Onboarding

What onboarding actually covers

Onboarding is the end-to-end process of bringing a new customer into a regulated relationship, from first collecting their information through to clearing them to actually transact. It’s the point where identity verification, document checks, beneficial ownership identification, sanctions and adverse media screening, and risk classification all have to happen, in sequence, before an account genuinely opens.

Onboarding isn’t a single check. It’s the operational assembly of every other KYC component into one workflow a customer actually experiences, which is exactly why it’s both the most compliance-critical and the most friction-sensitive part of the relationship.

The full sequence, step by step

A complete onboarding flow typically runs through a consistent sequence: collect the customer’s identifying information; verify that identity against reliable, independent evidence, usually a document check paired with biometric matching; for a business customer, identify and verify beneficial owners; screen the customer and any beneficial owners against sanctions, PEP, and adverse media sources; assess and classify risk, determining whether simplified, standard, or enhanced due diligence applies; and, only once all of that clears, activate the account.

Each step depends on the ones before it. A risk classification made before screening is complete isn’t a real classification; it’s a placeholder that has to be revisited once the actual results come in.

Where the risk-based tiering decision actually happens

Risk tiering is the decision point that determines how much of the rest of onboarding actually needs to happen. A customer whose profile supports simplified due diligence moves through a lighter version of the process. A customer flagged for enhanced due diligence, a PEP hit, a high-risk jurisdiction, an adverse media finding, needs the deeper version: verified source of wealth, senior management approval, closer initial scrutiny.

Getting this classification right early matters because it determines everything downstream. A customer wrongly classified as standard risk when they should have triggered EDD can pass straight through onboarding without the scrutiny the relationship actually needed.

Why onboarding speed became a genuine competitive metric

Onboarding speed has become a metric firms track and compete on directly, not just an internal efficiency concern. Fenergo’s 2025 survey of 600 senior executives across banks, asset managers, and fund administrators found that 70% of financial institutions had lost clients over the past year specifically due to slow onboarding, up from 67% in 2024 and 48% in 2023, the highest rate the survey has recorded.

That trend line matters more than any single year’s number. It shows onboarding friction getting worse, not better, even as firms have invested heavily in automation and digital verification tools, which suggests the problem isn’t purely technological.

The real cost of getting onboarding wrong

A lost customer during onboarding isn’t just a missed sale. It’s wasted acquisition spend, a damaged first impression that can affect a customer’s willingness to try the institution again, and, at scale, a real drag on growth that compounds over every product cycle a firm runs. Commercial and corporate banking onboarding tends to suffer the most, largely because business customer onboarding carries more inherent complexity, beneficial ownership verification, more documentation, longer risk assessment, than individual retail onboarding.

None of this is an argument for cutting corners on compliance to reduce friction. It’s an argument for building an onboarding flow where the compliance-required steps are efficient by design, rather than treating speed and rigour as a fundamental trade-off.

Digital onboarding vs traditional onboarding

Digital onboarding replaces in-person, paper-based steps with remote equivalents: document capture through a phone camera, biometric matching via selfie and liveness detection, automated database and registry checks, and electronic signature and consent capture, all completed without the customer visiting a branch or mailing documents.

The shift has been close to universal for retail relationships and increasingly common even for more complex business onboarding, though the underlying compliance requirements, verify identity, identify beneficial owners, screen for risk, assess and classify, don’t change. Digital onboarding changes how those requirements get met, not what’s actually required.

Where onboarding friction actually comes from

Onboarding friction tends to concentrate in a few specific, identifiable places: asking for information that could have been auto-populated or verified silently in the background rather than manually re-entered; long forms with no save-and-resume capability, forcing a customer who gets interrupted to start over entirely; document capture flows poorly optimised for mobile devices, where most applicants now actually apply from; and generic, one-size-fits-all flows that put a straightforward, low-risk individual applicant through the same number of steps as a complex business customer.

Each of these is a design problem, not a regulatory requirement. Nothing in AML law mandates a twelve-step form or forces a customer to restart after a dropped connection; those are implementation choices, not compliance necessities.

Perpetual KYC: onboarding that never really ends

Traditional onboarding treats the process as a gate: complete it once, and the relationship is established. Perpetual KYC treats onboarding as the first cycle of an ongoing process, where risk assessment, screening, and monitoring continue for the life of the relationship rather than resetting to a static state once the account opens.

This matters because a customer’s risk profile at onboarding isn’t necessarily their risk profile a year later. Ownership changes, new PEP connections emerge, transaction patterns shift. Treating onboarding as a one-time event that never gets revisited is exactly the gap that shows up repeatedly in enforcement findings tied to weak ongoing monitoring.

Onboarding for individuals vs businesses

Onboarding an individual and onboarding a business follow the same underlying logic but differ substantially in depth. Individual onboarding centres on identity verification and risk classification for one person. Business onboarding adds an entire additional layer: verifying the entity’s own registration and legal status, identifying and verifying beneficial owners through however many layers of ownership exist, and understanding the business’s actual activity well enough to build a meaningful expected-transaction profile, not just a generic industry code.

This is why business onboarding is consistently slower and more resource-intensive than individual onboarding, and why commercial banking shows up disproportionately in onboarding-friction data.

Common onboarding failures regulators actually cite

The onboarding failures that show up repeatedly in regulatory findings aren’t usually about missing a step entirely. They’re about risk classification decisions made too early, before screening results were actually in; documentation collected but never independently verified; beneficial ownership identified at only the first corporate layer rather than traced to a real individual; and onboarding treated as complete the moment an account opens, with no process for catching risk changes afterward.

Each of these reflects a process gap more than an outright absence of controls, which is exactly why regulators increasingly examine the sequencing and documentation of onboarding decisions, not just whether the individual checks technically happened somewhere in the file.

Designing onboarding that’s both fast and defensible

Designing onboarding that’s genuinely both fast and defensible means building automation into the compliance-required steps themselves, rather than treating speed as something achieved by skipping steps. Auto-populating and silently verifying information wherever possible reduces friction without reducing rigour. Save-and-resume capability keeps a genuinely interested applicant from restarting after an interruption. Risk-based flow branching, giving a low-risk individual a materially shorter path than a complex business customer, respects the risk-based principle that governs the rest of AML compliance rather than applying uniform friction regardless of actual risk.

The firms improving fastest on both dimensions, speed and compliance defensibility, treat them as the same design problem, not competing priorities to trade off against each other.

Frequently asked questions

Read more: our ultimate guides, whitepapers and templates

Related guides and resources to help you act on what you just read.