Drawing KYC samples that survive a supervisory question

Supervisors rarely ask whether you tested “some” files. They ask how you chose them. In our AML and KYC control reviews, the population frame is the first deliverable after kickoff — not an afterthought once fieldwork has already started.

Start with the frame, not the folder

Ask operations for a complete list of customers onboarded or reviewed in the period, with risk rating, product, and corridor. If that list cannot be produced, the finding is about record-keeping before any file is opened. We have paused more than one engagement until a usable frame appeared.

Stratify where risk differs

A flat random sample across all retail wallets and corporate remittance senders usually under-tests the higher-risk segment. We agree strata in the scoping memo: for example, high-risk corporates, politically exposed persons if present, and a general retail remainder. Sample sizes are stated up front so compliance can plan evidence rooms.

When extracts arrive late

Late populations compress testing days. We document the delay in the management letter’s limitations section rather than silently shrinking the sample. Boards deserve to know whether the observation set rests on a full or truncated period.

If you are preparing for a licensing readiness audit, treat the population extract as day-zero homework — it saves more calendar time than polishing policy wording.