KYC Onboarding in Banks: The Step-by-Step Process (and Where It Breaks Down)
How KYC onboarding actually works in a bank — the data captured at account opening, who must be identified and screened, the review stages that follow, and the failure points that turn a ten-minute application into a two-week wait.
Know Your Customer (KYC) is the discipline of establishing who a customer is — and whether the bank should do business with them — before an account is opened. KYC onboarding is where that discipline meets reality: the sequence of data capture, document collection, screening and review that runs between "submit application" and "account opened".
Most banks do not fail KYC onboarding for lack of policy. They fail it in execution: data captured on paper and re-keyed, declarations filed separately from the application, people connected to the account who were never screened, and reviews that stall because nobody can see where an application is waiting. This article walks the process step by step, for individuals and entities, and flags where it breaks down.
What is KYC onboarding?
KYC onboarding is the front-loaded part of a bank's KYC obligations: identifying the customer and the people behind the customer, collecting the evidence, making the required declarations, screening the parties involved, and recording a review decision — all before the account goes live. It is the moment of maximum leverage for compliance, because everything captured here is structured, current, and given voluntarily by an applicant who wants the account. Everything missed here has to be chased later, under remediation pressure. (Ongoing monitoring after the account opens is a separate discipline — that is the domain of AML compliance software.)
Step 1 — Identify the customer
What "the customer" means depends on the kind of account, and a serious KYC system treats each kind differently from the first question:
- An individual: legal name, date of birth, nationality, identity document (national ID or passport), tax identification, residential and postal address, employment and income, and next of kin. The full journey is covered in personal account opening, digitised.
- An entity: registered name, registration number, tax PIN, date and country of incorporation, business type and industry, addresses and contacts — plus the governance layer: directors, shareholders, and the board's authority to open the account. This is KYB — Know Your Business, a superset of KYC.
- A group (a chama or savings group): the group itself, its constitution or registration, its elected officials, and its full member register — every member identified.
- Joint applicants: each holder identified in full, as a person in their own right, never as "the other name on the account."
The classic breakdown at this step: capturing the primary applicant well and everyone else poorly. The account's risk usually lives in the people around it.
Step 2 — Establish who else must be identified
For anything other than a simple personal account, KYC onboarding fans out from the applicant to the people connected to the account:
- Beneficial owners — the natural persons who ultimately own or control the customer, typically at a 10% threshold or above. See beneficial ownership and UBO at account opening.
- Authorized signatories — the people who will operate the account, each with identification and a specimen signature or photo.
- Group members and officials — for group accounts, the register is the KYC population.
- Joint holders — each screened and identified separately.
The test of an onboarding process is whether it derives this population automatically from the application data — every director, owner, member, holder and signatory becoming a screening subject — or whether it depends on an officer remembering to add them.
Step 3 — Capture declarations at source
Two declarations belong inside the application itself, not in a side document:
- PEP status — whether any party is a politically exposed person, which triggers enhanced scrutiny. How this feeds screening is covered in PEP screening at account opening.
- Tax status — FATCA classification and, where applicable, CRS tax residencies and controlling persons. See FATCA and CRS for business accounts.
Captured as structured fields, these declarations route the application automatically — a "yes" on PEP can require an extra approval, a US indicium can require a W-form in the document checklist. Captured on paper, they get filed and forgotten.
Step 4 — Collect the documents
Document requirements follow from everything above: identity documents for each person, registration and tax certificates for entities, resolutions for boards and group meetings, proof of address where required. Two practices separate clean processes from chaotic ones: a checklist driven by the application data (three signatories means three ID slots — created automatically), and per-person tracking so "documents complete" is a fact, not an impression. A worked example for entities is in the business account opening documents checklist.
Step 5 — Screen and review
With the population identified and declarations made, screening and review can run to coverage: every derived subject checked and cleared, with the coverage status visible — "9 of 11 subjects screened" is actionable; "screening done" is not. A compliance officer works the queue, records outcomes, and signs off. The application then proceeds through document verification, the bank's internal review (segment, branch, exceptions, referrals), and approval — each stage with its own owner, queue, and SLA timer, and each decision carrying a recorded reason.
Where does KYC onboarding break down?
Five failure points account for most of the pain:
- Re-keying. Paper or PDF forms transcribed into systems introduce errors precisely where accuracy matters most — names, ID numbers, dates. Capture digitally at source, once.
- Partial screening populations. The company is screened; the third signatory is not. If subjects are derived by hand, they will eventually be missed. Systems should derive them from the data.
- Declarations divorced from the application. A PEP form in a filing cabinet cannot route an application. Structured declarations can.
- Invisible queues. When applications wait in inboxes rather than role-based queues with timers, turnaround time becomes a mystery measured in complaints.
- Unreconstructable decisions. If an auditor asks "who cleared this, and what did they see?", the answer should be a record, not an investigation. That requires an append-only audit trail written as the work happens — the theme of audit-ready account opening.
What good looks like
A KYC onboarding process is working when: the applicant provides everything once, in a guided journey; the system derives everyone who must be identified and screened; declarations are structured data that route the application; documents track per person against a checklist; every stage has an owner and a clock; and the entire history is on the record without anyone doing anything extra.
BAOS — the Bank Account Opening System implements much of that shape across business, personal, group and joint accounts: compliance data and declarations captured at source; every person who needs screening — directors, beneficial owners, group members, joint holders, signatories — worked out once each and listed on the application for your compliance team, with the screening itself running in your screening tool; per-person document checklists; and a review workflow with SLA timers on its steps, where every workflow action is recorded with who did it, in which role, when and from which address. For the wider selection question — what to look for in any system — start with the bank account opening software guide, or book a demo to watch a KYC-complete application move from submission to a recorded account number.
Frequently asked questions
What are the steps in KYC onboarding at a bank?
Five: identify the customer; establish who else must be identified — beneficial owners, authorized signatories, group members and officials, joint holders; capture the PEP and tax declarations inside the application; collect the documents against a checklist driven by the application data; then screen every derived subject to full coverage and record a review decision. All of it happens before the account goes live.
What is the first step in the KYC process?
Identifying the customer. For an individual that means legal name, date of birth, nationality, identity document, tax identification, residential and postal address, employment and income, and next of kin. For an entity it means the registered name and number, tax PIN, incorporation details, business type and addresses, plus the governance layer — directors, shareholders and the board's authority to open the account.
Who must be identified besides the applicant?
The natural persons who ultimately own or control the customer, typically at a 10% threshold or above; the authorized signatories who will operate the account; every member and official of a group account; and every holder of a joint account. A sound process derives that population from the application data automatically rather than relying on an officer to remember to add them.
Where does KYC onboarding usually break down?
At five points: re-keying paper or PDF forms into systems; screening only part of the population (the company but not the third signatory); declarations kept on paper where they cannot route the application; applications waiting in inboxes rather than role-based queues with timers; and decisions that cannot be reconstructed because no append-only audit trail was written as the work happened.
