They should prioritise both, but not with the same control path for every user. Stronger checks belong to higher-risk cases, while low-risk customers should move through the shortest defensible journey. The best KYC programme is the one that concentrates scrutiny where it changes the outcome most.
Why this is not a simple either-or choice
KYC is a control design problem, not a slogan contest. Compliance teams are trying to reduce fraud, sanctions, and onboarding abuse without creating so much friction that low-risk customers abandon the journey. The right answer is to size the control to the risk, then make the default path as short as possible where the evidence supports it.
That means the programme should be risk-based by design, not uniformly heavy. In practice, stronger checks belong where the customer profile, jurisdiction, product, or payment pattern justifies them, while low-risk flows should be kept efficient and well documented. The question is not how strict the controls can be, but where extra scrutiny actually changes the outcome.
What “stronger controls” should mean in a KYC programme
Stronger controls are not just more forms or more manual review. They usually mean better identity proofing, clearer beneficial ownership review, stronger screening logic, and more reliable escalation when something looks inconsistent. A good KYC design recognises that some cases deserve more certainty because the consequence of error is higher.
That is why current AML guidance generally favours risk-based customer due diligence rather than one fixed journey for everyone. FATF’s customer due diligence expectations and jurisdictional guidance such as FATF Recommendations, the AML and KYC framework and FinCEN both point compliance teams toward proportionate controls, where the depth of verification matches the risk. In onboarding terms, that often means simple cases can be handled quickly, while higher-risk cases trigger deeper checks or review.
Where digital onboarding is involved, stronger checks may also need to address document fraud, synthetic identity, and presentation attacks rather than just static form validation. That is why programmes that rely on remote verification often pair policy decisions with proofing methods such as liveness testing, document authentication, and step-up review when signals do not fit the expected profile. For teams building that journey, Identity Proofing and KYC Guide is the most direct internal reference for how the stronger path should be reserved for cases that need it.
How to reduce friction without weakening assurance
Lower friction does not mean weaker controls, it means fewer unnecessary controls on the wrong customers. The cleanest way to do this is to separate the decision to collect evidence from the decision to review it deeply. If the customer is low risk and the signals are consistent, keep the journey short and automate the routine validation. If the signals are inconsistent, escalate only that case rather than slowing everyone down.
The best programmes use tiering, pre-filled data where appropriate, reusable evidence, and clear escalation thresholds. That is also where legal and regulatory operating context matters, because some jurisdictions expect more formal identity and trust-service handling for electronic onboarding. In the EU, eIDAS 2.0, the EU Digital Identity Framework is relevant to how verified identity evidence and wallet-based flows may shape future onboarding patterns, even though the control objective remains the same: know who the customer is, and only add friction where it reduces real risk.
In practice, lower friction should be measured against abandonment, exception rates, false positives, and how often manual review changes the final decision. If the extra steps do not materially improve detection or reduce exposure, they are usually just operational drag. If they do improve confidence in higher-risk cases, they belong there and not in the standard path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | KYC onboarding depends on proving external customer identity. |
| IA-12 — Identity Proofing | Identity proofing is central to customer onboarding assurance decisions. | |
| AC-6 — Least Privilege | Risk-based access and review should limit extra friction to cases that need it. | |
| Recommendation — Use IA-8 to step up proofing when customer risk justifies stronger verification. Apply IA-12 to require stronger proofing for higher-risk onboarding cases. Constrain heightened review and approval paths to the smallest necessary set of cases. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | KYC relies on governing identity evidence and lifecycle during onboarding. |
| A.5.17 — Authentication information | KYC journeys depend on protecting and validating authentication and verification material. | |
| Recommendation — Define identity management rules that vary verification depth by customer risk. Protect authentication evidence and use stronger validation where risk is higher. | ||
Practitioner Guidance
What to prioritise: Build one KYC policy with multiple risk paths, not separate “security” and “customer experience” programmes. The first design decision should be which signals trigger step-up review, because that is what keeps friction targeted rather than universal.
What to verify: Check whether every extra control has a measurable purpose, such as reducing synthetic identity risk, improving sanctions confidence, or catching beneficial ownership ambiguity. If a control cannot be tied to a higher-risk failure mode, it belongs in the baseline review for removal or simplification.
Common mistake: Treating all manual review as strong control. Manual effort that is not focused on the right cases often increases cost and delay without improving assurance.
Practitioner takeaway: The best KYC design is selective, not maximal, and the strongest control is the one applied only when it materially changes the trust decision.
Related resources from NHI Mgmt Group
- How should compliance teams design a KYC process that balances AML obligations with customer friction?
- How should security teams prioritise NHI remediation in cloud environments?
- How should security teams govern non-human identities for compliance?
- How should security teams govern non-human identities for SOC 2 compliance?