How to evaluate KYC and digital customer onboarding software

What this software does

Customer onboarding software takes an applicant from the first screen to an account ready to open in the core system. Typical functions include an application form, capture of an identity document with the device camera, a selfie compared with the document photo and checked for liveness, verification of the applicant’s details against data sources, screening against sanctions and other government lists, due-diligence questions about expected activity, beneficial ownership collection for business accounts, a starting customer risk rating, and a queue where staff resolve applications that do not clear.

Some products only verify identity and return a result; others run the whole application and keep the record. Decide early which you are buying, and which system will hold your Customer Identification Program (CIP) record.

The rules that shape the work

For banks, two FinCEN rules under the Bank Secrecy Act set most of what onboarding has to support. Broker-dealers, mutual funds and futures firms have parallel CIP rules elsewhere in 31 CFR Chapter X.

• The Customer Identification Program. 31 CFR 1020.220 requires a written CIP, part of the AML program, with risk-based procedures that enable the bank to form a reasonable belief that it knows the true identity of each customer. Before opening an account the bank must obtain, at a minimum, a name, a date of birth for an individual, an address and an identification number, with limited exceptions.
• Verification. Identity is verified within a reasonable time after the account is opened, using documents, non-documentary methods or both, as the CIP describes. Non-documentary procedures must address, among other situations, a customer who opens an account without appearing in person, which covers most online applications. The CIP must also say when the bank will not open an account, what a customer may do while verification is pending, when an account will be closed, and when a Suspicious Activity Report should be filed.
• Records, lists and notice. The bank records the identifying information, a description of each document relied on, the methods and results of other verification, and how each substantive discrepancy was resolved. Identifying information is kept for five years after the account is closed, and the rest for five years after the record is made. The CIP must also check customers against the government lists of known or suspected terrorists that Treasury designates, and give customers notice, before the account opens, that information is being requested to verify their identity.
• Beneficial owners. The Customer Due Diligence (CDD) rule, at 31 CFR 1010.230, requires procedures to identify and verify the beneficial owners of legal entity customers: each individual who owns 25 percent or more of the equity interests, and a single individual with significant responsibility to control, manage or direct the entity. Identification can use the certification form in the rule’s appendix.
• Ongoing due diligence. Under 31 CFR 1020.210, the AML program includes risk-based procedures to understand the nature and purpose of customer relationships in order to develop a customer risk profile, and to maintain and update customer information, including beneficial ownership, on a risk basis.

On February 13, 2026 FinCEN issued an exceptive relief order under which institutions may limit beneficial ownership identification and verification to a legal entity customer’s first account, to times when they know of facts that reasonably call the earlier information into question, and to what their risk-based ongoing due-diligence procedures require. If you rely on it, check that the software can apply that policy.

Who should be on the evaluation team

• The BSA officer, who owns the CIP and approves the decision rules.
• Deposit operations or member services staff, who will work the exceptions every day.
• Digital banking and product owners, who answer for the applicant’s experience and for how many applicants give up.
• Core banking and IT owners, since approved applications have to create accounts and customer records correctly.
• Information security and privacy, to review how document images, selfies and other biometric data are collected, kept and deleted, including under any state biometric privacy law that applies to you, and who at the vendor can see them.
• Accessibility reviewers, or staff who can test the application with assistive technology.
• Internal audit, as an observer.

Questions to ask and things to test

• Complete an application on a phone yourself, then start another, stop halfway and return later. Note every field you are asked for and whether your policy needs it.
• Run test applications that should not clear: an address that does not match, a failed liveness check, an expired document and a possible sanctions match. See where each goes and what a staff member sees.
• Read each check’s result and reason and ask whether your examiners would accept it as evidence of how identity was verified.
• Open a business account with two beneficial owners and a separate controlling person, and review the certification and verification captured for each.
• Change a decision rule, such as which verification results go to manual review, and review the approval and version history.
• Pull the CIP record for one test customer and compare it item by item with what your procedures require: information collected, documents described, methods and results, and how discrepancies were resolved.
• Ask how you would leave. Can every record be exported in a usable form, to keep for its full retention period?

Common limits to probe

• No check is conclusive. Verification results depend on the services and data sources configured, and your institution decides how each result is used under its CIP.
• Not everyone can finish online. Some applicants cannot complete document capture or a liveness check because of their device, their document type or a disability. Your procedures need another route, and the product should send those applicants to staff.
• Decisions stay with you. The software applies rules your institution sets and approves; it does not replace the BSA officer’s judgment.
• Accounts open in your core. Onboarding tools generally do not hold, fund or move money.
• Onboarding is not monitoring. Ongoing transaction monitoring and suspicious activity reporting usually happen in a separate AML system. Check how the starting risk rating and due-diligence answers reach it.
• Jurisdiction. A product designed for US CIP and due-diligence requirements may not cover other countries’ documents, checks and disclosures.

Implementation risks

• A CIP that does not match the configuration. Update your written CIP to describe the documentary and non-documentary methods the new process uses, and reconcile the decision rules with it before go-live.
• An exception backlog. Strict rules send many applications to staff. Test thresholds at realistic volumes and staff the queue for the first months.
• Two sets of records. Decide whether the CIP record lives in the onboarding tool, the core system or both, and how records made before the switch will be kept and found.
• Notice and disclosures. Check that the CIP notice and account disclosures are presented before the account opens, and that the version each applicant saw is kept.

Related reading on this site

Requirement pages: Bank Secrecy Act and anti-money laundering rules, OFAC sanctions regulations.

In the glossary: KYC and CIP, AML and BSA, OFAC.

This guide describes the category, not any one product. It is general information, not legal advice: for what a rule requires of your organization, read the rule itself or ask your counsel.