BPN, a remittance provider in Türkiye, used to screen every new customer by hand at onboarding. For a service sold on speed, that step was slow. After it moved its onboarding screening to complead, formerly Sanction Scanner, the check became an API call that answers in seconds, with whitelisting and an audit log, per the July 2026 case study.
Customer onboarding covers everything a firm does between an application and the customer's first transaction, and know your customer (KYC) is the part of it the law prescribes. Each market writes its own KYC requirements. In regulated environments every later alert, review and report relies on the identity recorded on day one.
What happens at each step of the KYC onboarding process?
The KYC onboarding process has eight steps: notice, identification, verification, screening, purpose and owners, risk rating, the decision, and opening with monitoring. The US, EU and UK differ mainly on whether the account may open before a step ends.
Table 1. The KYC onboarding process, step by step (as of November 2026)
| Step | What the file must show | Can the account open before this ends? | If it cannot be done | Rule |
|---|---|---|---|---|
| 1. Notice and application | The applicant was told identity information is requested | No: the notice comes first | Show it on the application screen | 31 CFR 1020.220(a)(5) |
| 2. Identify | Name, date of birth (individuals), address, ID number (US); all names, place and date of birth, nationalities, any national ID number and residence (EU, for a natural person, outside lower risk cases) | US: no, the four items come first, though a bank's CIP may let a customer who has applied for a taxpayer identification number open first, once the filing is confirmed, and collect the number within a reasonable time; for a credit card account the items may come from a third party before credit is extended. EU: yes, with no transaction until the customer and the owners are identified and verified | Do not open the account | 1020.220(a)(2)(i)(A) to (C); AMLR Art 22(1), 23(3) |
| 3. Verify | The document or eID used, the method, the result, any discrepancy and how it was resolved | US: yes, within a reasonable time, on terms the bank sets. EU from 2027 and UK: yes, if nothing moves until it ends. Low risk, EU from 2027 and UK: yes, if the lower risk justifies it (EU: within 60 days, with limits or monitoring meanwhile) | Do not open, or close; consider a SAR | 1020.220(a)(2)(ii), (iii); AMLR Art 22(6), 23, 33(1)(a); MLR regs 30, 37 |
| 4. Screen | Sanctions and PEP lists checked, each match reviewed, the outcome | US: the CIP check against lists of known or suspected terrorists may follow opening, within a reasonable time, unless another federal rule needs it sooner, though the FFIEC manual states that no list has been designated for CIP purposes and that checks against OFAC lists remain a separate requirement. EU: a due diligence measure of its own | Refrain or terminate; consider reporting (EU) | AMLR Art 20(1)(d), (g); 1020.220(a)(4); FFIEC BSA/AML manual |
| 5. Purpose, business and owners | Why the account is opened, expected activity, occupation or business, the beneficial owners | EU: owners verified before any transaction, or within 60 days at justified low risk | Refrain or terminate; consider reporting (EU) | AMLR Art 20(1)(b), (c), (e); 23(3); 33(1)(a) |
| 6. Rate risk, pick the route | The score, its factors and the route: simplified, standard or enhanced | PEPs (every PEP in the EU from 2027; foreign PEPs, and others at higher risk, under FATF R.12) and their family members and close associates: not before senior management approves | Hold the decision until the route is set | AMLR Art 20(2), 42(1), 46; FATF R.12, R.19 |
| 7. Decide | Open, decline or refer; who decided and why | No: the decision opens it | Do not open; consider a suspicious transaction report | FATF R.10; AMLR Art 21(1) |
| 8. Open and monitor | The next review date and the monitoring switched on | Starts at opening; runs for the whole relationship | End the relationship | AMLR Art 20(1)(f), 21(1) |
Steps 2 to 5 can run at once. Identity data, the document check and the screen go out in one request while the applicant answers the purpose questions, so the customer due diligence measures finish together. The risk rating waits for all four results. The table is a framework of core components, and the workflow order can change as long as each row's timing rule holds.
Where do customer onboarding and KYC differ?
The difference is scope and time. Onboarding is the customer's journey (application, product choice, terms, first funding) and it ends at first use. KYC is the due diligence inside that journey that a regulator can test, and it goes on through ongoing monitoring and periodic reviews. For a company applicant the same checks keep their relevance, and KYB onboarding adds the ultimate beneficial owners (UBO) behind the entity.
What do AML rules require before an account opens?
Every rulebook wants identity before money moves and lets some verification finish later, but they part on whether the account opens first.
R.10 of the FATF Recommendations sets the baseline: verify the customer and the beneficial owner before or during the relationship, or "as soon as reasonably practicable" afterwards where a country allows it, the risks are effectively managed and waiting would interrupt normal business. A firm that cannot complete due diligence opens no account and considers filing a suspicious transaction report.
In the US, a bank's customer identification program under 31 CFR 1020.220 needs four items "prior to opening an account": name, date of birth for an individual, address and an identification number. A pending taxpayer number and credit card accounts are exceptions. Verification may follow "within a reasonable time after the account is opened".
In the EU, national laws under Directive (EU) 2015/849 apply until 10 July 2027, when Regulation (EU) 2024/1624, the AMLR, takes over. Its Article 23 sets verification before the relationship as the rule, allows it during where needed for normal business and of "little risk", completed "as soon as practicable", and lets a bank or financial institution open an account if no transaction runs until the customer and owner checks are done. A firm that cannot finish due diligence must refrain or terminate and "consider reporting" (Article 21).
The UK's Money Laundering Regulations 2017, regulation 30, set the same routes and conditions. 6AMLD (Directive (EU) 2018/1673) adds no onboarding step: it is criminal law, and the AMLR's money laundering definition points to its offenses.
Can a customer use the account before verification ends?
In the US, yes, on terms the bank's program sets until verification ends. UK and EU (from 2027) rules let the account exist while transactions wait. The exceptions on when verification must finish include justified low risk (EU: 60 days, AMLR Article 33; UK: regulation 37) and UK regulation 30ZA for insolvent bank customers.
What are the digital onboarding requirements for companies?
Digital onboarding has no rulebook of its own: the digital onboarding process meets the same due diligence duties, plus regulators' expectations for choosing and testing the solution. Seven requirements shape most designs.
- Match the assurance level to the risk. FATF's guidance on digital identity asks that a digital ID system's assurance levels be "appropriate for the ML/TF risks" of the customer, product and geography (para 23).
- Do not rate remote as high risk by default. The same guidance reads FATF's standards as not requiring every remote relationship to be classed as higher risk (para 88).
- Assess the solution before using it. The EBA's guidelines EBA/GL/2022/15, applied since 2 October 2023, ask EU banks and financial institutions to assess a remote solution before adopting it, including the "completeness and accuracy of the data" (paras 13 and 14).
- Stop when the session breaks. Identification should not continue after technical shortcomings or "unexpected connection interruptions" (para 24(c)).
- Accept a document or a strong eID. From 2027 the AMLR accepts an identity document, with independent sources where relevant, or an eID at assurance level substantial or high under eIDAS (Article 22(6)). A remote onboarding KYC form adds that selfie, short video or eID step to the standard identity questions.
- Cover the customer you never meet (US). A bank's non documentary procedures must cover customers opening accounts without appearing in person (1020.220(a)(2)(ii)(B)(2)). FinCEN's FAQs of September 2026 add that unexpired mobile driver's licenses and other government digital credentials showing nationality or residence and a photo or similar safeguard "may be used to verify identities" where a bank's CIP and systems allow.
- Keep the file. The records stay with the firm: a US bank keeps identifying information until five years after closure (credit cards: closure or dormancy) and verification records for five years after they are made (1020.220(a)(3)(ii)).
Which technologies does digital onboarding use?
Five tools do the work. OCR reads the document text and a face match compares a selfie with the document photo. Liveness detection checks that a live person is at the camera, actively, by asking for a movement, or passively, by analyzing the capture alone. An eID can stand in for the document, and an API carries each result into the decision. Run in house or by an identity verification (IDV) provider, these tools and biometric technologies form the eKYC checks of a remote flow.
Among this year's digital onboarding trends, the innovation with a rule behind it is the government digital credential.
How is AI transforming KYC and customer onboarding?
For the future of KYC automation, the EU AI Act sets which AI uses at onboarding carry high risk duties, and from when.
In a manual flow the KYC bottleneck is the queue: documents reviewed by hand, in house or offshore, and name matches waiting for a person. Artificial intelligence (AI) changes that CDD work. Models read the document and fill the form, entity resolution groups the hits that belong to one listed person, NLP sorts news about the applicant into risk categories, and a score turns the answers and the screen into a route.
A person still decides each referral. From 2027 the AMLR's Article 76(5) allows automated and AI decisions on conditions, including meaningful human intervention in any decision to open, refuse or change due diligence.
complead fits into the compliance layer of this flow through its customer risk assessment and KYC product, and its screen queries 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. Onboarding sits on one engine with screening, monitoring, fraud and investigation, so a customer has one risk score rather than a separate score in each tool.
Is AI in AML onboarding high risk under the EU AI Act?
Mostly not. Annex III of the AI Act lists remote biometric identification but excludes biometric verification "the sole purpose of which is to confirm" that a person is who they claim to be. Credit scoring of natural persons is listed, minus AI "used for the purpose of detecting financial fraud"; sanctions screening and AML risk scoring are not listed. The Digital Omnibus on AI moved the Annex III duties to 2 December 2027.
The live risk is video forgery and other fraud aimed at the checks. FinCEN's deepfake alert of 13 November 2024 notes that criminals have combined GenAI images with stolen or fake personal data to create synthetic identities. Its red flags include a photo "inconsistent with their other identifying information" and "multiple identity documents that are inconsistent with each other".
How should risk decide the onboarding route?
Picture three applicants at one e money firm:
- A salaried resident opening a wallet gets standard due diligence: an eID or a document with a selfie, a clean screen, a fast decision.
- A non resident whose top ups will come from accounts abroad answers extra questions on source of funds and expected activity and starts on a higher score and a lower limit.
- The parent of a foreign minister. The screen flags a family member of a PEP (AMLR Article 20(1)(g)). FATF R.12 covers family members and close associates too, so the account waits for senior management approval, the firm takes steps to establish the sources of wealth and funds, and monitoring is enhanced.
Risk based client onboarding keeps the same eight steps and sets the depth of each by an individual analysis of the customer's risks (AMLR Article 20(2)): enhanced due diligence where the risk is increased, simplified measures allowed where it is lower. A customer risk assessment at step 6 records the route for the supervisor. For persons from countries the FATF calls out, R.19 asks for enhanced due diligence, effective and proportionate to the risks. It sets no ban itself, though countries may add countermeasures that go further.
What happens after onboarding?
Approval starts the next part of due diligence. AMLR Article 20(1)(f) puts ongoing monitoring inside CDD, so the file should leave onboarding with a next review date for the customer's tier and the events that pull it forward, such as a new match or unexpected activity. Perpetual KYC runs those reviews on events, and the continuous ongoing monitoring that follows reads the same file.
How do you improve the customer onboarding process with an effective strategy?
Secure and efficient onboarding of new customers takes the waiting out between checks and keeps every check. Customer onboarding strategies differ by product, yet an efficient strategy for onboarding customers comes down to the same best methods, six tips that double as AML practice.
- Ask once. Collect each fact once, prefill what the firm already holds, including for an existing customer adding a product of the same risk, and ask only what the rules and the risk model need.
- Screen before the decision. Run the sanctions and PEP screen in the identity check's request, not in a batch after opening. When comparing a customer onboarding solution, test whether the screen returns before the decision.
- Route by risk. Clean applications take a fast lane; referrals go to a named reviewer with the reason attached.
- Reuse where reliance is allowed. FATF R.17 lets countries permit reliance on a regulated third party's checks if the firm gets the results at once and copies on request without delay, but responsibility "remains with the financial institution relying".
- Show what is pending. Tell the applicant which check is open and what is missing, so a document request does not lose the firm the customer's lifetime value (LTV).
- Log every decision. Record who decided, on what evidence and when, so the file answers a supervisor without a rebuild.
Why is my customer onboarding process taking too long for AML compliance?
Because checks run in a row. Four challenges cause most of the delay: screening in an overnight batch, every partial name match reviewed at one threshold, missing information chased by email, and referrals with no owner. Order is the important change, and proper onboarding processes implement it with parallel steps and an owner per referral.
Which onboarding metrics show the process works?
Effective customer onboarding shows in four key metrics, where better compliance and better business results meet: completion, time to decision, alert quality and EDD volume.
Table 2. Onboarding funnel for one month at an illustrative e money firm
| Step | Count | Rate | Methodology |
|---|---|---|---|
| Applications started | 10,000 | ||
| Applications submitted | 7,600 | 76% | of started |
| Decided the same day | 6,840 | 90% | of submitted |
| Screening alerts | 1,140 | 15% | of submitted |
| Alerts cleared as no match | 1,083 | 95% | of alerts |
| Alerts escalated | 57 | 5% | of alerts |
| Sent to enhanced due diligence | 380 | 5% | of submitted |
When 95 percent of alerts clear as no match, check the screening threshold before the applicants. The 5 percent EDD rate records a policy, so hold it against the risk assessment. Other firms' customer onboarding statistics reflect other customer mixes; your own previous month is the benchmark.
What did regulators change for onboarding in 2026?
- 10 April. FinCEN proposed new AML/CFT program rules, still a proposal on 3 November.
- 30 June. UK regulation 30ZA took effect: for 30 days from a bank's insolvency, a credit institution may let that bank's customers, once identified, open an account and transact, finishing due diligence as soon as practicable and pausing in enhanced due diligence cases.
- 6 July. The FCA's Mills Review found that AI "could also amplify risks associated with fraud".
- 27 July. The Digital Omnibus on AI came into force, moving the Annex III duties from 2 August 2026 to 2 December 2027.
- 30 September. AMLA's final report on its draft CDD standards (AMLR Article 28(1)) came out; they go to the Commission for adoption.
- Next. The AMLR applies from 10 July 2027.
BPN kept its screening step and moved it from a manual queue into the seconds a customer already spends applying. Before redesigning your own flow, list the steps that still wait on a person and check in Table 1 whether a rule requires the wait.
How this page was checked. Each rule text was reread on 2 and 3 November 2026: the June 2026 FATF Recommendations, FATF's March 2020 guidance on digital identity, 31 CFR 1020.100 and 1020.220, Regulation (EU) 2024/1624, Directive (EU) 2024/1640, UK regulations 30, 30ZA and 37, EBA/GL/2022/15, the AI Act with the Digital Omnibus on AI, FinCEN's deepfake alert, its digital credential FAQs and its April 2026 program proposal, the FFIEC BSA/AML manual's CIP section, the FCA's Mills Review and AMLA's final CDD report of 30 September 2026. Table 2 and the applicants in the risk section are worked examples. Fact checked by: Laura Otterpohl, Compliance Manager at Candex, on 6 November 2026.
