1Tell me about yourself.

Keep it to about a minute and make it relevant. Cover your education or background, what drew you to compliance, any training you have completed, and what you are looking for now. Do not narrate your whole life — end on why you are sitting in this interview.

2Why do you want to work in KYC?

Give a real reason grounded in the work itself — the investigative element, the responsibility of getting it right, the fact that it protects the financial system. Avoid "it is a growing field with good opportunities", which says nothing about you.

3You have no KYC experience. Why should we hire you?

Answer directly, then pivot to evidence. Name the transferable strengths — attention to detail, working to procedure, handling documents accurately, written clarity — and back each with a concrete example. Then mention any KYC training you have done. Confidence without overclaiming is what lands here.

4What do you know about our company?

Do the research beforehand. Know what they do, which markets they operate in, and something recent — a product launch, an acquisition, a regulatory development. Being unable to answer this is one of the most common entry-level failures.

5What does a KYC analyst actually do day to day?

Reviews new customer applications and documents, verifies identity, checks ownership structures for companies, runs screening for sanctions, PEP and adverse media, assesses customer risk, and completes periodic reviews of existing customers. Say this in your own words rather than reciting a job advert.

6How did you prepare for this interview?

Be specific — the training you completed, the topics you studied, the practice you did. Vague answers suggest you did not prepare much. This question rewards honesty about effort.

7Where do you see yourself in three years?

Show ambition inside compliance rather than through it. Senior analyst, EDD specialist, or team lead are all good answers. Saying you want to move into a different department suggests you see this as a stepping stone.

8Are you comfortable with repetitive work?

Be honest that the work is detailed and repetitive, and explain how you stay accurate — process discipline, checklists, treating each file fresh. Claiming you find repetition exciting sounds false; showing you have a method sounds credible.

9What is your greatest weakness?

Name a real one with what you are doing about it. "I can be slow when I am learning something new, so I take notes and build my own reference sheets" is honest and shows self-awareness. Avoid the fake weakness of being a perfectionist.

10Why did you choose compliance over your degree subject?

Connect the two if you can — law, commerce, statistics and languages all transfer. If there is no connection, say plainly what attracted you to the field. Career changers are normal in compliance and interviewers know it.

11What training or certification have you done?

Name it, and more importantly say what you learned and can apply. A certificate alone means little; being able to describe a KYC workflow you practised means a lot.

12How do you handle being corrected?

Say you expect it at entry level and welcome it, and give an example of feedback you acted on. Quality assurance is built into KYC work, so someone who takes correction badly is a poor fit.

13Are you willing to work shifts or support other regions?

Answer honestly. Many KYC operations run extended hours to cover global markets. If you can, say so clearly; if you cannot, say what you can do rather than agreeing and withdrawing later.

14What are your salary expectations?

Research the entry-level range for that market first and give a realistic band rather than a single figure. At fresher level, showing you have researched sensibly matters more than negotiating hard.

15What is KYC?

Know Your Customer — the process of verifying who a customer is, understanding their activity, and assessing the risk they present. It is a regulatory requirement and the foundation of a financial institution's defence against financial crime.

16Why do banks perform KYC?

To comply with anti-money laundering law, to prevent criminals using the bank to launder money or finance terrorism, and to understand their customers well enough to spot activity that does not fit.

17What is AML and how does it differ from KYC?

AML — anti-money laundering — is the broader framework for preventing and detecting money laundering. KYC is one part of it, focused on identifying and understanding customers. KYC answers who; AML covers what they do and how it is detected.

18What is money laundering?

Disguising the origins of money obtained through crime so it can be used as if legitimate. The underlying crime is called the predicate offence.

19What are the three stages of money laundering?

Placement, where illicit funds enter the financial system; layering, where transactions obscure their origin; and integration, where the money returns as apparently legitimate wealth.

20What is terrorist financing and how does it differ?

Providing funds for terrorist purposes. It differs because the money may be legitimately earned, and amounts are often small — so the concern is the intended use rather than the origin.

21What is FATF?

The Financial Action Task Force, the international body that sets AML and counter-terrorist-financing standards through its Recommendations, evaluates countries, and maintains the grey and black lists.

22What is a regulator, in this context?

The authority supervising financial institutions in a jurisdiction and enforcing AML rules — for example the FCA in the UK, FINTRAC in Canada, MAS in Singapore. Know the one relevant to the role you are applying for.

23What is the KYC lifecycle?

Onboarding, where the customer is identified and verified; ongoing monitoring of activity; periodic review to refresh information; and offboarding when the relationship ends. KYC is continuous, not a one-off check.

24What is CIP?

The Customer Identification Programme — the minimum requirement to collect and verify identifying information before opening an account, typically name, date of birth, address and an identification number.

25What is onboarding?

The process of taking on a new customer — collecting information and documents, verifying identity, screening, assessing risk, and approving the relationship before the account becomes active.

26What is a periodic review?

A scheduled refresh of an existing customer's information to confirm it is still accurate and that their activity remains consistent with what is known. High-risk customers are reviewed more often than low-risk ones.

27What is remediation?

A project to bring existing customer files up to current standards, usually because past records were incomplete or rules changed. Many freshers start in remediation because it is high-volume, structured work.

28What is KYB?

Know Your Business — applying KYC to corporate customers, which involves verifying the entity itself, its ownership structure and its beneficial owners rather than just one individual.

29Who is a beneficial owner?

The natural person who ultimately owns or controls a company, commonly defined as holding above a set ownership threshold, or exercising control by other means. The point is to identify the real human behind the entity.

30What is a UBO?

The Ultimate Beneficial Owner — the person at the top of an ownership chain, identified after tracing through any intermediate companies. Complex structures exist partly to make this difficult.

31What is a shell company?

A company with no real operations or employees. Shell companies have legitimate uses, but they are also used to obscure ownership, which is why they attract additional scrutiny.

32What is source of funds?

Where the specific money in a transaction or account came from — a salary payment, a property sale, a business receipt. It concerns the particular funds, not overall wealth.

33What is source of wealth?

How the customer accumulated their overall assets — career earnings, business ownership, inheritance, investments. It is broader than source of funds and harder to evidence.

34What is a SAR?

A Suspicious Activity Report — a confidential report filed with the national financial intelligence unit when there is reasonable suspicion of financial crime. It reports suspicion, not proof, and the decision to file sits with the MLRO.

35What documents verify an individual's identity?

Government-issued photo identification such as a passport, national ID card or driving licence. Requirements vary by jurisdiction, and the firm's policy defines what is acceptable.

36What documents verify an address?

Recent utility bills, bank statements, tax correspondence or government letters — usually issued within a defined recent period. Mobile phone bills are often excluded.

37What documents would you need for a company?

Certificate of incorporation, constitutional documents, proof of registered address, register of directors and shareholders, ownership structure, and identification for directors and beneficial owners.

38How would you check whether a document is genuine?

Verify security features, check that fonts, spacing and layout are consistent, confirm the document is within validity dates, cross-check details against other documents, and where possible verify against the issuing source or a registry.

39What would make you suspect a forged document?

Misaligned text, inconsistent fonts, poor image quality, altered dates, mismatched details between documents, missing security features, or a document that does not match the format used by that issuer.

40What do you do if you suspect a document is forged?

Do not accept it and do not accuse the customer. Escalate to a supervisor with the specific concerns documented. A suspected forgery may itself require a suspicious activity report, which is not an analyst-level decision.

41What is a certified copy?

A copy confirmed as a true likeness of the original by an approved person such as a notary, lawyer or bank official, with their name, position, signature and date. Requirements are set by policy.

42What is an expired document — can you accept it?

Generally no for identity verification. An expired passport does not evidence current identity. The customer should provide a valid document, and exceptions require approval.

43What if the customer's name differs across documents?

Establish why — marriage, transliteration, name order conventions, or a legal name change. Obtain supporting evidence such as a marriage certificate or deed poll, and document the explanation rather than assuming.

44What is electronic identity verification?

Verifying identity against electronic data sources or through digital document and biometric checks rather than physical documents. It is increasingly common for remote onboarding.

45What is liveness detection?

A check confirming a real person is present during a digital verification, rather than a photograph or recording being held to the camera. It protects against a common form of impersonation.

46Why is remote onboarding higher risk than face to face?

Because you cannot inspect original documents or observe the person directly, which makes impersonation and document fraud easier. It is why electronic verification and liveness checks matter.

47What is a corporate registry and how is it used?

An official register of companies in a jurisdiction. It is used to verify a company exists, confirm directors and shareholders, and check filings against what the customer has told you.

48What if a registry shows different directors than the customer declared?

Query it rather than assume dishonesty — registries can lag recent changes. Ask for supporting documentation of the change and document the reconciliation.

49What is a document checklist and why does it matter?

A list of what must be collected for each customer type. It matters because it ensures consistency and completeness, and evidences that the process was followed.

50What would you do if a document was missing?

Request it from the customer or the relationship manager, record the outstanding item, and do not complete the file as though it were satisfied. Incomplete files that are marked complete are a serious quality failure.

51What is CDD?

Customer Due Diligence — the standard checks applied to all customers: identifying and verifying them, identifying beneficial owners, understanding the purpose of the relationship, and monitoring on an ongoing basis.

52What is EDD?

Enhanced Due Diligence — deeper scrutiny applied to higher-risk customers, adding source of wealth and source of funds verification, more information gathering, senior management approval and closer monitoring.

53What is SDD?

Simplified Due Diligence — reduced measures permitted for demonstrably low-risk customers in some regimes. It reduces the depth of checks but never removes the obligation entirely.

54When is EDD required?

For higher-risk situations — politically exposed persons, customers in high-risk jurisdictions, complex or unusually large transactions, correspondent banking, and any relationship the firm rates high risk.

55What is the risk-based approach?

Applying controls in proportion to risk rather than treating every customer identically — more scrutiny where risk is higher, less where it is lower. It is the principle underpinning modern AML regulation.

56What factors determine customer risk?

Who the customer is, the countries involved, the products and services used, and how the relationship was established — for example remotely versus in person.

57What makes a customer higher risk?

PEP status, links to high-risk jurisdictions, cash-intensive business, complex or opaque ownership, adverse media, or activity that does not match their stated profile.

58Is a cash business automatically suspicious?

No. Many legitimate businesses handle large amounts of cash. It raises inherent risk and warrants closer attention, but it is not evidence of wrongdoing on its own.

59What is a customer risk rating?

The score or category assigned to a customer — typically low, medium or high — reflecting assessed money laundering risk. It determines the depth of due diligence and the frequency of review.

60What would cause a risk rating to change?

A change in ownership or control, a move into a higher-risk country or sector, adverse media, PEP status, or transaction behaviour inconsistent with the profile.

61What is the purpose of asking about expected account activity?

It establishes the baseline against which future behaviour is measured. Without knowing what is expected, it is impossible to identify what is unusual.

62What is a nature and purpose statement?

The record of why the customer wants the account and how they intend to use it. It should be specific enough to be useful — "business banking" alone tells you nothing.

63What is a high-risk jurisdiction?

A country with weak AML controls, on FATF's grey or black list, subject to sanctions, or otherwise assessed as higher risk. Dealings involving them require additional scrutiny.

64What is a PEP?

A politically exposed person — someone holding or having held a prominent public function. PEP status is not an accusation; it means the relationship carries higher corruption risk and requires enhanced measures.

65Can a PEP be refused an account just for being a PEP?

Refusing solely on PEP status is discouraged, because blanket de-risking excludes legitimate customers. The correct approach is enhanced due diligence, senior approval and closer monitoring.

66Who are relatives and close associates?

Family members and close business or personal associates of a PEP. They are screened because funds are often moved through them rather than through the PEP directly.

67What is screening?

Checking customers and related parties against sanctions lists, PEP data and adverse media sources to identify risk before and during the relationship.

68What are sanctions?

Restrictive measures imposed by governments or international bodies against countries, entities or individuals — including asset freezes and prohibitions on dealing with designated parties.

69What happens if a customer matches a sanctions list?

The transaction is held and the match escalated immediately. Sanctions breaches carry severe penalties, so an unresolved match is never released — the safe action is always to stop and escalate.

70How does a sanctions match differ from a PEP match?

A sanctions match is a legal prohibition requiring blocking. A PEP match is a risk indicator triggering enhanced due diligence. Confusing the two is a common entry-level error.

71What is a false positive?

A match generated by someone who is not actually the listed person — usually because names are similar. Resolving them is a large part of an analyst's daily work.

72How would you resolve a possible name match?

Compare identifiers — full name, date of birth, nationality, occupation, address. If they clearly point to different people, document the discount with reasoning. If the data is insufficient, escalate rather than assume.

73What is adverse media screening?

Searching news and public sources for negative information about a customer — investigations, charges, convictions or regulatory action — that no list would capture.

74Does negative news automatically mean rejecting a customer?

No. You assess whether it is genuinely the same person, whether the source is credible, and whether the matter is material. Reacting to any negative article is as wrong as ignoring all of them.

75Why is screening repeated after onboarding?

Because circumstances change — someone can be sanctioned, become a PEP, or appear in adverse media at any time. A one-off check at onboarding would miss all of it.

76Who is screened besides the account holder?

Beneficial owners, directors, authorised signatories and, in higher-risk cases, connected parties. Risk frequently sits behind the named customer rather than with them.

77Why do screening systems produce so many false positives?

Because matching relies heavily on names, and lists often lack the identifiers needed to discriminate. Common names and transliteration variants generate large volumes of noise.

78What is transaction monitoring?

Ongoing review of customer transactions to identify activity that may indicate financial crime. KYC establishes what is expected; monitoring tests what actually happens.

79How do you ensure accuracy in detailed work?

Follow a consistent order, use checklists, verify against source documents rather than memory, and re-check before submitting. Describe an actual method rather than saying you are "very detail-oriented".

80How do you manage a heavy workload?

Prioritise by risk and deadline, work systematically rather than jumping between files, and flag early if volumes are unmanageable. Silently falling behind is worse than raising it.

81What would you do if you did not know the answer to something?

Check the procedure first, then ask a colleague or supervisor. Guessing is the wrong instinct in compliance, and asking sensible questions is expected at entry level.

82What is quality assurance in KYC?

Independent checking of completed files to confirm decisions were correct, consistent and properly documented. Your work will be sampled, which is normal rather than a sign of distrust.

83What makes a well-documented KYC file?

Complete information and documents, clear evidence of verification, a reasoned risk assessment, screening results and their resolution, and notes another reviewer could follow without redoing the work.

84Why is documentation so important?

Because regulators assess what is recorded, not what was thought. If the reasoning is not written down, it is treated as though it never happened.

85What is an SLA in KYC operations?

A service level agreement — the agreed timeframe for completing a file or review. Meeting SLAs matters, but never at the cost of completing checks properly.

86How do you handle confidential information?

Access only what is needed, never discuss customer details outside authorised channels, keep screens and documents secure, and follow the firm's data policies. Confidentiality breaches are treated very seriously.

87What is tipping off?

Telling a customer that a suspicious activity report has been made or is being considered. It is a criminal offence in most jurisdictions, so staff must follow approved wording when customers ask about delays.

88How would you keep learning once in the role?

Reading internal procedures and updates, following regulator publications and enforcement notices, asking questions on complex files, and continuing formal training. Compliance changes constantly.

89A customer's utility bill shows a different address from their application. What do you do?

Query the discrepancy rather than choosing one. Ask for clarification and supporting evidence — they may have recently moved. Document the explanation and the document that resolved it. Never quietly amend the record to make it match.

90A relationship manager asks you to approve a file quickly because the client is important. What do you do?

Complete the checks properly and explain that the process cannot be shortened. Commercial importance does not change the requirements. If pressure continued, I would raise it with my supervisor and document it.

91You realise you made an error on a file you completed last week. What do you do?

Report it immediately so it can be corrected. Concealing an error turns a fixable mistake into an integrity issue, and compliance teams judge people on how they handle errors rather than on never making them.

92A company's ownership structure runs through three countries and you cannot identify the UBO. What do you do?

Keep tracing as far as the available records allow, use corporate registries, and request the structure chart and supporting documents from the customer. If the ultimate owner still cannot be identified, escalate — an unidentifiable UBO is itself a risk indicator, not a reason to proceed.

93A customer becomes angry about the documents you are requesting. How do you handle it?

Stay calm, explain that the requirements are regulatory and apply to everyone, and be clear about exactly what is needed so they are not asked repeatedly. If it escalates, involve a supervisor rather than compromising on the requirement.

94You notice something unusual but you are not sure it matters. What do you do?

Raise it. At entry level nobody expects you to make the final judgement, and the cost of asking is far lower than the cost of missing something. Document what you observed and escalate.

95Your colleague asks you to share your system login because theirs is not working. What do you do?

Refuse and suggest they contact IT. Sharing credentials breaches security policy and destroys the audit trail that shows who made each decision. This is a test of integrity, not helpfulness.

96What do you find most interesting about KYC?

Answer genuinely — many people cite the investigative side of tracing ownership structures, or the variety of businesses and countries you encounter. Specific interest is more convincing than general enthusiasm.

97What do you think will be the hardest part of this job for you?

Give an honest answer with a plan — for example the volume of new terminology, and how you intend to build your own reference notes. Claiming nothing will be difficult sounds naive at entry level.

98Are you applying elsewhere?

Be honest without oversharing. It is normal to be applying to several roles; what matters is showing genuine interest in this one.

99How soon can you start?

Give your real availability including any notice period. Do not promise an immediate start you cannot deliver.

100Do you have any questions for us?

Always have two or three ready. Good ones: what a typical day looks like, how new joiners are trained, what the team structure is, how performance is measured, and what progression looks like after the first year. Never say you have no questions.