KYC software for regulated onboarding

KYC is the part of an anti-money laundering program that answers a simple question: who is this customer, and what risk do they bring? KYC software turns that question into a repeatable, documented process instead of a pile of emails, spreadsheets and screenshots.

A complete KYC process usually combines several checks. Some happen before an account is opened, some at the moment of onboarding, and some for the rest of the relationship.

• Identity verification: confirming that a person is who they say they are, using reliable, independent documents, data or information.
• Sanctions screening: checking the customer against official sanctions lists before any business is done with them.
• PEP screening: identifying politically exposed persons, their family members and close associates, who call for enhanced due diligence.
• Risk rating: combining country, product, channel and customer factors into a risk level that decides how much scrutiny applies.
• Ongoing monitoring: re-screening customers when lists change and reviewing them again when their risk changes.
• Record keeping: keeping the evidence of every check so that a decision can be explained to an auditor or supervisor later.

1. 1

   Pre-onboarding checks

   Before a full identity check is spent on an applicant, cheap signals such as a disposable email address, a virtual phone number, a risky IP address or automated sign-up behavior can filter out obvious fraud.

2. 2

   Collect and verify identity

   The customer provides identity details and documents. The software checks that the document is genuine and belongs to the person presenting it.

3. 3

   Screen against lists

   The customer's name, date of birth and nationality are matched against sanctions, PEP and other risk lists, allowing for spelling variants, transliteration and aliases.

4. 4

   Assess risk and decide

   The results feed a risk rating. Low-risk customers proceed, higher-risk customers go to enhanced due diligence, and matches go to an analyst for review.

5. 5

   Monitor for the life of the relationship

   Customers are screened again when lists change and reviewed again on a schedule set by their risk level.

The FATF Recommendations, the global standard for anti-money laundering, set out customer due diligence in Recommendation 10: identify and verify the customer, identify the beneficial owner, understand the purpose and intended nature of the relationship, and conduct ongoing due diligence. Recommendation 12 adds enhanced measures for politically exposed persons.

National and regional rules build on these standards, including the EU anti-money laundering framework, the US Bank Secrecy Act and FinCEN rules, and the UK Money Laundering Regulations 2017. Their details differ, but supervisors generally expect a risk-based approach, consistent application, and evidence that every check was actually performed.

• Matching quality: does name matching handle transliteration, word order and aliases without burying analysts in false positives?
• Explainability: can the software show why a customer matched a list entry, so an analyst can clear or escalate it with confidence?
• Coverage: which sanctions, PEP and risk sources are included, and how is that coverage documented?
• Integration: is there an API for real-time checks and a batch option for screening an existing customer base?
• Audit trail: is every check, result and decision recorded so it can be reconstructed later?
• Data control: where does customer data go, and can the software be deployed so that it stays under your control?