How KYC and AML systems work online

Online KYC (Know Your Customer) and AML (Anti-Money Laundering) are not a "formality," but a mandatory control system: identification, customer risk assessment, continuous monitoring of transactions and timely reports to the regulator. The goal is to prevent laundering, terrorist financing, fraud and underage gambling, while maintaining high UX and data privacy.

1) What is KYC and AML - short

KYC: identification and address of the client, age/legal capacity verification, collection of the minimum PII set, risk assessment at the entrance and periodic review (KYC refresh).

AML/CFT: sanction and PEP screenings, suspicious payment pattern detection, limits, manual investigations and STR/SAR (suspicious activity reports) filing.

2) Onboarding: standard KYC stream (5 steps)

1. Data collection: name, date of birth, citizenship, address, contacts; consents and basis of processing.

2. Documents: photo/scan ID (passport/ID-card/water. credential) + sometimes proof of address (utility bill/bank statement).

3. Liveness and biometrics: selfie video/photo, verification of "liveliness," comparison with a document.

4. Validation: MRZ, expiry date, control of fakes, geo-inconsistencies, age barrier.

5. Sanctions/PEP/Adverse media: checking the client and beneficiary on current lists and negative news → risk scoring.

Result: approve/reject/manual review. When manually checking, the case goes to a specialized queue with a checklist and SLA.

3) Customer Risk Rating

Formed from:

Identification factors: documents and their validity, data mismatches.
Georisk: country of residence/source of funds, sanctions jurisdictions.
Behavioral signals: device, proxy/VPN, matches with known fraud networks.
Financial profile: declared source of funds, turnover limits, early transactions.
Scoring breaks down Low/Medium/High into levels and sets the KYC depth (EDD - extended check) and KYC refresh frequency.

4) Ongoing Due Diligence: Post-onboarding Monitoring

Periodic revisions (12-36 months or at risk events).

Permanent sanction/RAP rescreening when updating lists.

Behavioral triggers: bursts of deposits/withdrawals, atypical payment routes, multiple cards, "mules," cross-border transfers, night peaks, communication with other accounts (graph signals).

Case management: alerts turn into cases with priority, checklists, notes, attachments and results (cleared/STR).

5) Transaction monitoring (AML rules & models)

Threshold rules: N deposit/output per period, large amounts, frequent cancellations, splitting (structuring).

Route patterns: fast in/out, rare/custom PSPs, high chargeback rate.

Behavioral ML: anomaly clusters, multiaccounting/collusion graph indicators.

Tuning: TP/FP balance (true/false positives), periodic backtesting on historical data.

6) STR/SAR and regulator interaction

When the case remains suspicious:

The compliance officer forms the STR/SAR (facts, amount, pattern, participants, timeline).
The timing and format of the report depends on the jurisdiction; storage of materials - in an unchanging archive, access only by roles.
The client is not notified of the submission of the report (tipping-off is prohibited).

7) Integrations and architecture (API/Webhooks/buses)

REST/gRPC for synchronous requests (create a KYC case, request a result, get a risk rate).

Webhooks from KYC/sanctions/AML providers: signed HMAC, with anti-replay (timestamp, nonce), retray with deduplication.

Event bus (Kafka/PubSub): transactions, status changes, alerts → SIEM/file store.

Money idempotency: 'Idempotency-Key', unique 'txn _ id', sagas/compensations - so that webhooks repeat does not create takes.

8) UX and the fight against fraud - how to combine

Multistage: basic check in, advanced - only for risk/limit upgrade.

Mobile KYC: camera, OCR, autocomplete, progress bar, clear format and timing requirements.

Friction by signal: tightening only with proxy/VPN, unusual devices, matches by column.

Transparency: Case and ETA status in the interface to reduce support tickets.

9) Data privacy and security (GDPR/security)

Minimization: collect only what is needed; different bases for PII, KYC media, transactions.

Encryption: TLS 1. 2+/1. 3; during AES-256-GCM storage; individual keys and KMS/HSM; limited TTL for KYC photo/video.

Access: RBAC/ABAC, MFA, journals; Just-in-Time is right for investigations.

Legal grounds: contract/legal interest/legal duty; DSR (access/remediation/deletion) processes and retention policy.

WORM archives for logs and investigation materials.

10) Suppliers and quality (vendor management)

Accuracy (match-rate) and delay: CCR/sanction response time ≤ X seconds, liveness accuracy → SLO metrics.

Country/document coverage: ID validators by region, local address databases.

Reliability: uptime, DR plans, transparency of updating sanctions lists.

Audit and compliance: ISO 27001, pen-test reports, DPIA, data processing contracts.

Cost: model "for checking" vs "for successful validation," discounts for volume.

11) KYC/AML performance metrics

KYC pass-rate and average case time (minutes/hours).

False Positive Rate on sanctions/PEP and transactional alerts.

Alert-to-Case Ratio and escalation share in STR/SAR.

Chargeback Rate/Fraud Rate after onboarding.

Cost per Verification and share of manual reviews.

Regulatory SLAs: Meeting response and retention deadlines.

12) Typical errors

"Let's collect everything and then figure it out." Excess data increases risk and cost.

Uniform limits for all markets. Ignoring local rules leads to locks/penalties.

No rescreening. Sanctions lists change daily.

Lack of money idempotency. Webhooks replays → double transactions.

Overzealous WAF/bot check: breaks KYC loading and lowers pass-rate.

Manual investigations without checklists: different officers - different result, no repeatability.

13) Implementation checklist (save)

Basic and enhanced KYC streams understood by SLA and UX
Sanctions/PEP/Adverse media: daily updates, rescreening
Risk scoring and escalation rules (EDD, limits, refresh)
Transactional monitoring: thresholds, scripts, ML signals, backtesting
API/Webhooks with HMAC, anti-replay, retray + money idempotency
KMS/HSM, PII/KYC media encryption, separate storages
WORM archive for cases/logs, SIEM and dashboards
Retention Policies/DSRs, DPIAs, and Provider Contracts
STR/SAR Reporting and Incident Runbook
Quality metrics: pass-rate, FP-rate, TTV KYC, share of manual reviews

14) Mini-FAQ

KYC = one-time check? No, high-risk clients have periodic refresh and constant screening.

Is liveness always needed? For markets with high levels of fraud, yes; for low risk can be triggered by a signal.

Will ML replace the rules? Better hybrid: rules for explainability and regulator, ML - to reduce FP and identify non-trivial patterns.

KYC hinders conversions? Flexible stepping, mobile UX and clear requirements keep the pass-rate high.

Is it possible to store documents "just in case"? No, it isn't. Retention according to the purpose and terms of the law, then removal or crypto-erasure.

Effective KYC/AML online is a coordinated work of technologies, processes and people: clear onboarding with liveness and document check, constant sanctions checks, smart transaction monitoring, reliable data crypto protection and transparent reporting to the regulator. With this approach, the platform blocks financial and legal risks, accelerates "clean" customers and maintains the trust of users and partners.