For a long time, KYC and KYB were treated as bureaucratic steps: the customer fills out a form, sends a document, waits. That model is obsolete. Modern KYC and KYB are an exercise in balancing minimum friction for legitimate customers with relentless rigor against fraud and abuse.
The difference that matters
KYC (Know Your Customer) answers “is this person who they claim to be, and what is their risk?”. KYB (Know Your Business) does the same for companies: identify the business tax ID (CNPJ in Brazil / CUIT in Argentina), validate that the entity exists, map the ownership structure, and understand the commercial purpose.
Both solve distinct questions, but they overlap: KYB often ends in several KYCs, of partners, of ultimate beneficial owners (UBO), of legal representatives. Treating them as separate silos generates rework. Treating them as a single flow generates speed.
Modern onboarding in four layers
1. Personal identity
- Document: structural OCR of ID cards, driver’s licenses, or passports; authenticity validation (microprinting, MRZ, color patterns).
- Facial biometrics: comparison between selfie and document photo, with active or passive liveness to block deepfakes and masks.
- Personal data: validation against official sources (national tax authority (Receita Federal in Brazil / AFIP in Argentina), Bacen / BCRA, bureaus) and cross-referencing with internal databases.
2. Business identity (KYB)
- Business tax ID: direct query to the national tax authority: registration status, activities, share capital, opening date.
- Ownership structure: automated discovery of partners and ownership percentages.
- UBO: identification of the ultimate beneficial owner (direct and indirect control). In structures with holdings, this requires walking through ownership chains, which cannot be done manually at scale.
- Address and activity: cross-validation with official data and consistency checks (a fintech declared as a bakery is a red flag).
3. Purpose and counterparty verification
- PEP: is the customer or any partner a politically exposed person?
- Sanctions and restrictive lists: UN, EU, and local sanctions lists (Coaf / UIF, Bacen / BCRA, and equivalent authorities in Brazil and Argentina).
- Adverse media: relevant news mentioning the customer or partners in a negative context.
- Internal history: was this a customer before? Were they rejected previously? Are they on any internal list?
4. Scoring and decision
The result of the previous three layers feeds a risk score, which combined with the institution’s policy produces a decision:
- Direct approval for low-risk profiles with complete technical validation.
- Approval with monitoring for medium-risk profiles (enhanced monitoring for 90 days, lower limits).
- Analyst desk for cases that require human judgment.
- Rejection with clear reasons and a documented right of appeal.
Where most onboardings still fail
Four failures repeat in onboardings we have seen break:
-
Document as the single source of truth. Anyone relying only on the document loses to deepfakes and document fraud. ALWAYS combine it with biometrics, behavior, and source checks.
-
Validate once and forget. A good customer at onboarding can shift risk in 30 days (became a PEP, was sanctioned, became a partner of a shell company). Perpetual KYC (ReKYC) is the modern standard.
-
Uniform friction for everyone. High friction for a low-risk customer is a lost sale. Low friction for a high-risk one is a loss. Risk-based onboarding adjusts the depth of verification to the profile.
-
Superficial UBO. Accepting the first ownership level keeps the launderer happy. Indirect ownership chains are where real control hides, and where the regulator looks first.
The role of AI
Every layer of onboarding today is powered by specialized models:
- OCR + document classification: reads documents in hundreds of formats, identifies tampering.
- Liveness: passive (no user action) using texture, depth, and motion analysis.
- Face match: compares biometrics with tolerance calibrated by risk profile.
- Ownership discovery: automated extraction and correlation of ownership structures at scale.
- NLP for adverse media: reads news in Portuguese, Spanish, and English and categorizes relevance.
Without AI, this stack demands a large team, a slow process, and inconsistent quality. With well-trained and supervised AI, onboarding drops below 3 minutes for the legitimate customer and accurately blocks the bad actors.
Metrics that matter
If you do not measure, you do not improve. The three essential metrics of modern onboarding:
- Completion rate (CR): % of customers who start and finish. Below 60% indicates excessive friction.
- Average approval time (AAT): minutes from first click to final decision. In mature fintechs, it stays below 5 minutes for most cases.
- Post-onboarding fraud rate: % of accounts that turn into fraud within the first 90 days. Above 1% indicates the pipeline is letting fraud through.
Conclusion
Intelligent KYC and KYB are not a luxury, they are what separates those who will scale healthily from those who will become a regulator’s case study. The good news is that the technology to do it well exists, is accessible, and is mature. The question is whether your product, risk, and compliance team is aligned to implement the complete version, or is still living in the PDF form.
At Guardline, ONP delivers all these layers in a single API. If you want to see how the complete pipeline works, schedule a demo.