KYC now spans identity proofing, fraud and pKYC scale

At a glance

What this is: This is Alloy’s explanation of how its KYC approach combines identity verification, due diligence, AML screening and perpetual monitoring across the customer lifecycle.

Why it matters: For IAM-adjacent identity teams, the key issue is that KYC governance now depends on continuous risk reassessment, evidence integrity and workflow control, not just initial identity proofing.

By the numbers:

• Over 900 of the world’s top financial organizations use Alloy, according to the article.

Context

KYC sits at the boundary between identity verification, fraud prevention and financial crime control. When customer risk changes after onboarding, point-in-time checks stop being enough, because the governance problem is not only who the customer was at entry but whether the organisation can keep reassessing them as their profile, behaviour and exposure change.

The article frames that problem through a full lifecycle model that includes onboarding, enhanced due diligence, sanctions and watchlist screening, and periodic review. That is a familiar pattern in regulated financial services, but it is increasingly relevant to any identity programme that needs to keep decisions current rather than merely compliant. Identity proofing and KYC matters here because the first trust decision is only the beginning.

Key questions

Q: How should organisations design a KYC programme that scales across different customer risk levels?

A: A strong KYC programme uses a risk based model rather than a one size fits all process. Start with customer identification, then apply standard due diligence for most cases, enhanced due diligence for higher risk relationships, and simplified due diligence only where risk is clearly low. The programme should also define record keeping, list screening, and periodic review so onboarding and compliance stay aligned.

Q: Why do identity verification programmes fail when they stop at onboarding?

A: Because a verified account can still become fraudulent later. Onboarding only proves that the identity looked acceptable at one moment, while fraud, mule activity, and laundering risk emerge after the account becomes active. Strong programmes keep behavioural and transaction context attached to the identity record so later activity changes the risk posture.

Q: What are the signs that a KYC program is not keeping pace with customer risk?

A: Common warning signs include slow onboarding, frequent manual review exceptions, poor detection of unusual activity, and inconsistent risk scoring across customer groups. If an institution still relies heavily on paper checks or cannot update customer risk profiles as behaviour changes, its KYC process is likely underpowered. That creates blind spots in both compliance and fraud prevention.

Q: What should compliance teams do when AI is used to triage KYC cases?

A: They should require traceable evidence, human override paths and a complete audit trail for every recommendation the system makes. AI can help with summarisation and watchlist triage, but it must not obscure why a case was marked low, medium or high risk. Accountability still has to rest with the programme.

Technical breakdown

Why identity verification is only the first KYC control

Identity verification answers a narrow question: does the person exist and do the submitted attributes match enough evidence to establish a baseline? In regulated onboarding, that is necessary but not sufficient. KYC extends the control set by adding business purpose, beneficial ownership, transaction expectations and ongoing risk context. The technical problem is orchestration across multiple evidence sources, because a single API response cannot capture the full risk picture. Risk-based routing then determines whether the case stays in a low-friction path or is escalated to manual review or enhanced due diligence. See the Identity Proofing and KYC Guide.

Practical implication: Treat verification as an entry control and design separate decision paths for higher-risk applicants.

How CDD and EDD change the decision model

Customer due diligence evaluates whether the customer profile makes sense for the relationship, while enhanced due diligence increases scrutiny when signals indicate elevated risk. This is not just more data collection. It is a conditional decision model in which PEP status, geography, source of funds and transaction patterns trigger additional evidence requirements. The control value comes from forcing the programme to explain why an application is acceptable, not merely whether it is authentic. That reduces blind approval of customers who pass identity checks but still represent unacceptable financial crime exposure.

Practical implication: Build escalation rules that require additional evidence when risk signals exceed predefined thresholds.

What perpetual KYC requires technically

Perpetual KYC shifts governance from periodic recertification to continuous or event-triggered review. The mechanism depends on detecting changes in PII, account activity and transaction behaviour, then re-opening the case or stepping the customer up for re-verification. That is materially different from a static annual review. The workflow must preserve prior evidence, compare it with new signals and maintain a defensible audit trail for why a refresh was or was not triggered. In practice, pKYC is a state-management problem as much as a screening problem. See the NHI Lifecycle Management Guide.

Practical implication: Instrument trigger conditions so customer risk changes reopen review workflows automatically.

Threat narrative

Attacker objective: The objective is to exploit stale trust in an approved customer relationship so illicit activity can continue without timely detection or escalation.

1. Entry occurs when a customer passes initial onboarding checks but later accumulates risk signals that were not visible at the start of the relationship.
2. Credentialed or attributed trust is then reused as if it still reflected the customer’s current risk posture, allowing the relationship to continue without new scrutiny.
3. Impact follows when sanctions, adverse media or transaction anomalies are missed between review cycles, creating compliance exposure and potential financial crime blind spots.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

KYC governance is now a lifecycle control problem, not a front-door verification problem. The article shows that identity proofing, CDD, AML screening and pKYC have to work as a connected decision system, because a customer’s risk profile can change after approval. That shifts the governance burden from proving who someone is once to maintaining a defensible risk state over time. Practitioners should treat KYC as an identity lifecycle programme with continuous evidence refresh, not a one-time onboarding gate.

Continuous risk reassessment: the right named concept for modern KYC is the shift from static onboarding certainty to ongoing trust recalibration. The article’s pKYC model illustrates why periodic reviews alone cannot keep pace with changes in PII, account activity and transaction behaviour. This is also where fraud and identity governance converge: a valid identity can still sit inside an evolving risk profile that deserves renewed scrutiny. Practitioners should design controls around change detection, not calendar-driven reassurance.

Agentic AI in KYC only works when the audit trail is stronger than the automation. The article’s AI Assistant is positioned around corroboration, triage and case summarisation, but the real governance question is whether every recommendation, evidence source and override is preserved for review. In regulated identity workflows, automation cannot be allowed to blur accountability. Practitioners should insist on decision traceability before scaling AI-assisted review.

The most important control question is not speed, it is escalation quality. The article emphasises routing high-risk cases to additional verification or manual review, which is the right architectural pattern for regulated identity programmes. The weakness in many KYC stacks is not lack of data, but inconsistent thresholds and weak case escalation logic. Practitioners should measure whether risk signals actually change the path a case takes.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.
• Read next: NHI Lifecycle Management Guide

What this signals

pKYC is becoming the practical answer to stale trust. Once customer risk can change through account activity, sanctions exposure or new adverse media, periodic reviews are too blunt to carry the governance load. The programmes that will hold up are the ones that can reopen cases automatically when risk changes, not just re-run them on a schedule.

AI assistance in compliance will be judged by traceability, not by how much work it removes. In identity-heavy workflows, automation is only acceptable when reviewers can see the source of each recommendation and when the system preserves a full decision history. That makes case provenance a governance requirement, not a nice-to-have.

The real KYC control gap is threshold drift. If escalation rules are not tuned to actual risk signals, high-risk customers can keep flowing through the low-friction path while analysts drown in false positives. Practitioners should focus on whether the workflow changes when the signal changes, because that is where KYC becomes operationally real.

For practitioners

• Implement risk-based escalation rules Define the signals that trigger enhanced due diligence, step-up verification or manual review, then test them against real case outcomes.
• Separate identity proofing from ongoing risk review Keep onboarding evidence, sanctions screening and lifecycle monitoring as distinct control layers so a clean initial approval does not mask later risk.
• Preserve a complete decision audit trail Record every evidence source, override, recommendation and final outcome so reviewers can reconstruct why a case was approved or escalated.
• Calibrate AI-assisted review around explainability Require the system to surface the sources behind watchlist hits, application summaries and risk flags before analysts rely on its recommendations.

Key takeaways

• KYC is increasingly a lifecycle governance problem because customer risk can change after initial verification and approval.
• The article highlights a layered control model that combines onboarding checks, CDD, AML screening and pKYC escalation.
• Practitioners should focus on trigger quality, auditability and evidence traceability rather than treating automation as a substitute for governance.

Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Segregation of Duties (SoD) Guide · NHI Lifecycle Management Guide · Fraud Prevention Guide for Digital Businesses

Key terms

• Customer Due Diligence: Customer due diligence is the process of verifying a customer’s identity and understanding the risk attached to that relationship. Wallet-based presentations can streamline it, but the institution remains accountable for deciding which attributes are trusted and how exceptions are handled.
• Enhanced Due Diligence: Enhanced due diligence is the higher-intensity review applied when a customer or related party presents elevated risk. It usually means deeper source-of-funds checks, closer monitoring, stronger approval requirements, and clearer evidence retention so the institution can justify why the relationship is acceptable.
• Perpetual KYC: Perpetual KYC is a continuous review model that re-evaluates customer identity and risk whenever defined triggers occur. Instead of relying on annual refresh cycles, it uses live events, profile changes, and monitoring outputs to decide when re-verification or updated review is required.
• Risk-Based Authentication: An access model that changes verification requirements based on the estimated risk of the request. It combines identity assurance, device posture, application sensitivity, and contextual signals to decide whether to allow, block, or step up verification before access is granted.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is suitable for practitioners building stronger identity governance across human, machine and AI-driven workflows.