Customer onboarding bottlenecks expose identity verification gaps

At a glance

What this is: 1Kosmos argues that slow, manual identity checks are turning customer onboarding into a conversion and compliance bottleneck, and that automated verification can reduce friction without relaxing assurance.

Why it matters: IAM and identity governance teams need to see onboarding as a control point, because slow verification increases abandonment while exposing gaps in how identity proofing is operationalised across customer journeys.

By the numbers:

• 70% of financial institutions in 2025 lost clients because of slow and inefficient onboarding processes, according to Fenergo research cited by 1Kosmos.
• Human verification has failure rates up to 26%, according to 1Kosmos.

Context

Customer onboarding slows when identity proofing is built as a manual queue instead of a controlled verification workflow. In regulated environments, that delay is not just a user-experience problem. It becomes a governance problem because the organisation is asking customers to wait while the business still has to satisfy KYC, AML, and assurance requirements.

The article focuses on customer identity verification, not non-human identity governance. That makes the primary question one of human identity proofing, workflow design, and control placement: how to preserve assurance while reducing abandonment and operational drag.

1Kosmos frames automation as the response to this mismatch between modern onboarding expectations and paper-based checks. The operational challenge is to speed up verification without weakening the identity evidence needed for regulated customer enrolment.

Key questions

Q: How should fintech teams reduce onboarding friction without weakening identity verification?

A: Start by separating the fields that support a real control objective from the fields that only add inconvenience. Then use verified data to reduce repeated entry, keep KYC evidence intact, and measure drop-off at each step so you can see whether a control is helping or hurting conversion.

Q: Why do slow identity checks cause so much customer abandonment?

A: Because every extra step adds waiting, re-entry, and uncertainty to a process customers expect to finish quickly. When verification takes days, legitimate users often leave for faster alternatives, and the business loses both conversion and revenue even if the control is technically sound.

Q: What are the signs that an onboarding verification process is failing?

A: Common signs include accepting photocopied documents, failing to compare the face capture with the ID photo, and relying on only basic capture and OCR modules. If those gaps exist, the workflow can be bypassed by static images, masks, or altered documents. A weak process also tends to attract bot sign ups and creates inconsistent customer records.

Q: When should identity verification teams use human review alongside automated checks?

A: Human review is most useful when automated checks lack confidence, such as poor lighting, damaged documents, older ID photos, or documents with complex security features. It also helps when organisations operate in regulated environments or need a higher assurance outcome. The practical approach is to treat automation as the default and human fallback as a control for ambiguous or high risk cases.

Technical breakdown

Why manual identity verification becomes an onboarding bottleneck

Manual document review inserts human queueing, inconsistent judgement, and repeated exception handling into identity proofing. Each step, from document intake to authenticity checks to database comparison, adds latency and creates more opportunities for mismatch. The process also scales poorly when the applicant volume grows or when the verification standard has to be applied uniformly across regions and document types. In practice, the bottleneck is not identity proofing itself but the way the workflow forces every case through the same manual path, regardless of risk or document quality.

Practical implication: move repetitive document checks out of human queues and reserve manual review for true exceptions.

How automated KYC reduces friction without reducing assurance

Automated KYC combines document scanning, biometric matching, liveness detection, and authoritative data lookups into one identity proofing flow. The technical shift is from human interpretation to machine-assisted validation of document features, data fields, and proof-of-presence signals. That matters because regulated onboarding needs both speed and evidence. When the system can verify government-issued IDs, compare the applicant to the photo, and cross-check authoritative sources in real time, the organisation reduces abandonment while keeping the assurance bar intact.

Practical implication: design onboarding so the verification stack can prove document validity, person presence, and data consistency in one pass.

Why legacy identity systems struggle with modern fraud and customer expectations

Legacy verification systems were built for slower workflows and narrower threat models. They struggle with deepfakes, high-volume digital intake, and customer expectations for near-instant account opening. That creates a gap between what the business promises and what the control can actually support. When verification cannot distinguish legitimate users quickly, the organisation either adds friction that drives abandonment or loosens controls that increase risk. The technical problem is therefore both speed and resilience: the verification layer has to withstand modern presentation attacks while operating at digital transaction pace.

Practical implication: test whether your onboarding controls can handle deepfake-era fraud without forcing every applicant into manual review.

Threat narrative

Attacker objective: The objective is not account takeover but onboarding failure, where friction, delay, or poor verification causes legitimate applicants to abandon the process.

1. Entry occurs when a customer enters the onboarding funnel and submits identity evidence that must be checked before account creation.
2. Escalation happens when manual review, document mismatch, or repeated exception handling extends the onboarding queue and increases abandonment pressure.
3. Impact is business loss through abandoned applications, delayed revenue, and higher operational cost, while compliance teams absorb the extra review burden.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity proofing has become a conversion control, not just a compliance step: The article shows that onboarding delay now changes customer behaviour as directly as it changes control assurance. When applicants abandon the process, the organisation loses both the relationship and the regulated transaction. The implication is that identity governance has to treat proofing latency as a measurable business risk, not a back-office inconvenience.

Manual review creates an identity assurance paradox: The more the process depends on human review, the more the organisation accumulates delay, inconsistency, and rework. That does not make verification safer in practice, because the control starts to fail on throughput before it fails on fraud. Practitioners should read this as a warning that assurance without operational speed simply shifts the loss from fraud to abandonment.

Friction is now part of the threat model: Customer drop-off, repeated retries, and documentation error are not side effects. They are the mechanism by which weak onboarding design turns identity checks into revenue loss. This is where NIST 800-63 style assurance thinking meets programme reality: the control must work at the speed of the channel, or users self-select out.

Automated verification changes the control boundary, but not the governance obligation: The article’s strongest signal is that automation helps only when it is embedded into a governed proofing journey, not bolted onto a broken workflow. The named concept here is identity verification friction debt. That debt accumulates whenever onboarding design forces legitimate users to pay the cost of manual proofing, and practitioners must track it as part of identity programme health.

Customer identity governance now needs evidence of both accuracy and completion: A high-verification standard is not enough if too many applicants never finish the process. That changes how IAM and IGA leaders should think about onboarding metrics, because completion rate, abandonment, and exception volume all become governance indicators. The practical conclusion is to manage customer identity as an operating model, not a one-time check.

From our research library:

• Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.

What this signals

Identity verification friction debt: onboarding teams accumulate hidden risk every time they make legitimate applicants wait for a control that could have been automated. That debt shows up as abandonment, support load, and slower time to revenue, so it belongs in IAM programme reporting rather than in a separate customer-experience silo.

Modern proofing programmes need to distinguish between assurance quality and journey completion. A control can be accurate and still fail the business if it cannot operate at the speed of the channel, which is why completion rate and exception rate should sit beside fraud detection in governance reviews.

For practitioners

• Instrument onboarding abandonment at each step Track where applicants exit the journey, which documents fail most often, and which verification step creates the longest delay. Use those signals to separate process friction from genuine risk cases.
• Replace manual document queues with automated proofing Use automated document scanning and real-time verification for standard cases, then route only exceptions to human reviewers. Keep the review path narrow so latency does not become the default control outcome.
• Add biometric liveness checks to remote onboarding Require a live capture that proves the applicant is present and matches the identity document. Use liveness to reduce spoofing risk while keeping the application flow digital.
• Tune risk-based routing for assurance level Apply stronger review only when the applicant profile, document quality, or source data inconsistency justifies it. Low-risk applicants should not be forced through the same delay as edge cases.
• Measure verification completion as a governance metric Report completion rate, average verification time, and manual exception volume together so the programme can see whether stronger checks are also creating avoidable drop-off.

Key takeaways

• Slow customer onboarding becomes a business risk when identity checks add enough friction to drive applicants away before verification is complete.
• The article ties manual review and verification delay to abandoned applications, lost clients, and avoidable operational cost.
• The practical fix is to automate standard proofing steps while keeping exception handling, assurance evidence, and regulatory controls intact.

Key terms

• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Liveness Detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions.
• Customer Due Diligence: Customer due diligence is the process of verifying a customer’s identity and understanding the risk attached to that relationship. Wallet-based presentations can streamline it, but the institution remains accountable for deciding which attributes are trusted and how exceptions are handled.
• Access Friction: Access friction is the delay, inconsistency, or effort a person experiences when trying to reach a system or task. It becomes a governance issue when it is high enough to encourage shortcuts, exceptions, or support-heavy workarounds that weaken the intended control model.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.