A signed AML questionnaire: why the case still needs review

Draft date: 8 November 2026. Author: Kyclara Editorial Team.

A completed and signed anti-money laundering questionnaire collects the client's statements; it does not automatically complete customer due diligence. The operator must check relevant information, resolve inconsistencies and document the assessment under applicable rules. “Submitted by the client” and “reviewed by the intermediary” are different statuses and should remain recognisable in the file.

This guide concerns the organisation of AML/KYC work. It does not establish which checks suffice for an individual relationship or replace the intermediary's procedures. The relevant legislation and competent authority's provisions must be identified according to the obliged entity and its activity: a portal does not resolve that classification independently.

Distinguish formal completeness from verified content

An initial check can establish whether required fields have been completed and requested attachments are present. This helps avoid empty or unreadable submissions. It does not demonstrate that an answer is correct, that a document belongs to the identified subject or that the information is mutually consistent.

A content review stage is therefore needed. If a client declares an economic activity but describes an incompatible relationship purpose, another mandatory box does not resolve the problem. The reviewer's note should identify the inconsistency and the enquiry needed to understand it, without turning every discrepancy into a finding of wrongdoing.

Check who is making the statements

For a company, identify the role of the person completing the form and their connection to the client. The person uploading a document may be an assigned employee, while the statement must come from the person required by the procedure. Access to an email account alone does not demonstrate representation powers or identity.

If the process uses a one-time code, document what that step actually records. Do not call it a qualified signature unless it meets the required characteristics. Electronic signing and identity verification are related but distinct questions; an assessment of the signing method does not remove other checks required for due diligence.

Connect each uncertainty to its source

When an inconsistency emerges, identify the answers or documents concerned. “Information needs correcting” does not help the recipient and may generate irrelevant additions. A precise request explains which point requires clarification without suggesting an answer the client should repeat to secure acceptance.

Keep the initial information separate from its correction. A legitimate correction should improve the file without erasing why it was requested. Record the date and updated document under applicable retention rules. There is no need to expose the complete history to people who have no reason to access it. Access arrangements should allow authorised reviewers to follow the change while protecting the rest of the client's information.

Treat the score as an input for assessment

A risk indicator depends on the information entered and the configured method. If an answer is wrong or missing, the result may mislead. The reviewer should be able to reconstruct the contributing factors and identify relevant circumstances not represented by the indicator. A low number does not cure incomplete identification.

Procedures must establish who makes the decision and when further enquiry is needed. If someone departs from an assessment suggested by the system, the reasons should explain the evidence considered. “Manual assessment” alone is insufficient explanation. Equally, accepting a system suggestion does not remove the need to check its relevance to the file.

An entirely fictional example

The imaginary intermediary “Selva Gestioni” receives a complete questionnaire. Its corporate client declares a simple ownership structure, but an attachment describes an intermediary company absent from the answers. The portal has correctly collected the fields and signing code; the inconsistency still requires examination.

The operator seeks clarification of the ownership chain and links the additional information to the original statement. The competent function then assesses the updated file and records its reasons. This example does not suggest that a particular addition suffices in every case: it shows why collecting a questionnaire should not be confused with completing the review.

Define the outcome and outstanding activities

At closure, state what was checked and any limitations. If necessary information is missing, apply the rules in the applicable framework and procedure rather than marking the file “approved” merely to clear a work queue. An operational difficulty does not change the content of the obligations.

Also specify when the file should be revisited and who will receive relevant events in the meantime. Maintaining the relationship may require updates: initial verification does not keep documents and statements current indefinitely. Frequency must be determined in context rather than imposing the same interval for everybody here. A new piece of information should be routed to the appropriate reviewer even if the scheduled review date has not yet arrived.

Sources and limitations

The Bank of Italy's customer due diligence provisions are a primary source for their respective addressees; they are not automatically extended to every professional. The UIF describes the Italian AML framework, in which understanding a client involves activities beyond collecting a form.

Electronic form requires assessment of the eIDAS Regulation, EU 910/2014, in its applicable version, without equating all signatures. This guide does not assess the validity of an individual signature or advise on opening a relationship. The chosen process must be examined alongside the rest of the identification and review arrangements.

To compare this method with a workflow separating client submission from operator review, you can view Kyclara.