An investment firm that opens accounts online has to answer two questions about every applicant: is this person who they say they are, and may we take them on as a client? A good digital flow answers both, records how, and keeps asking the second question for as long as the relationship lasts.
This article walks through that flow for firms serving clients in any market, from a single country to many. It describes design choices, not legal requirements.
What do KYC requirements mean for your onboarding design?
The rules depend on the firm, where it operates, its licence and its client types, and they change over time. Before designing a flow, firms should confirm their requirements with their compliance team and write them down as a policy.
That policy is what the flow should implement. The checks, the order they run in and what happens to each result should all trace back to it, so that a reviewer can see why an applicant was approved, declined or sent for review.
Step 1: confirm the person is real and present
One-time codes sent to the applicant's phone and email confirm they control the contact details they gave, before any other check runs.
Passive liveness detects printed photos, screens, masks and injected video without asking the user to blink or turn, which keeps the experience simple on any phone. Device and IP signals add context: VPN and emulator detection, IP reputation and duplicate devices can all feed your routing rules.
Step 2: check the identity document and its chip
The applicant scans the photo page of their passport, national ID, residence permit or driving licence. A sound document check reads the data, looks for tampering, checks expiry, and compares the printed page with the machine-readable zone.
Where the phone supports it, the flow can also read the NFC chip on an e-passport or ID card. The chip holds signed data, so reading it and checking it against the printed page is a stronger test than an image alone.
Next, face match compares the selfie with the document photo and returns a similarity score that your rules act on. Face search checks a new face against faces you have already seen or blocked, which catches people applying twice under different documents.
Some flows also need proof of address, read from a utility bill or bank statement with the name, address and issue date extracted, and a questionnaire covering source of funds, occupation and expected activity, asked in the applicant's language.
How should AML screening work for clients from many countries?
AML screening checks the applicant's name against sanctions lists, politically exposed persons (PEPs) and their relatives and close associates, adverse media and any watchlists your institution keeps.
For a firm with clients from many countries, name matching across scripts matters. The same person may appear in their own script on their ID, such as Arabic, and in one of several English spellings on a list. Screening should use fuzzy matching across scripts and transliterations, so a name and its English spelling are recognised as the same person.
What happens when PEP or sanctions screening finds a possible match?
Shared names are common, so many possible matches are not the person on the list. Auto-declining every hit turns away good clients.
A better rule is to score each match, show the reasons it matched, and route every possible match to an analyst. The analyst reviews the evidence and records a decision. Failed biometric checks are a different case: a face that does not match the document can reasonably decline automatically, if your policy says so.
Why ongoing AML monitoring matters after onboarding
Lists change, people take public roles, and news is published after an account opens.
Ongoing monitoring rescreens existing clients when lists update and tells you when a status changes. Transaction monitoring applies your rules to payments and transfers and raises alerts into cases, with the history and evidence an analyst needs in one place. Returning users can re-verify with a selfie instead of a new document, for example before a payout.
How do you verify a business client and its beneficial owners?
Pull company registry data, then identify directors, shareholders and ultimate beneficial owners. Each owner should go through the same individual flow as a retail applicant, and the company itself should be screened.
Why keep a decision record for every applicant?
Keep a record per applicant with every check, its result, the evidence behind it, the reviewer and the reason for the decision. When an auditor or your own compliance team asks why someone was approved, the answer is in one document rather than spread across systems.
How Quantaint Identity & AML fits
Identity & AML arranges these checks into the flow your compliance team designs. A no-code workflow builder sets branches by country, client type or risk, routes uncertain results to manual review, and lets you test two versions of a flow side by side.
It covers documents from over 220 countries and territories, screens names against more than 1,300 global lists including OFAC, UN, EU and UK sanctions, and keeps a decision record for each applicant, available as a PDF. Applicants see your brand, in over 40 languages, including English and Arabic. Your systems receive results through signed webhooks and the API, with SDKs for web, iOS, Android, React Native and Flutter, and hosted verification links.
The same checks can sit in front of account opening for other services, such as a goal-based Robo Advisor. Your institution makes each onboarding decision, holds its own licences and provides the regulated service. Quantaint provides the software that runs the checks and keeps the record; it is not licensed by the SEC or any other market authority.