Why KYC Delays Cost More Than Compliance Time
Slow onboarding now loses business. A Fenergo study of 600 senior executives, reported by Fintech Global on 8 October 2025, found that 70% of firms had lost clients to slow onboarding. That is up from 67% in 2024 and 48% in 2023. The sample covers banks, asset managers and fund administrators, not insurers, so treat it as a signal rather than an insurance benchmark.
The pattern will be familiar to you. Every MGA, coverholder or broker you add to your distribution chain waits on the same checks: company verification, ownership, screening, signed terms. If your process depends on email and spreadsheets, each new relationship adds to the queue. Speed to market suffers, and so does the quality of the record you can show a regulator or capacity provider.
This post sets out where the time goes in KYC, what regulation 28 of the Money Laundering Regulations 2017 requires and does not require, five common inefficiencies in insurance, and a practical way to fix them.
Where the Time Goes in KYC
Most KYC delay is not analysis. It is administration. Four patterns account for much of it.
The first is document chasing by email. Someone requests certificates, ownership details and declarations, then waits, reminds and re-requests. The second is rekeying. The same company name, registered number and director details are typed into a CRM, a spreadsheet and a screening tool, and each copy can drift out of step with the others.
The third is repeat requests. An MGA that holds capacity or distribution relationships with several principal firms often receives near-identical due diligence requests from each one. The MGA answers the same questions several times, and each principal firm builds its own file. The fourth is scattered results. Sanctions, PEP and adverse media checks sit in separate tools, so nobody sees one consolidated view of a counterparty.
The cost is measurable, although not for insurers. Fenergo’s 2023 research, reported by Corporate Compliance Insights on 17 November 2023, found that an average corporate KYC review took 95 days globally, up from 84 days, and cost $2,598. That study covered more than 1,100 bank executives. We have not found a comparable published figure for insurance firms, so we do not extrapolate one here. Your own data will be more useful: time how long a typical broker or MGA takes from first request to approved, and count how many people touch the file.
If you want a baseline for what a complete check involves, the KYB and KYC checklist guide lists the standard steps. Once you know what the process is meant to include, it is easier to see which steps are repeated for no reason.
What the Rules Require, and What They Do Not
Regulation 28 of the Money Laundering Regulations 2017, as published on legislation.gov.uk, sets out the customer due diligence measures that firms in scope must apply. The firm must identify and verify the customer. It must understand the purpose and intended nature of the business relationship. Where the customer is a company, it must understand the ownership and control structure and identify the beneficial owners.
Regulation 28(11) adds ongoing monitoring of the relationship. That includes keeping the documents, data and information obtained for due diligence up to date. This is the point many firms miss. A file that was complete at onboarding is not compliant if it is stale two years later.
Regulation 28(12) then says the extent of the measures should reflect the firm’s own risk assessment. Whether the regulations apply to a particular insurance activity depends on the firm and the business it writes, so check your own scope with your compliance function or advisers.
The practical point is straightforward. The rules require risk-based checks that are kept current. They do not require every counterparty to be handled the same way, by the same people, through the same manual steps. Uniform manual processes are a choice about how to meet the requirement, not part of the requirement itself.
Five Common KYC Inefficiencies in Insurance
1. Checking everyone to the same depth regardless of risk
A long-standing, UK-regulated broker with a simple ownership structure gets the same questionnaire as a new overseas coverholder with layered ownership. Reviewers spend equal time on both, so the high-risk case gets no more attention than the low-risk one, and the low-risk case is slower than it needs to be. Regulation 28(12) points the other way: depth should follow risk.
2. Document collection by email with no shared record
Documents arrive as attachments, get saved to a shared drive or an inbox folder, and are tracked in a spreadsheet. Nobody can say with confidence which version is current or when it expires. When an audit or a capacity provider review comes, the team spends days reconstructing evidence that should already exist in one place.
3. Duplicated onboarding across principal firms
The same MGA or broker completes broadly the same due diligence for several partners. Each principal firm repeats the effort, and the counterparty experiences your onboarding as friction. In a competitive distribution market, that friction can decide who gets the business first.
4. Periodic reviews on a fixed calendar
An annual or three-yearly review means information goes stale between reviews. A director change, a sanctions designation, a PEP link or a piece of adverse media can appear the week after a clean check and stay unseen for months. Continuous PEP and sanctions screening closes that gap, because it shifts the trigger from the calendar to the event.
5. No single view of status
If you cannot see in one place which counterparties are verified, which are overdue and which have open issues, you cannot evidence oversight. That matters when the FCA or a capacity provider asks for management information, and it matters internally when you need to decide where to spend limited headcount.
How to Fix KYC Inefficiencies
The fix is to design the process around risk and reuse rather than around volume. Five changes do most of the work.
Tier by risk. Define what a low, medium and high-risk counterparty looks like in your risk assessment, and set the depth of checks for each. This is what regulation 28(12) expects, and it frees reviewer time for the cases that need it.
Keep one shared counterparty record. Hold identity, ownership, screening results and documents against a single record that everyone works from. That removes rekeying and gives you the single source of truth you need for audit.
Collect once and reuse. Ask the counterparty for information once, store it with an expiry, and reuse it for later checks. Where a counterparty is already known to a wider network, you should not need to start from zero.
Move from periodic to continuous monitoring. Replace calendar reviews with alerts on sanctions, FCA status, director changes and financial deterioration. This is the proactive model: you act when something changes, not when the review date arrives.
Keep an audit trail. Record who checked what, when and on what basis, so you can evidence outcomes to a regulator without reconstruction.
Technology can carry much of this. REG Network supports counterparty onboarding, KYC and KYB checks and AML screening, and provides ongoing monitoring with alerts. REG Exchanges handles secure document exchange, signatures and renewals, so documents are collected once and tracked centrally. REG Risk 365 supports structured counterparty risk assessments, so the tiering described above can be configured and applied consistently. None of this removes your responsibility for compliance decisions. It reduces the manual work around them and makes the evidence easier to produce. If manual handling is the main pressure on your team, see how REG approaches manual compliance processes.
KYC inefficiency is mostly process design, not regulatory demand. Regulation 28 asks for risk-based checks that are kept up to date, and it does not ask you to repeat the same manual steps for every counterparty. The cost of getting this wrong is real: slower speed to market, information that goes stale between reviews, and weak evidence of oversight when a regulator or capacity provider asks for it. Start by mapping where checks repeat across your onboarding, then move to risk-based tiering and continuous checks, and build compliance into onboarding rather than adding it afterwards.
