Sampling KYC files without drowning in volume
A workable sample is not a census. Stratify by risk band, fix the window, and document why each file entered the sample.
AML walkthroughs fail when teams treat sampling as either a handful of favourite files or an impossible full review. Neither approach helps a compliance committee or an inspector understand how the programme behaves.
Stratify first
Split the population by the risk bands your own policy claims to use. If high-risk files are five percent of the book but zero percent of your sample, the walkthrough cannot speak to the control that matters most. Low-risk volume still deserves a smaller slice so reviewers can see that simplified due diligence is actually simplified — and still documented.
Fix the window and stick to it
Choose a period long enough to include periodic reviews and onboarding peaks, then freeze it. Expanding the window mid-fieldwork to chase nicer files undermines the credibility of the sample. Document the selection method in a one-page note attached to the worksheets.
Read for the decision, not the template
A complete checklist with a blank rationale for enhanced due diligence is a finding. Reviewers care whether a human judgment is visible. When we sit with compliance owners, we ask them to narrate the last decision they made on a high-risk file; the narration often reveals training needs faster than the form fields do.
Close the loop with dispositions
Pair KYC sampling with a small alert disposition sample from the same period. Patterns across both — missing source-of-funds notes, delayed escalations — tell a fuller story than either population alone.