The KYC onboarding process, step by step
Short answer: the KYC onboarding process has five stages: collect the applicant’s details, capture and read their identity document, verify the document is genuine and belongs to them, screen them against sanctions and watchlists, then decide whether to approve, reject or escalate. Most of the cost sits in the last stage, because whatever the system cannot decide alone becomes a person’s job.
This covers what each stage of the KYC onboarding process involves, where applicants actually abandon the flow, and how to judge KYC software against building the pipeline yourself.
The five stages
1. Collect. Name, date of birth, address, and whatever else your regulator requires for the customer type. Dull, and the place where the most avoidable drop-off happens, because every field you ask for costs you applicants.
2. Capture and read. The applicant photographs an identity document. The system classifies what it is, corrects the image, and extracts the fields. This is the stage everyone calls OCR and it is the stage where intelligent document processing services actually differ from a text-extraction API: a passport, a national ID and a driving licence from three countries share no layout, no field order and no fonts.
3. Verify. Two separate questions that get conflated. Is the document genuine, checked through security features, font consistency, checksum validation on the document number, and expiry. And does it belong to the person submitting it, checked by matching the portrait against a selfie with a liveness test.
4. Screen. Sanctions lists, politically exposed persons, adverse media. KYC screening is a data problem rather than a document problem, and it is usually a vendor feed rather than something you build. Where anti-money-laundering obligations apply, KYC AML software handles this stage and the ongoing rescreening that follows it.
5. Decide. Approve, reject, or send to a human. The third option is the one that determines your operating cost.
Where applicants actually drop out
Onboarding abandonment is rarely about the decision. It is about the capture step.
A photograph taken in poor light, at an angle, on a cracked phone screen, will fail extraction. If your response is “please try again” with no further guidance, a meaningful share of those applicants leave. If the response names the problem, “the bottom edge of your document is cut off”, most of them succeed on the second attempt.
The same applies to the selfie. Liveness checks fail on glare, on hats, on poor front cameras. Every retry loop without a specific instruction is a place where a real customer gives up.
We have seen this dominate the numbers more than accuracy does. A pipeline reading at 98% field accuracy still loses customers if the 2% get a generic error.
The decision stage is your cost base
Every applicant the system cannot clear automatically becomes a queue item. The share it clears without a person is the straight-through rate, and it is the only number that matters for what onboarding costs you.
Two things move it. The first is extraction accuracy, which has a ceiling set by your worst documents rather than your best. The second, and more controllable, is where you set confidence thresholds. Set them loose and cases clear that should not have. Set them tight and your reviewers drown.
The right way to set them is to measure both error directions separately on a labelled sample of your real documents, then choose the point where the cost of a manual review is less than the cost of a wrong approval. That is a business decision, not a technical one, and it belongs to your compliance function.
For one FinTech, getting this right removed €40,000 a year of manual review at 98% field-detection accuracy, running on 70% less compute than the baseline. The routine 90% of the queue disappeared; the reviewer stayed on the cases that genuinely needed judgement. The full write-up is in the KYC OCR automation case study.
KYC software, or build it
KYC verification software from vendors like Sumsub, Onfido and AU10TIX sells the whole pipeline. They are the right answer more often than a firm offering KYC and KYB automation is supposed to admit.
Buy when your document mix is common, your volumes are moderate, per-check pricing is comfortable at your scale, and your compliance rules match what the vendor already models. You get coverage of hundreds of document types on day one, which is genuinely hard to replicate.
Build when one of four things is true. Per-check pricing has become your dominant line item at your volume. Your document types are unusual and the vendor’s coverage is poor on exactly the ones you see most. Data residency or network isolation rules out sending documents to a third party. Or your decision logic is specific enough that you keep fighting the vendor’s model.
The honest comparison is per-check cost multiplied by your annual volume, against a build plus its running cost. Below a few hundred thousand checks a year the vendor usually wins on arithmetic alone. The build-versus-buy detail is in KYC verification: build vs buy.
KYB is a different problem
KYB and KYC are often bought together and they are not the same job. Onboarding a company is not onboarding a person with extra fields. Know Your Business starts with a certificate of incorporation, articles and a registry record, then has to establish who actually controls the entity.
That ownership question is the whole difficulty. Beneficial ownership sits behind holding companies, nominee directors and cross-border structures, and the document naming it is often several layers up. Company names disagree between the certificate, the registry and the application form, in ways that are usually innocent and occasionally not.
The extraction machinery is the same. What is new is reconciliation, and the fact that every beneficial owner you identify on paper then has to run through the individual identity pipeline. The two systems have to hand work to each other rather than sit side by side.
Expect a lower straight-through rate on KYB than on KYC, and treat that as correct rather than a failure. The structures that fall out are the ones nobody should be clearing automatically.
Onboarding is not the end of it
Onboarding is a point in time. Compliance is not. Ongoing monitoring covers sanctions rescreening, changes to a company’s registry record, expiring documents, and transaction patterns that do not match the profile established at onboarding.
The engineering parts are scheduled rescreening, registry change detection, document expiry tracking, a case queue, and an audit trail that reconstructs why a decision was made and by whom. The risk model and the rules deciding what is suspicious are not engineering: they belong to your compliance function and to the regulator you answer to. A vendor offering to write those for you is selling something worth reading carefully.
What to measure
Four numbers, tracked from the first week.
- Straight-through rate. The share clearing without a person. Your cost base.
- Drop-off by stage. Where applicants abandon, split by capture, liveness and review. Almost always concentrated in capture.
- False accept and false reject, separately. A single accuracy number hides the trade-off you are actually making.
- Time in the review queue. The applicant experience of every case that falls out.
If you track only one, track the straight-through rate. Everything else is a way of explaining why it is what it is.
The takeaway
The KYC onboarding process is five stages, but the cost lives in two of them: the capture step, where applicants abandon, and the decision step, where everything the system will not clear becomes a salary. Accuracy gets the attention and thresholds get the outcome. Measure both error directions on your own documents before anyone quotes you a number.
EpochC builds KYC and KYB automation and the intelligent document processing services underneath it. See the KYC OCR automation case study — €40,000 a year removed at 98% field accuracy — or start a project.