. The workflow calculates indirect percentages from registry extracts and ownership documents, and it stops when the terminal is still a company, a trust with no named trustee, or a chain with no control person.
Customer risk rating applies the factors the policy writes down: geography, product, ownership opacity, screening outcome, and expected activity. FinCEN leaves the method to the institution, so the matrix version is stored beside the tier. A changed input during monitoring rescores the profile. A high tier routes to a person with approval authority.
The evidence pack lines those results up so a reviewer can replay the file. A note that says the registry was checked fails the record FinCEN expects, which is a description of what the institution relied on.
Credibility, Approval, and Suspicion
Three outputs carry a name. The workflow can gather the materials. The conclusion belongs to a person the policy can identify later.
Source-of-wealth judgment is the first. Recommendation 10 places source of funds, where necessary, inside ongoing due diligence, and the interpretive note lists source of wealth among the enhanced measures for higher-risk relationships. The workflow can request statements, sale agreements, and filings, and it can log what is missing. Whether those records explain the wealth is the analyst's conclusion, attributed by name.
High-risk approval is the second. Enhanced due diligence starts when the tier, a PEP determination, or another trigger says standard measures are too thin. FATF Recommendation 12 requires senior management approval to establish or continue a relationship with a foreign PEP, together with reasonable measures on source of wealth and source of funds. The interpretive note to Recommendation 10 lists that same senior approval among enhanced measures for higher-risk relationships. The workflow routes the file, attaches the pack, and records the trigger. Acceptance is the act the named senior person records.
SAR suspicion is the third. Monitoring can surface activity outside the stated purpose, a screen left unresolved, or a customer who will not name a beneficial owner the rule requires. Suspicion is the institution's determination that the activity meets the threshold for a report, including the Recommendation 10 case in which due diligence cannot be completed and the relationship should stop. The workflow opens the case. An investigator decides.
Two Paths Out of One File
Design the split before automating a step. A new system on an undifferentiated queue leaves the 90-day review in place and adds software around it.
The straight-through path is a file the procedure can close. CIP is complete. Screening cleared under a written rule. Ownership resolves to natural persons and a control person, which is the work of UBO mapping automation when the chain runs through holding companies. The tier sits in the band policy allows to proceed on standard measures. The pack has no open items. That file goes unread. Policy still samples closes, by tier and by product, so an exam can see that the auto-close was tested. The institution owns the procedures on both paths.
The exception path is the rest of the book. An open screen. A chain that stops short of a natural person. A high tier, a foreign PEP, or a source-of-wealth request. A fact that calls prior beneficial ownership into question under FIN-2026-R001. The person receives the pack, the item that stopped the file, and the rule that stopped it.
Three patterns refill the queue. A model that declares wealth credible, accepts a high-risk relationship, or files a report has taken a determination the standards attach to people. Automating only the screen, while CIP still lives in a separate inbox, sends the analyst hunting across systems for one fact. A calendar refresh of every unchanged customer misses the trigger FIN-2020-G002 describes: a new controller, activity outside the profile, or information that undermines the ownership certification.
Where Sphinx Fits
Sphinx runs those five steps under the institution's own procedures and writes each result so the file can be replayed. Teams using Sphinx have seen 87% fewer false positives, an 80% reduction in case review time, and 98% of cases resolved the same day, including six-month backlogs cleared in days. Source-of-wealth judgment, high-risk approval, and SAR suspicion stay with the institution's people.
Frequently Asked Questions
What does it mean to automate customer due diligence?
Automating customer due diligence means a workflow finishes the steps with a checkable output, and a named person keeps the judgments. CIP collection, screening, UBO resolution, risk rating, and the evidence pack sit on the workflow side. Source-of-wealth credibility, high-risk approval, and SAR suspicion sit with the institution's people.
Which CDD steps can close without an analyst?
A workflow can collect CIP identifiers and retry failed fields, clear screening hits that cannot be the same person under a written rule, resolve ownership to natural persons at the 25% line plus one control person, apply a written risk matrix, and assemble the evidence pack. A plausible screen, a chain that stops at another company, or a high tier stops that path and routes the file.
Which CDD decisions should stay with a person?
Source-of-wealth judgment, approval of a high-risk or foreign-PEP relationship, and the suspicion behind a SAR stay with a named person. FATF Recommendation 12 requires senior management approval for a foreign PEP, and Recommendation 10 requires the institution to refuse or exit a relationship it cannot diligence and to consider a report. The workflow can gather the documents. The conclusion is attributed to someone.
Does FinCEN require a fresh beneficial-ownership check at every new account?
Order FIN-2026-R001, issued February 13, 2026, limits that identification and verification to three points: the first account a legal entity opens, any later moment when facts reasonably call the earlier information into question, and whatever risk-based ongoing due diligence requires. Ongoing monitoring, and the duty to update customer information on a risk basis, remain in place.
Can a low-risk file close without anyone reading it?
A file can close unread when CIP is complete, screening clears under a written rule, ownership resolves, the tier sits in the band policy allows for standard measures, and the pack has no open items. Policy should sample those closes by tier and product. A high tier, a foreign PEP, incomplete due diligence, or an open screen routes to a person.
.png)
