A trust office that did not know how many files fell short

By Mitchell Zandwijken · 10 September 2026 · KYC remediation, UBO, trust office

Example case — not an existing client. This case was written to show how we work. The situation is assembled from patterns we encounter at comparable institutions; the organisation, the figures and the outcomes are illustrative and do not trace back to any client of ZandKade Compliance. The amounts match our published rates.

A trust office had acquired a portfolio from a firm that closed and managed 1,400 files across three systems. An internal audit reported that file quality fell short, but nobody knew how much. We started with a baseline on 120 files, used it to segment the portfolio down to 620 files that genuinely needed remediation, and completed those in five months — with decision rules fixed in advance, so the outcome did not vary by colleague.

Type of institution: Licensed trust office, 22 FTE
Portfolio: 1,400 client files across three systems, partly acquired
Supervisor: De Nederlandsche Bank
Trigger: Internal audit finding plus an acquired portfolio
Duration: 5 months, including three outreach waves
Client's own effort: One relationship manager per client group, around 8 hours a week
Investment: Baseline € 1,950; then € 95 per standard file and € 240 per file requiring enhanced due diligence, project minimum € 7,500 — fixed price, no additional billing

Need help with this? In a free thirty-minute call we look at your situation with you. Book a call or ring +31 6 11 32 53 62.

Contents

The situation
The baseline: know before you start
Segmentation: from 1,400 to 620
Decision rules before the first file
Three outreach waves
The outcome
What you can take from this
Duration and investment
Questions that come up

The situation

Two years earlier the office had taken over the portfolio of a firm that was closing down. The acquisition brought clients, revenue and files — and another firm's file standard. On top of that, its own files sat in two different systems, a legacy of a software migration that had stalled halfway.

Internal audit reported that file quality fell short. What it could not say was how big the problem was. That is the point at which most remediation programmes go wrong: the board feels compelled to "redo everything", because nobody can point at what is in order. Redoing everything at 1,400 files is a year-long programme and a multiple of the budget.

The baseline: know before you start

We first assessed a sample of 120 files, stratified across the three systems, across acquired and own clients, and across the risk classes the office used. That is enough for a reliable picture per group and few enough not to spend months on it.

Finding in the sample	Share	Weight
No current record of the ultimate beneficial owner	41%	Heavy — goes to the core of due diligence
Purpose and intended nature of the relationship not recorded	23%	Heavy — determines whether monitoring means anything
PEP status never checked	12%	Heavy — a hit triggers enhanced due diligence
Expired identity document without reassessment	7%	Medium — fixable with one contact
Risk classification present but not substantiated	34%	Medium — needs recording, not new investigation

The percentages add to more than a hundred because files had several shortcomings. More important than the figures was the pattern: acquired files scored worse on every point, and within the office's own files the problem sat almost entirely with relationships predating the system migration.

Segmentation: from 1,400 to 620

620 files for full remediation. All acquired relationships plus own relationships from before the migration: re-request information, establish the UBO, record purpose and nature, substantiate the risk class.
310 files for targeted completion. Essentially complete, but missing a record that could be resolved without contacting the client — a classification that had been made but not justified, for instance.
470 files, no action. Opened recently under the current standard, with a five per cent sample check to test that conclusion.

That split is where the money sits. Start without segmentation and you pay for 1,400 files. Measure first and you pay for 620 full and 310 light remediations — and you can explain to a supervisor why the remaining 470 stayed outside the programme.

Decision rules before the first file

Before a single file was touched, we agreed the decision rules with the office. This is the step most often skipped and the one that costs most afterwards, because without fixed rules every colleague judges slightly differently and the result is not reproducible.

Which documents suffice to establish a UBO per type of legal entity, and when an extract is not enough.
When a file moves from standard to enhanced due diligence, and who takes that decision.
How many contact attempts a client gets, at what intervals, before the file goes to the escalation route.
What happens with a client who does not respond: which services are suspended, when, and on what basis.
When a finding during remediation leads to a report to the FIU — and the rule that the remediation process does not wait for it.

Three outreach waves

Wave 1 — targeted request from the client's own relationship manager. Personal, naming exactly what is needed and why. Response: around 60 per cent within three weeks.
Wave 2 — reminder with a deadline. In writing, with a date and a statement of what happens if it passes. Response: around 85 per cent cumulative.
Wave 3 — notice of suspension. On behalf of the board, referring to the statutory basis and the contractual provision. Response: 94 per cent cumulative.

The remaining six per cent is where the real work sits. A client who will not explain his ownership structure after three requests is not an administrative problem but a risk signal. In this engagement that produced 38 files moving to enhanced due diligence, two reports to FIU-Nederland and three terminated relationships.

The outcome

620 files fully remediated in five months, plus 310 targeted completions.
94 per cent response after the third wave, without legal proceedings.
38 files to enhanced due diligence, of which three led to termination and two to a report.
One reproducible standard. Every remediated file was assessed against the same recorded rules, with the reasoning in the file. In a supervisory sample that is the difference between "we fixed it" and "this is how we fixed it, and here is why".
An embedding arrangement. The decision rules were built into the regular onboarding process, with a half-yearly quality sample. Without that step the portfolio drifts again within two years.

What you can take from this

Measure before you start. A baseline of a few weeks determines whether you pay for 1,400 files or for 620. That is usually the difference between a programme that fits and one that gets cancelled.
Fix the decision rules before the first file. Otherwise you produce 620 individual judgements rather than one standard applied 620 times.
An acquisition brings the other party's file standard with it. Put a portfolio quality test in the acquisition terms, not in the year that follows.
Non-responding clients are a risk signal, not an administrative remainder. Treat them as such, and record what you did.
Embed the standard in the regular process, or a remediation becomes a recurring expense rather than a one-off.

Duration and investment

The baseline was a separate engagement of € 1,950 excluding VAT — deliberately available on its own, so the board knew what the portfolio would cost before committing. After that the fixed price per file applied: € 95 excluding VAT for a standard file and € 240 excluding VAT for a file requiring enhanced due diligence, with a project minimum of € 7,500 excluding VAT covering the baseline, decision rules, quality assurance and final report.

We work here without additional billing. That means we carry the risk of files that turn out heavier than expected; the client carries the risk of clients who do not respond. The split is deliberate: we can influence the first and the client can influence the second — and it prevents the argument that otherwise arises halfway through every remediation programme.

Questions that come up in this kind of engagement

How large does a baseline sample need to be?

It depends on the size and variation of the portfolio. At a few thousand files a stratified sample of around a hundred usually suffices, spread across systems, origin and risk classes. The aim is not statistical perfection but a reliable pattern: which groups score badly, and why.

What do we do with clients who do not respond?

Decide in advance how many contact attempts a client gets, at what intervals, and what happens then. A client who provides no information after repeated requests belongs in the escalation route: suspension of services on the basis of your terms, a risk assessment, and where necessary a report or termination. What you should not do is leave the file open indefinitely.

Do we have to report what we discover during remediation?

Yes. If a transaction meets an objective indicator or you have subjective grounds to suspect money laundering or terrorist financing, the reporting duty applies in full — including where the finding arises from your own remediation. The reporting process runs alongside the remediation and does not wait for it.

Could we not do this ourselves?

Often yes, and sometimes that is the sensible choice. The two parts where in-house programmes most often go wrong are the segmentation, because the instinct is to include everything, and reproducibility, because your own staff know the client and unconsciously judge more leniently. We are frequently brought in for precisely those two parts, with the execution kept in house.