Table of Contents
The KYC onboarding process has nine steps: intake, customer identification, document collection, verification, sanctions and denied party screening, beneficial ownership mapping, risk rating, approval, and handover to ongoing monitoring. Each step has an owner and a realistic turnaround. Most onboarding delays come from three of them, and they are fixable.
This guide walks the flow end to end, naming who does what, how long each stage should take, and what each step leaves in the file.
It applies to banks and payment firms. It also applies to exporters, freight forwarders and trading companies, who run a lighter version of the same flow under a different name.
What KYC onboarding actually covers
KYC onboarding is the set of checks you run before a customer relationship goes live. It sits inside a wider anti money laundering programme. The FATF 40 Recommendations set the international baseline, and national regimes build on it. The EU does this through its anti money laundering directives and a newer directly applicable regulation. The United States does it through the Bank Secrecy Act and rules written under it.
Three terms get used interchangeably and should not be:
- CIP is customer identification. Who is this person or entity, and can you prove it.
- CDD is customer due diligence. What do they do, where does the money come from, what should normal activity look like.
- EDD is enhanced due diligence. The deeper set of checks you apply when the risk rating is high.
Onboarding is where CIP and CDD happen. EDD happens there too, but only for accounts that earn it.
The KYC onboarding process step by step
Step 1. Intake and product scoping
Before you ask for a single document, record what the customer wants to buy. A domestic savings account and a cross border trade finance facility carry different obligations. The product decides the depth of the file.
Capture entity type, country of incorporation, country of operation, expected products, and expected activity. Owner: the relationship manager or the sales team. Turnaround: same day.
Step 2. Customer identification
For an individual you need full legal name, date of birth, residential address, and a national identifier where the regime requires one. For an entity you need legal name, registration number, registered address, legal form, and the names of directors and authorised signatories.
Collect these as structured fields, not as free text pasted from an email. Structured fields are what your screening engine needs later. Owner: onboarding operations. Turnaround: minutes if the customer fills a form, days if you chase it by email.
Step 3. Document collection
Ask once. The single biggest cause of onboarding drop off is the second and third document request, each arriving days apart. Build a conditional document list driven by the answers in step 1, then send the whole list in one message.
Typical requirements by customer type:
- Individual. Government issued photo ID. Proof of address dated within the period your policy sets, usually a utility bill, bank statement, lease or tax notice.
- Sole trader. The individual set, plus business registration and a trading address.
- Private company. Certificate of incorporation, constitutional documents, register of directors, register of members or shareholder list, and a recent company search extract.
- Partnership. Partnership agreement, plus identification for each partner above the control threshold.
- Trust or foundation. Trust deed, plus identification for settlor, trustees, protector and named beneficiaries.
- Listed company or regulated financial institution. Usually a reduced set, evidenced by the listing or the licence rather than by a full ownership trace.
Owner: onboarding operations, with the relationship manager applying pressure. Turnaround: this is the long pole. Assume days for individuals and weeks for layered corporate structures.
Step 4. Verification
Collection is not verification. Verification means testing the document and the data against an independent source.
For identity documents that means checking the machine readable zone, the security features, and the expiry date, then matching a live selfie to the photo. For entities it means pulling the record from the company registry yourself rather than accepting a PDF the customer supplied. A registry extract you fetched is worth more in an audit than a scan the customer emailed.
Owner: onboarding operations, usually with an identity verification vendor. Turnaround: under a minute when automated, one to two days when a document fails and needs human review.
Step 5. Sanctions and denied party screening
Screen the customer, the directors, the authorised signatories and the beneficial owners. Screen the addresses too. Many regimes list addresses and vessels alongside names.
Run the name against sanctions lists, export control denial lists, politically exposed person data and adverse media. If you are a trading company rather than a bank, the export control lists matter as much as the sanctions lists. You can run a denied party screening check against consolidated government lists before the relationship goes anywhere near a contract. The mechanics of embedding this into the intake flow are covered in more depth in our guide to sanctions screening in customer onboarding.
Every hit needs a decision and a written reason. Most hits are false positives caused by common names, transliteration or partial matches. Our note on resolving a false positive sets out the discounting logic. Owner: the compliance analyst. Turnaround: seconds for a clean pass, hours to days for an alert queue.
Step 6. Beneficial ownership and control
You need to know the natural persons who ultimately own or control the entity. The EU framework uses a 25 percent ownership threshold and many other regimes mirror it. Ownership is only half the test. Control counts as well, through voting rights, board appointment rights or a shareholders agreement.
Where no individual meets the threshold, most regimes require you to record the senior managing official instead. Do not leave the field blank.
Sanctions ownership works differently from KYC ownership and catches people out. Under the aggregation principle applied by several regulators, an entity can be blocked because listed parties own it in combination even when no single owner is listed. Our explainer on the 50 percent rule in sanctions screening covers how that works. Owner: the compliance analyst. Turnaround: one day for a flat structure, one to three weeks for a multi jurisdiction chain.
Step 7. Risk rating and due diligence tier
Score the customer against your documented factors. Country, industry, product, channel, ownership complexity, PEP exposure and expected activity are the usual inputs. The score maps to a tier, and the tier sets what else you must do.
Simplified due diligence for the lowest tier. Standard for the middle. Enhanced for the top, which typically means source of wealth evidence, senior sign off and a shorter review cycle. Owner: the compliance analyst, with the model owned by the MLRO. Turnaround: automatic if the model runs on structured data.
Step 8. Approval, conditions and sign off
Someone has to accept the risk by name. For standard cases that is the onboarding team lead. For high risk and PEP cases it is usually the MLRO or a committee.
Approval is not always binary. Conditional approval, where the account opens with restricted functionality until a specific item lands, keeps good customers from walking away while keeping the control intact. Owner: the approver named in policy. Turnaround: one to two days, longer if the committee meets weekly.
Step 9. Handover to ongoing monitoring
Onboarding ends by producing three things for the monitoring system: the risk tier, the expected activity profile, and the next review date. Without the expected activity profile, transaction monitoring has no baseline to compare against and will generate noise for years.
Owner: onboarding operations. Turnaround: same day as approval.
Owners and target turnaround by step
| Step | Owner | Target turnaround | Artifact produced |
|---|---|---|---|
| 1. Intake and product scoping | Relationship manager | Same day | Completed intake record |
| 2. Customer identification | Onboarding operations | Same day | Structured identity fields |
| 3. Document collection | Onboarding operations | 2 to 10 business days | Indexed document set |
| 4. Verification | Onboarding operations | Minutes to 2 days | Verification result and registry extract |
| 5. Screening | Compliance analyst | Same day to 2 days | Dated screening report with alert dispositions |
| 6. Beneficial ownership | Compliance analyst | 1 day to 3 weeks | Ownership chart to natural persons |
| 7. Risk rating | Compliance analyst | Automatic | Score, tier and factor breakdown |
| 8. Approval | Team lead or MLRO | 1 to 2 days | Named sign off and any conditions |
| 9. Handover to monitoring | Onboarding operations | Same day | Activity profile and next review date |
Where KYC onboarding stalls, and what fixes it
Three stages absorb most of the elapsed time.
The document chase loop
An analyst reviews the file, spots one gap, emails the customer, waits four days, reviews again, spots the next gap. Each loop costs days of calendar time and almost no work time.
The fix is a completeness review before the substantive review. One person checks the file against the conditional checklist and sends every outstanding item in a single request. Measure loops per file. Two is acceptable. Five means your checklist is broken.
The ownership chain that will not resolve
A holding company in one jurisdiction owns an entity in another, with a nominee layer in between. Registry data is thin or in another language. Analysts keep pulling threads.
The fix is a stop rule. Set a maximum number of layers you will trace unaided, then escalate to a paid corporate registry search or ask the customer for a signed ownership declaration with supporting evidence. A declaration you have challenged and tested is a legitimate outcome. An unresolved chain sitting in a queue is not.
The alert backlog
Fuzzy matching set too wide produces hundreds of weak hits per batch. Analysts drown. Real matches get less attention than they deserve because everything looks the same.
The fix is threshold tuning plus a whitelist of previously cleared entities, reviewed on a schedule rather than left to grow forever. Tune with evidence, record the change, and keep the before and after alert volumes. The habits that keep this under control are set out in our denied party screening best practices guide.
What the closed onboarding file has to contain
Assume an examiner will open one file at random and ask you to justify the decision. The file should answer without anyone needing to remember anything.
- Every document collected, with the date received and who reviewed it.
- The verification result, including which source was checked and when.
- The screening report, showing the lists used, the list version or date, the names submitted and the disposition of each alert with a reason.
- The ownership chart, traced to natural persons, with the evidence behind each layer.
- The risk score, the factors that drove it, and any manual override with its written justification.
- The approval, with the approver named and dated, and any conditions attached.
- The expected activity profile and the next review date.
Retention periods are set by your regulator and commonly run for years after the relationship ends. Our guide to record keeping for screening covers what a defensible archive looks like.
KYC onboarding outside financial services
Exporters, importers, freight forwarders and manufacturers run a version of this flow without calling it KYC. The regulatory driver is different. It is export control and sanctions law rather than anti money laundering rules, and the obligation usually attaches to the transaction rather than the relationship.
The practical steps look similar. Identify the counterparty, verify the entity exists, screen it and its owners, understand the end use, then record the decision. Screening is the step you cannot skip, and it is available free through Globalior’s free screening tool.
Metrics that tell you the process works
Four numbers are enough for a monthly review.
- Elapsed time to approval, split by customer type, measured from first contact rather than from when the file was complete.
- Touches per file, meaning how many times a human picked it up. High touch counts point at a workflow problem rather than a staffing problem.
- Alert clear rate, the share of screening alerts discounted as false positives. A rate close to 100 percent suggests thresholds are too wide.
- Abandonment rate, the share of applications that go quiet mid process. Movement here usually traces back to a document request that changed.
Key takeaways
- The KYC onboarding process runs nine steps, from intake through to handover to ongoing monitoring, and every step needs a named owner.
- Product scoping comes before document collection, because the product decides how deep the file has to be.
- Collection and verification are separate steps. A document the customer emailed is not verified until you have tested it against an independent source.
- Screening must cover the entity, its directors, its signatories and its beneficial owners, and every alert needs a written disposition.
- Beneficial ownership under sanctions rules is not the same test as beneficial ownership under KYC rules, and aggregation across listed owners can block an entity nobody listed.
- Most onboarding delay sits in three places: the document chase loop, unresolved ownership chains, and screening alert backlogs.
- Conditional approval, with restricted functionality until a named item arrives, keeps customers without weakening the control.
Frequently asked questions
How long should KYC onboarding take?
An individual with clean documents can be onboarded in minutes to a day when verification is automated. A private company with a straightforward ownership structure usually takes a few days. Complex corporate cases with layered cross border ownership routinely run into weeks. Most of that elapsed time is waiting for documents, not analyst work.
What is the difference between KYC and KYB onboarding?
KYC onboarding verifies an individual. KYB onboarding verifies a business, then runs KYC on the natural persons behind it. KYB adds registry verification, constitutional documents, the ownership trace and checks on directors and signatories. The screening and risk rating steps are the same in both. KYB files are larger and take longer.
Can you open an account before KYC is complete?
Some regimes allow verification to be completed shortly after account opening where the risk is low and controls limit what the customer can do. The permission is narrow and conditional. Check the rule that applies to you rather than assuming it exists, and if you use it, restrict functionality and set a hard deadline after which the account is frozen.
What triggers enhanced due diligence during onboarding?
Common triggers are a politically exposed person among the owners or controllers, a connection to a high risk jurisdiction, an opaque or unusually layered ownership structure, a cash intensive business line, a non face to face onboarding channel, and adverse media. EDD usually means source of wealth evidence, senior approval and a shorter review cycle.
How often should the customer file be refreshed after onboarding?
Refresh cycles are driven by the risk tier. High risk customers are typically reviewed annually, medium risk less often, low risk least often. Event driven triggers matter more than the calendar. A change of ownership, a change of address, a new product, a sanctions list update or unexpected activity should all pull the review forward.
If you want the screening step handled before a customer ever reaches your onboarding queue, start with the free denied party screening tool. For help designing the flow around it, get in touch with the Globalior team.