KYC and AML: How Digital Customer Onboarding Works
Basics4 minInnovialabs editorial team
In short
KYC confirms that a customer is who they claim to be, and AML checks whether they pose a money-laundering risk; remote onboarding chains document capture, a liveness and face match, sanctions screening and a risk score into one automated flow.
The short answer
KYC (Know Your Customer) is the process of confirming a customer's identity before you open an account or issue a product. AML (Anti-Money Laundering) is the broader set of rules that keeps criminal money out of the financial system. KYC is one of its tools.
Digital onboarding replaces the branch visit with a chain of automated checks inside an app or website:
- The customer enters personal data and scans an identity document.
- The system checks that the document is genuine and reads its data.
- A selfie or short video confirms that a live person is present and matches the document photo.
- The name is screened against sanctions and PEP lists.
- A risk score decides: approve, reject or send to a human reviewer.
The exact requirements depend on the regulator in your country, so the flow is always designed together with the compliance team.
Step by step: what each check does
| Step | What is checked | Typical tools |
|---|---|---|
| Data collection | Name, date of birth, ID number, address, phone | Form with validation, OTP for phone |
| Document check | Authenticity, expiry, data consistency | OCR, MRZ and NFC chip reading, template matching |
| Liveness | A real person, not a photo, mask or replay | Passive or active liveness (head turn, blink) |
| Face match | Selfie matches the document photo | Biometric face comparison |
| Registry check | Data matches government or credit bureau records | API of state ID or credit systems where available |
| Screening | Sanctions, PEP, adverse media | Screening services with regularly updated lists |
| Risk scoring | Overall risk level of the customer | Rules engine plus manual review queue |
NFC chip reading of biometric passports is one of the strongest document checks: the chip data is digitally signed by the issuing state, which makes forgery much harder than with a photo of the page.
Risk scoring and due diligence levels
Not every customer needs the same depth of checks. AML regimes usually distinguish:
- Simplified due diligence for low-risk products with small limits.
- Standard due diligence for most customers.
- Enhanced due diligence (EDD) for high-risk cases: PEPs, unusual countries, large volumes, complex ownership. Here you may ask for the source of funds and involve a compliance officer.
A risk score combines factors such as country, product, expected turnover, occupation, device and behaviour signals. A practical approach is to start with transparent rules that compliance can explain to an auditor, and only later add machine learning on top.
Onboarding is not the end
AML obligations continue after the account is opened:
- Ongoing monitoring of transactions for unusual patterns.
- Re-screening of existing customers when sanctions lists change.
- Periodic KYC refresh for expired documents or changed risk level.
- Reporting of suspicious activity to the financial intelligence unit, following local rules.
- Record keeping: storing checks, decisions and evidence for the required period.
Build or buy
Most fintechs combine a ready KYC provider (document, liveness and face match through an SDK) with their own orchestration layer. The orchestration decides the order of steps, stores results, runs the rules engine and gives reviewers a back office.
When choosing a provider, check:
- support for local identity documents and languages;
- where personal and biometric data is stored, and whether this meets local data-residency laws;
- SDKs for iOS, Android and web, and how much they increase app size;
- quality of the manual review tools and audit logs;
- pricing model per check and per successful onboarding.
Common mistakes
- Treating KYC as a one-time form. Without monitoring and re-screening, compliance gaps appear quickly.
- Too many steps at once. Asking for everything upfront hurts conversion. Tiered limits let customers start with a basic level and upgrade later.
- No manual review path. Automated checks will produce edge cases; someone must resolve them quickly.
- Weak error messages. "Verification failed" without a hint (glare, cropped document, poor light) sends people to support.
- Storing more data than needed. Biometrics and document images are sensitive; keep only what the law requires and protect it.