How to build a KYC onboarding system
The parts of a know-your-customer and know-your-business onboarding system, how they fit together, the rules behind them and an order to build them in.
What a KYC onboarding system does
A KYC onboarding system checks that customers are who they say they are and that taking them on is within the firm's risk appetite. It collects details and documents, verifies identity, screens against sanctions and politically exposed person lists, scores the risk and sends unclear cases to a person.
For business customers (KYB) it also checks the company in official registries and traces who owns and controls it. After onboarding, the same system schedules periodic reviews and reacts to events that change a customer's risk.
The modules you need
Most teams need all of these in the end. The phased plan below sets the order.
Application flow
A short flow that asks only what this customer type needs, with save and resume so people can come back.
Identity verification
ID document capture and checks, liveness or selfie match, or a national eID login where one exists.
Screening
Sanctions, politically exposed persons and adverse media checks at onboarding and again when lists change.
Risk scoring
A customer risk rating from product, country, occupation, ownership and screening results, with the reasons kept.
Case review
A queue for analysts with all checks in one view, four-eyes approval for high-risk cases and a recorded decision.
Business checks (KYB)
Company registry lookup, directors, and ownership tracing to the ultimate beneficial owners.
Periodic and trigger reviews
Reviews scheduled by risk rating, plus reviews triggered by events such as a new sanctions hit or a change of owner.
Evidence store
Every document, check result and decision kept with time stamps, ready for an audit.
How the parts fit together
- 01
Workflow engine
Each application is a state machine: started, checks running, review, approved, declined or waiting on the customer.
- 02
Vendor adapters
One adapter per ID, screening or registry vendor, so a vendor can be swapped or a fallback added without touching the flow.
- 03
Rules and risk engine
Versioned rules for which checks each customer needs and how risk is scored, so a policy change is a configuration change.
- 04
Case management
Queues, assignment, four-eyes approval and notes for the analysts.
- 05
Evidence vault
Encrypted storage for documents and raw vendor responses, with retention set by law.
- 06
Event log
Who did what and when, for every application and review.
Data model sketch
- 01
Party
A person or a company, with identifiers, addresses and roles.
- 02
Ownership link
Who owns or controls whom, and by how much, for tracing beneficial owners.
- 03
Document
Type, issuer, expiry, extracted fields and the check result.
- 04
Check
Vendor, type, result, score and the raw response, kept as evidence.
- 05
Risk assessment
The rating, the factors behind it and the rule version used.
- 06
Case, decision and review schedule
The analyst's decision with its reason, the approver, and when the next review is due.
Systems it has to talk to
- 01
Identity verification vendors
Document checks, liveness and biometric match.
- 02
Screening lists
Sanctions lists such as the UN, EU, OFAC and UK lists, PEP databases and adverse media.
- 03
Company registries
National business registers and beneficial ownership registers where they are open.
- 04
Digital identity
National eID schemes and eIDAS in the EU, where customers can prove identity by logging in.
- 05
Core and CRM
Opening the account or merchant record in the core system once a customer is approved.
- 06
Credit and fraud data
Credit bureaus and fraud signals where the product needs them.
Rules to design for
Which rules apply depends on your market and product.
- 01
Anti-money-laundering law
Customer due diligence, enhanced checks for higher risk and ongoing monitoring, under each country's AML law and, in the EU, the AML directives and regulation.
- 02
Remote onboarding rules
Guidance such as the EBA guidelines on remote customer onboarding sets how digital ID checks must work in the EU.
- 03
Record keeping
Keep due diligence records for the period the law sets, which in the EU is generally five years after the relationship ends.
- 04
Data protection
Biometric data used to identify people is special-category data under the GDPR, so it needs a lawful condition and tight retention.
- 05
AI and biometrics
Remote biometric identification is high-risk under the EU AI Act. Verification that only confirms a person is who they claim is excluded, so check which one you do.
From prototype to production
Build in this order so something real is in users' hands early.
- 01
Clickable prototype
The customer flow and the analyst's review screen for one customer type, tried with real users before code is written.
- 02
One segment live
Individuals in one country in production: ID checks, screening, risk rating, case review and the evidence store.
- 03
Business customers and refresh
KYB with ownership tracing, periodic and trigger reviews, and screening re-runs when lists change.
- 04
Scale
More countries and document types, fallback vendors, and tuning the rules to cut manual reviews.
What drives the cost
These decide most of the budget. For a number based on your own scope, use the cost tool. OceanLab bills $30-50/hr or per milestone.
- 01
Countries and document types
Each country brings its own IDs, registries, lists and rules.
- 02
Number of vendors
Each ID, screening or registry vendor is an integration to build, test and monitor.
- 03
Depth of KYB
Ownership tracing through several layers of companies is much more work than a registry lookup.
- 04
Manual review volume
The more cases reach a person, the more the analyst tools matter.
- 05
Refresh logic
Periodic and event-driven reviews across an existing customer base.
- 06
Core system integration
How easily approved customers can be opened in the core or merchant system.
Product builds that match this guide
Keystep - Digital Bank Onboarding with ID, Liveness and Risk-Based Review
An onboarding platform for an Irish digital bank: applicants open a EUR current account from their phone with ID and selfie liveness checks, and a staff console lets onboarding and financial crime teams review the cases the rules cannot decide, through to an issued Irish IBAN.
Gija - KYC and KYB Case Management with Ownership Tracing and Four-Eyes Approval
Designed and built a clickable KYC and KYB case-management platform for a Vilnius electronic money institution: a case queue with SLAs, individual and business cases with registry comparison and beneficial ownership traced through every layer, an explainable risk score, four-eyes approval and requests for information sent to customers.
Gantry - Merchant Onboarding and KYB Platform with Four-Eyes Underwriting
Designed and built a clickable merchant onboarding and KYB console for a CBN-licensed payment gateway in Lagos: an applications queue, a case review that checks CAC, BVN, NIN, liveness and the settlement account name in one place, an underwriting workbench with an explainable risk score, limits and rolling reserves, and four-eyes approvals bound to each approver's mandate.
Sampan - KYC Refresh Platform for Periodic and Trigger Reviews
Designed and built a clickable KYC refresh platform for a Hong Kong bank's existing customers: periodic reviews by risk tier, reviews opened by trigger events, pre-filled case files that show what changed, risk re-rating and a fair, documented ladder for customers who do not respond.
VaultGo - Self-Custody Onboarding & Recovery for First-Time Holders
Built a focused onboarding, recovery-phrase backup and PIN/biometric setup flow for a Japanese self-custody wallet - designed to convert first-time holders into confident self-custodians, shipped in 8 weeks.
Two ways to work with OceanLab
Project build
We design and build the system as one project. It starts with a clickable prototype your team tries before any production code is written. Pay per milestone (outcome-based) or hourly at $30-50/hr, depending on role and seniority.
Embedded engineers
Our engineers join your team on a flexible monthly retainer. Part-time is fine and it runs month to month, with hours that overlap the US, UK and Europe, the Middle East, and Australia and Asia. Outcome-based or $30-50/hr.
Questions
Should we use one KYC vendor or several?
Start with one per check type, behind an adapter. Add a second when coverage, cost or uptime calls for it. The adapter is what keeps that change small.
How do we cut onboarding drop-off?
Ask only what the customer's risk needs, let people save and come back, run checks in the background while they continue, and send only unclear cases to manual review.
What is the difference between KYC and KYB?
KYC checks individual customers. KYB checks a business: that it exists, who runs it, and who ultimately owns or controls it, then runs KYC on those people.
