KYC for Fintech Startups: The Build Order From Day One

KYC for fintech startups means verifying every customer’s identity, screening them against sanctions and watchlists, rating their risk, and monitoring the relationship afterwards. The duty usually arrives through your sponsor bank or payment partner before any regulator writes to you. Get the policy written and the vendor chosen before you take your first real customer.

Most founders discover this during partner diligence. The bank sends a questionnaire asking for your AML policy, your customer identification programme, your risk assessment and the name of your compliance officer. Nobody has written any of them. Integration slips a quarter.

What follows is the order to build things in, what the documents actually contain, how to pick a vendor with no volume and little bargaining power, and the failure modes that stop a fintech from launching.

Where your obligation actually comes from

Three routes, and they carry different consequences.

You hold the licence

If you are registered or authorised in your own right, such as a money services business, an electronic money institution or a payment institution, anti money laundering law applies to you directly. You owe a written programme, an appointed officer, training, independent testing and suspicious activity reporting. The regulator can examine you.

You ride on a partner’s licence

Banking as a service arrangements are the common startup path. The bank remains the regulated entity, and it stays responsible for the customers you introduce. It therefore pushes its own standard onto you by contract. In practice that standard is often stricter than the law, because the bank is managing its own examination risk. Read the contract, because the operative requirement is in there, not in the statute.

You are not yet in scope

Pure software with no custody of funds, no payment initiation and no customer relationship may sit outside AML rules for now. Sanctions rules are different. They apply to everyone in the jurisdiction, with no licence threshold and no small business exemption. You can be outside KYC scope and still be firmly inside screening scope.

The four documents you need before launch

Partner diligence asks for these by name. Write them yourself, then have a specialist review them. Documents bought as templates and never adapted are visible immediately.

Enterprise risk assessment. Your products, customer types, geographies, delivery channels and payment methods, each rated for money laundering and sanctions risk, with the controls that reduce each rating. Every other document flows from this one. Date it and review it annually.
AML and sanctions policy. What you will and will not do. Prohibited customer types, prohibited countries, the escalation path, who signs off on a high risk relationship, who files a suspicious activity report.
Customer identification and due diligence procedure. The operational detail. Which fields you collect, which documents you accept, what your vendor thresholds are, what triggers enhanced due diligence, what a reviewer must record.
Screening procedure. Which lists you screen, at what match sensitivity, how often you rescreen the existing book, how an alert is escalated, cleared and documented.

You also name a compliance officer with real authority and a reporting line to the board or to a founder. At seed stage this is often a co-founder rather than a hire. That is acceptable if the person genuinely owns it and has the time. A part time contractor with the title and no decision rights will not survive diligence.

Minimum viable KYC

For a consumer product, the baseline is the customer identification programme data set: legal name, date of birth, residential address and a government identifier such as a national insurance, social security or tax number where the jurisdiction uses one. Verify those against an independent source. Then screen the verified name.

For business customers the baseline is larger. Legal name, registration number, registered address, nature of business, certificate of incorporation, the directors, and the beneficial owners above the applicable ownership threshold. Each beneficial owner is then verified as an individual and screened.

Screening is the part startups under-build. Identity verification vendors often cover sanctions and politically exposed persons but not export denial lists, debarment lists or unverified party lists. If your customers move goods, those lists matter. You can run a denied party screening check against consolidated government lists in seconds, which is a reasonable manual control while your automated coverage is still thin.

What to build at each stage

Stage	Identity verification	Screening	Monitoring	People
Pre-product, closed beta	Manual document review, logged in a spreadsheet with images stored securely	Manual list checks at onboarding, results screenshotted and dated	Founder reviews every transaction	Founder acts as compliance officer
Seed, first paying customers	Vendor API for document and selfie checks, manual fallback path defined	Automated at onboarding, manual rescreening on list updates	Threshold rules and a daily exception report	Named officer, part time analyst
Series A, scaling volume	Full automation with risk based step-up and case management	Automated onboarding plus automated portfolio rescreening	Behavioural monitoring, tuned scenarios, alert queue	Dedicated compliance team, first independent audit
Own licence application	Documented model governance and vendor testing evidence	Documented tuning, match rate testing, list coverage attestation	Scenario tuning evidence and reporting statistics	Officer approved by the regulator, board reporting

What a sponsor bank will ask you

Competitor guides describe the bank relationship in general terms. The questions are specific and repeat across partners. Prepare answers to these.

Which vendor performs identity verification, and can we see the contract and the accuracy testing?
What are your acceptance thresholds, and who approved them?
What percentage of applicants go to manual review, and who reviews them?
Which sanctions and denial lists do you screen, how often are they refreshed, and how do you evidence a refresh?
How do you rescreen existing customers when a list changes?
Show us three cleared alerts and three declined applications with the reasoning.
Who is your compliance officer, what is their reporting line, and how much time do they spend on this?
What is your record retention period and where is the data held?
When was your last independent test, and what did it find?

The last three catch most startups. Banks want to see an audit trail that reconstructs a decision months later, not a screenshot folder. Build the logging before the volume arrives, because retrofitting it means re-examining every historic case.

Choosing a vendor with no volume

You have no leverage at seed stage, so optimise for exit options rather than price.

Contract length. Refuse multi-year commitments. Take usage based pricing with a low or no minimum, even at a worse unit rate.
Data portability. Ask, in writing, whether you can export verification evidence including document images if you leave. Some vendors keep it. That turns a switch into a re-verification of your whole book.
Country coverage. Check the specific countries and document types you need, not the headline number of countries supported.
List coverage. Get the list inventory in writing. Sanctions coverage is common. Export denial, debarment and unverified party lists often are not.
Fallback. What happens to an applicant the vendor cannot verify? If the vendor has no manual review product, you are building one.
Audit artefacts. Does the API return a reference, a reason code and a timestamp you can store? If it only returns pass or fail, your evidence file is thin.

Run a pilot with real users before you sign. Measure drop-off per step and the false rejection rate by sampling declines and checking them by hand. Demo accuracy figures are produced under laboratory conditions with good documents and good lighting.

Manual is fine, undocumented is not

A manual process is defensible at low volume. Regulators and partners care whether the control works consistently, not whether it is automated. What they will not accept is a process with no written procedure, no record of who decided what, and no evidence the check happened.

Switch to automation when one of these is true. Manual review is taking more than a few hours of someone’s day. Onboarding delay is measurably costing conversions. You are operating in more than two or three countries. Or your partner has told you to. Smaller operations can still run a lean programme, and our guide to screening for small businesses covers how to keep it proportionate.

Whichever you run, rescreening is the part that gets forgotten. Lists change without notice, and a customer who was clean at onboarding can be designated later. Set a defined frequency and stick to it. Our note on how often to screen suppliers and customers sets out sensible intervals by risk level.

Failure modes that stop a launch

Treating compliance as a pre-launch task

Firms write the policy, pass diligence and then never touch it. The risk assessment goes stale, the product adds a feature the policy does not cover, and the gap surfaces at the next partner review. Put a calendar date on the annual review and on quarterly reporting to the founders.

Growth outrunning controls

This is the one that does real damage. When onboarding volume rises faster than review capacity, backlogs build and thresholds get quietly loosened to clear them. Supervisors have responded to this pattern by restricting how fast a firm may add new customers until its controls are repaired. A growth restriction is far more expensive than a fine for a company whose valuation rests on growth.

Screening the customer and nobody else

Your obligation covers counterparties too. Payment beneficiaries, merchant customers, vendors, contractors and, for anyone touching physical goods, freight forwarders and end users. A single screening step at signup leaves most of the exposure unscreened. Building the check into onboarding is described in our guide to sanctions screening in customer onboarding, and the same logic extends across the payment chain.

No training record

Every regulated programme requires training, and every examiner asks for the attendance record. Annual training with a dated register and a short assessment satisfies it. Our piece on effective compliance training explains how to make it land rather than tick a box.

Sequencing, month by month

Write the enterprise risk assessment. It takes a week and it determines everything else.
Name the compliance officer and record the reporting line.
Draft the AML and sanctions policy from the risk assessment.
Write the customer identification and screening procedures at operational detail.
Shortlist three vendors, run a pilot with real applicants, measure drop-off and false rejections.
Build the evidence store: what you log, where, for how long, and who can read it.
Define the manual fallback path and staff it.
Train the team and keep the register.
Book an independent review before your first partner audit, not after it.

Steps one to four cost time, not money. They are also what partner diligence actually reads. Founders usually reverse the order, buying a vendor first and writing the policy to match whatever the vendor happens to do.

Key takeaways

Your practical KYC standard usually comes from your sponsor bank contract, which is often stricter than the statute that applies to the bank.
Sanctions and denied party rules apply with no licence threshold, so a startup can be outside AML scope and still fully inside screening scope.
Four documents carry partner diligence: the enterprise risk assessment, the AML and sanctions policy, the customer due diligence procedure and the screening procedure.
A manual process is defensible at low volume. An undocumented process is not, at any volume.
Check vendor contracts for data portability before signing, because a vendor that keeps your verification evidence makes switching mean re-verifying your whole customer book.
Rescreen the existing book on a defined schedule, since a customer clean at onboarding can be designated later.
Growth outrunning control capacity is the failure that draws supervisory restrictions on how fast you may add customers.

Frequently asked questions

When does a fintech startup need KYC?

Before the first customer who can move money. If you hold a licence, the duty starts with the licence. If you use a sponsor bank or payment partner, the duty starts when the contract is signed, and the partner will test it during integration. Sanctions screening obligations start as soon as you have a counterparty, regardless of licensing.

How much does KYC cost a startup?

Vendors typically charge per verification, with pricing varying by country and by whether the check includes document authentication, biometrics and screening. Ask for per-check pricing with no minimum commitment at seed stage. The larger cost is usually people. Manual review time, the compliance officer’s time, and the independent review before a partner audit.

Can a fintech outsource KYC entirely?

You can outsource the execution. You cannot outsource the responsibility. The regulated firm remains accountable for the outcome, which means you must oversee the provider, test its output, and be able to explain its decisions. That oversight has to be documented, with evidence that you tested a sample of the provider’s decisions yourself.

What is the difference between KYC and AML?

AML is the whole programme: risk assessment, policy, an appointed officer, training, monitoring, reporting and independent testing. KYC is the customer-facing part of it, covering identification, verification, risk rating and ongoing due diligence. A startup that has bought an identity verification tool has some KYC. It does not yet have an AML programme.

Do I need a compliance officer at seed stage?

You need a named person with authority to refuse business and a direct line to the founders. At seed stage that is often a co-founder rather than a hire, which is acceptable if they genuinely own the work. Sponsor banks ask who the person is and how much time they spend. A title with no decision rights fails diligence.

How long do I keep KYC records?

Anti money laundering rules set a minimum retention period running from the end of the customer relationship or the date of the transaction, and the number of years differs by jurisdiction. Check the rule for your licence and your partner contract, then take the longer of the two. Keep the decision reasoning, not only the documents.

Getting screening in place

Screening is the control you can stand up on day one without an integration project. Globalior’s free screening tool checks names against consolidated government sanctions and denial lists, and you can use the free denied party screening tool for customers, vendors and payment counterparties alike. If you want a second opinion on your onboarding design before a partner audit, contact the Globalior team.