KYC and CDD rules: are your onboarding controls fast enough?

TL;DR: The UK Money Laundering Regulations 2017 require regulated firms to identify customers, verify identity from a reliable independent source, and keep records for five years, while allowing secure electronic verification that can clear genuine customers faster, according to OneID. The compliance challenge is not proving identity in theory, but building onboarding checks that meet legal assurance without turning verification into a conversion bottleneck.

Editorial analysis by NHI Mgmt Group, based on content published by OneID: “The Money Laundering Regulations 2017: KYC and CDD requirements explained”.

By the numbers:

• The same data lifted new-customer onboarding by around 15%.

Key questions

Q: How should financial institutions automate KYC checks without slowing customer onboarding?

A: Financial institutions should use KYC APIs to automate identity checks at onboarding, because manual review is slow, resource-intensive, and harder to scale.

Q: Why do single-source identity checks create risk in customer onboarding?

A: Single-source checks often fail because they collapse coverage and assurance into one lookup.

Q: What breaks when customer due diligence is treated as a one-time onboarding step instead of an ongoing control?

A: When due diligence stops at onboarding, organisations can miss changes in ownership, behaviour, geography, or transaction patterns that alter risk after the account is opened.

Practitioner guidance

• Define the identity evidence standard Specify which independent sources count for each risk tier and require teams to document why those sources are reliable enough for the relationship.
• Separate verification from screening Keep customer identity verification distinct from sanctions, PEP, transaction monitoring, and affordability checks so each control has a clear owner and failure mode.
• Test thin-file onboarding paths Measure how often legitimate applicants fail a credit-reference-only check and whether secondary sources recover them without weakening assurance.

Bottom line: The article frames KYC as a legal assurance problem, not just a user-experience problem, because regulated firms must verify identity from independent evidence.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →