Why do telco KYC programmes fail when agents are paid per capture?

Why the incentive structure breaks KYC integrity

When field agents are paid for each successful capture, the programme stops optimising for evidence quality and starts optimising for throughput. That changes agent behaviour at the point where identity proofing is most fragile, especially if supervisors judge success by volume, acceptance rate, or time to onboard rather than by authenticity of the enrolment.

In practice, the failure is not just “fraud happens”, it is that the payment model creates a predictable shortcut. Agents can treat the process as a document collection exercise instead of a verification exercise, and that makes weak checks look operationally efficient while silently degrading trust in the resulting customer record.

That is why identity proofing and KYC controls need to be designed as integrity controls, not as sales conversion metrics. NHIMG’s Identity Proofing and KYC Guide covers the control surface where document checks, liveness, and synthetic identity defences intersect with customer onboarding.

How false captures become compliant-looking SIM registrations

A per-capture scheme can produce records that satisfy the form of compliance while violating the substance of it. Fake identities, reused photos, and bulk pre-registration all create the appearance of completed diligence, but the subscriber behind the SIM may be unknown, unreachable, or entirely fictional.

That is particularly dangerous in telecom environments because the registration record often becomes the trust anchor for downstream use. Once a SIM is attributed to a “verified” customer, the operator may have reduced visibility into who actually controls the number, which weakens customer accountability, abuse tracing, and response to law-enforcement or fraud enquiries.

At scale, the problem compounds when the same incentive pattern is replicated across branches, dealers, or outsourced channels. A few bad submissions are an operational defect; a channel-wide capture bonus becomes a governance defect, because the programme itself is manufacturing bad identity data faster than manual review can catch it.

The control lesson is straightforward: paid capture only works if the programme also rewards rejection of suspicious enrolments, escalation of exceptions, and evidence quality. FATF Recommendations frame customer due diligence as a risk-based obligation, not a paperwork target, which is exactly why volume-only incentives are misaligned with KYC.

What must change in the operating model

The operating model has to separate compensation from raw acceptance counts. Good programmes pay for quality-adjusted outcomes, not just completed records, and they build enough post-enrolment review to detect patterns such as duplicate imagery, recycled documents, abnormal dealer concentration, or unnatural submission bursts.

Where the channel is distributed, the best practical control is to compare agent behaviour against expected fraud patterns rather than against averages alone. A dealer who is faster than everyone else is not necessarily better; if speed correlates with higher rejection later, stronger exception rates, or unusual reuse of supporting evidence, the incentive design is probably distorting behaviour.

Because this is an access-to-service problem as much as a fraud problem, the enrolment channel should also have tight authority boundaries. If a field agent can approve, override, and finalise the record with little friction, then the workflow invites policy bypass even when the written procedure looks strong.

For telecom operators that expose customer-facing onboarding through digital flows, eIDAS 2.0, the EU Digital Identity Framework is a useful reference point for stronger identity assurance and portable verification patterns, even when the actual onboarding channel is not a wallet-based one.

Risk and Threat Considerations

Per-capture incentives create a structural fraud surface because they reward the agent for getting a record accepted, not for proving that the subscriber is real. Once that incentive exists, attackers and opportunistic intermediaries can industrialise false enrolment, then use the resulting SIMs for anonymity, account abuse, or attribution evasion.

Failure mechanism: the channel converts identity verification into quota fulfilment, so weak evidence, reused photos, collusive captures, and bulk pre-registration can pass through as “completed” onboarding. Over time, the programme accumulates bad trust data that is expensive to unwind and hard to detect from the top-line metrics.

Impact: the operator ends up with a population of SIMs that appear compliant but are not tied to real, accountable subscribers. That increases fraud exposure, weakens traceability, and can turn the KYC programme itself into a liability during audits, investigations, or incident response.

Practitioner Guidance

What to prioritise: redesign compensation before you tune the verification stack. If the channel pays for captured records, any downstream control will be working against the incentive model, so start by changing how success is measured and rewarded.

What to verify: check whether rejection rates, duplicate-document patterns, dealer concentration, and later remediation rates are reviewed by the same team that approves agent payouts. If those signals are missing from performance management, the programme is probably optimising for paperwork, not identity truth.

Common mistake: treating a high approval rate as evidence of a healthy onboarding funnel. In this context, unusually smooth throughput can be a warning sign that the channel is suppressing scrutiny rather than improving customer experience.

Practitioner takeaway: KYC fails when the business pays for acceptance instead of assurance, because the incentive system becomes the attacker’s helper long before any technical control does.

Related resources from NHI Mgmt Group

• How should organizations approach the governance of AI agents?
• What does the 144:1 NHI-to-human ratio mean for IAM governance programmes?
• How can organizations manage unauthorized agents in their systems?
• Why do static KYC reviews fail in modern financial crime programmes?