KYC compliance challenges are reshaping identity verification at scale

At a glance

What this is: This is an analysis of why KYC programmes become expensive and brittle at scale, with Smile Identity highlighting fraud, manual processing, false positives, and customer friction as the main failure points.

Why it matters: IAM, fraud, and compliance teams need to see KYC as a lifecycle and experience problem, not just a regulatory checkbox, because poor verification design drives abandonment, risk exposure, and operational cost.

By the numbers:

• Large financial institutions spend up to $500 million annually on KYC compliance, according to Smile Identity.

Context

KYC is the set of identity verification and risk checks used to confirm a customer is who they claim to be, screen for financial crime exposure, and satisfy AML obligations. The core governance problem is not the existence of KYC, but the cost, latency, and false-positive burden that appear when verification steps are applied without enough risk-based design.

For IAM and identity governance teams, KYC sits at the intersection of human identity proofing, fraud control, and compliance operations. The article's central point is that programmes can meet regulatory intent while still creating poor customer experience and excessive manual work if they are not tailored to risk, geography, and verification method.

Key questions

Q: What breaks when eKYC is treated as a standalone onboarding tool?

A: Lifecycle governance breaks down. A strong initial proof does not automatically fix account recovery, password reset, fraud monitoring, or high-risk transaction controls. If the proofing decision is not carried forward into IAM policy, the organisation ends up with a good front door and a weak interior.

Q: Why do KYC programmes create such high operating costs?

A: Costs rise when verification depends on repeated manual review, exception handling, and duplicate data entry across fragmented systems. The more often staff must interpret documents, resolve mismatches, or recheck records, the more KYC behaves like a labour process instead of a governed identity control. Automation reduces that burden only when the underlying rules are stable.

Q: How should teams reduce false positives in identity detection without missing real attacks?

A: Teams should reduce false positives by enriching identity alerts with lifecycle, workflow, authenticator, and change-management context before the alert reaches an analyst. That lets the system pre-classify onboarding, verified resets, and scheduled changes as expected behaviour while preserving attention for genuinely unsanctioned events. The goal is classification first, then investigation, not the reverse.

Q: Should compliance teams prioritise stronger controls or lower customer friction in KYC?

A: They should prioritise both, but not with the same control path for every user. Stronger checks belong to higher-risk cases, while low-risk customers should move through the shortest defensible journey. The best KYC programme is the one that concentrates scrutiny where it changes the outcome most.

Technical breakdown

Why KYC programmes become operationally expensive

KYC gets expensive when the verification workflow depends on repeated manual review, fragmented data sources, and exception handling for edge cases. Customer identification, document validation, watchlist screening, and risk scoring are not inherently slow, but they become slow when each step is treated as a separate control rather than a single governed workflow. That fragmentation also makes it harder to tune false-positive rates because teams lack a consistent feedback loop between review outcomes and policy rules.

Practical implication: consolidate verification steps into one governed workflow and measure where manual review is creating the most delay.

How false positives and deepfakes distort identity verification

False positives happen when legitimate customers are incorrectly flagged as risky, often because models are overly strict, data is stale, or identity evidence is inconsistent across sources. Deepfakes make this harder because they can imitate faces or videos well enough to defeat basic human review and weak biometric checks. The technical issue is not only detection accuracy, but confidence calibration: systems need enough signal to distinguish genuine variation from deception without overblocking real users. That balance is especially hard when verification models are not trained across the full population they serve.

Practical implication: tune verification logic against real customer populations and review where false positives are driving unnecessary abandonment.

Risk-based onboarding and adaptive verification

The article points to risk-based onboarding as the practical answer to customer friction. In this model, low-risk users complete a lighter verification path, while higher-risk cases trigger stronger checks such as reauthentication, document review, or biometric confirmation. This is an identity governance pattern as much as a fraud control pattern, because the verification burden is assigned according to risk rather than applied uniformly. Done well, it preserves assurance where it matters most and avoids forcing every customer through the same high-friction process.

Practical implication: define onboarding tiers so stronger verification is reserved for higher-risk customers or transactions.

Threat narrative

Attacker objective: The attacker wants to create and use fraudulent customer identities that can bypass verification and enable financial crime.

1. Entry begins when criminals use fake documents, stolen identity data, or deepfake media to present as legitimate applicants.
2. Credential or identity evidence is then harvested through weak document checks, stale databases, or human review errors that allow fraudulent accounts to pass.
3. Escalation occurs when the fraudulent identity is accepted into the onboarding flow and can interact with financial services as if it were genuine.
4. Impact is fraud, compliance exposure, and customer trust loss when the organisation fails to detect the false identity before account creation or transaction abuse.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

KYC is no longer just a compliance control, it is a customer identity governance problem. The article shows that verification design now affects cost, fraud exposure, and onboarding conversion at the same time. That means KYC has to be governed as a lifecycle process, not treated as a single front-door check. Practitioners should manage it as a policy, data, and experience problem together.

False positives are the hidden tax in many KYC programmes. The operational cost is not only the review effort itself, but the customer abandonment and support load created when legitimate users are blocked or delayed. This is where identity teams need clearer thresholds for when automation is acceptable and when a higher-assurance path is justified. Practitioners should measure friction as rigorously as detection.

Risk-based onboarding is the right control pattern, but only if the risk model is maintained. A tiered verification design works when it reflects current fraud patterns, regional regulations, and customer behaviour. If the risk model drifts, the programme either over-verifies low-risk users or under-protects high-risk ones. Practitioners should treat onboarding policy as a living control, not a static workflow.

Confidence in identity verification depends on the quality of the underlying evidence, not just the tooling. Document checks, biometrics, watchlist screening, and database matching all fail differently when the data they consume is stale or inconsistent. The governance lesson is that KYC effectiveness sits downstream of data quality, rule tuning, and operational review. Practitioners should align assurance targets with the actual reliability of their evidence sources.

What this signals

Risk-based onboarding is the practical governor for KYC friction. When verification intensity is tied to customer risk, teams can reduce abandonment without weakening assurance for higher-risk cases. The programme decision is not whether to add more checks, but where to place them so they change outcomes.

KYC effectiveness should be measured as a balance of fraud resistance, verification latency, and customer drop-off. If any one of those metrics dominates the others, the process is probably miscalibrated and will either overblock legitimate users or under-protect the organisation.

For practitioners

• Implement risk-tiered KYC journeys Define separate onboarding paths for low-, medium-, and high-risk customers so stronger checks only trigger when the profile warrants them.
• Measure false-positive friction Track how often legitimate applicants are blocked, delayed, or forced into repeat verification, then tune rules and thresholds against that rate.
• Automate routine verification steps Use OCR, document validation, and structured data capture to remove repetitive manual checks where the assurance value is low.
• Keep regulatory workflows adaptable Build configurable KYC workflows so regional rules, watchlists, and verification thresholds can change without redesigning the whole process.

Key takeaways

• KYC becomes operationally brittle when compliance, fraud detection, and customer onboarding are managed as separate processes instead of one governed identity flow.
• The strongest pain points in the article are high annual cost, manual workload, false positives, and customer friction, all of which point to poor risk calibration.
• Risk-tiered verification, automation of routine checks, and better evidence quality are the controls most likely to reduce cost without weakening assurance.

Key terms

• KYC Compliance: KYC compliance is the set of controls used to verify a customer’s identity and assess whether onboarding meets legal and policy requirements. In practice, it includes collecting identity evidence, checking it against trusted sources, and retaining auditability. The control must be designed to match jurisdiction, risk level, and business model.
• False Positive: A false positive is a scanner result that looks like a secret but is not actually sensitive. In secret governance, false positives matter because they consume analyst time, weaken trust in alerts, and can delay response to the findings that truly change exposure and access risk.
• Risk-based onboarding: An onboarding model that changes verification depth, approval thresholds, and manual review based on customer risk. It uses the same identity workflow differently across geographies, products, and behaviour signals so low-risk customers move quickly while higher-risk cases receive additional scrutiny.
• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.

Deepen your knowledge

Identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.