A remediation task can be marked complete while the weakness that created it remains in place.

The missing document has been uploaded. The policy has been revised. The training session has been delivered. Those are visible milestones, but the person responsible for closure still needs to establish whether the underlying control now works.

FinCEN's August 2026 action against UBS Financial Services makes that distinction concrete. FinCEN said the firm continued to fail to monitor foreign-currency transactions after an earlier settlement addressing the same failures, and that significant remediation work began only after its investigation was under way. The case concerns US obligations; the distinction between planned and effective remediation also matters when reviewing an investor-onboarding control.

For a fund manager or administrator, closure needs evidence of what failed, what changed and whether the change worked.

Define the failure before counting completed files

Imagine an internal review finds that some investor files contain ownership charts without evidence supporting the intermediate company relationships. The immediate response is to collect the missing records.

That work matters, but it leaves a second question: how did the files reach approval with the gap unresolved?

Perhaps the onboarding form requested only the final beneficial owners. Perhaps the workflow treated an uploaded chart as sufficient evidence. Perhaps reviewers understood the requirement differently, or an exception process allowed cases to proceed without a recorded decision.

Each explanation calls for a different response. More training will have limited effect if the workflow still permits an unsupported relationship to pass unnoticed. A new mandatory field will have limited effect if the field asks the wrong question.

The finding should therefore describe both the observed problem and the control failure that allowed it. Its scope should identify the affected population, the period under review and the basis for deciding which other files may share the weakness. Without that scope, a high completion rate can conceal cases that were never included.

Separate correcting the record from repairing the process

For the fictional ownership finding, one stream of work addresses existing investor records. Another changes how new ownership structures are reviewed.

The existing files need the missing evidence, an assessment of what it shows and any resulting update to the risk decision. A document can arrive without resolving the question. It may be out of date, relate to the wrong entity or expose a further layer that requires examination.

The process change needs to make those unresolved relationships visible before approval. It might adjust the questions asked, assign responsibility for review or require a recorded exception when evidence remains incomplete. The exact design should follow the cause of the failure.

These streams can progress at different speeds. The team may repair the workflow before finishing the historical population, or complete straightforward files while a harder design question remains open. Reporting them separately gives management an accurate picture of residual exposure.

This is a useful extension of working through a KYC remediation backlog task by task. Individual tasks need a destination: a defensible investor record and a control that prevents the same avoidable gap from recurring.

Decide what evidence would justify closure

The person reviewing closure should know the acceptance criteria before the delivery team declares success.

For the ownership example, the evidence might include reviewed files from the affected population, the revised workflow and results showing how that workflow handles a newly submitted layered structure. The test should include an incomplete case, so the team can demonstrate what happens when the necessary evidence is absent.

A process may work well when every input is correct and still fail at the moment it is supposed to challenge a gap. A useful test follows the case through assignment, enquiry, escalation and decision. It asks whether the right person sees the unresolved issue and whether approval reflects its status.

The scale and independence of validation should match the significance of the finding and any formal requirements attached to it. An internal process improvement and a regulator-directed remediation programme may have different closure arrangements. The team should follow the applicable authority rather than assume that its own completion status ends the matter.

The closure record should also state the limits of the evidence. If validation covers one investor category, it should not imply that every other structure has been tested. If remaining exceptions are accepted through an authorised process, those exceptions need owners, reasoning and any required follow-up.

Make the record useful after the programme ends

The closure pack should let a future reviewer reconstruct what changed and why it was accepted.

Connect the original finding to its cause, corrective work, validation and approval. This allows a later reviewer to establish whether a recurring issue points to a failed fix or a different weakness.

Management reporting should preserve the same distinctions. Documents received, files reassessed, exceptions outstanding and controls validated describe different stages. Combining them into one “completed” total makes it harder to see where judgement or evidence is still missing.

Feed the finding into the ongoing KYC review process, so the operating team knows which ownership gaps to watch for after the programme ends.

Steward supports the remediation work through assigned document, verification and screening tasks. Keeping the task beside its evidence helps the designated reviewer decide whether the closure criteria have been met. That reviewer remains responsible for the closure decision.

Test the next incomplete ownership case. The repaired workflow should identify the missing evidence, route it to the responsible reviewer and preserve the resulting decision.