KYC operations: separate identity evidence from the access decision

A proposed decision matrix

An identity verification result does not establish affordability, source of funds or suitability for every product.

Name the decision before selecting a check

A document scan, a login challenge and an eligibility decision solve different problems. NIST describes identity proofing through resolution, validation and verification: identifying the claimed person, checking evidence and linking the applicant to it. Its framework does not determine entitlement to a service. Use that distinction to ask what each supplier output actually establishes and which decision remains with the operator.

NIST SP 800-63A-4 — Identity proofing and enrolment

Put required checks at the correct point in the journey

The British Gambling Commission says online gambling businesses must verify age and identity before gambling. Its guidance also explains that businesses should not defer requests until withdrawal when the information could have been requested earlier, while recognising that later legal obligations can arise. This is a British example, not a universal timing rule for every market. Map the applicable obligations before designing the registration and withdrawal states.

Gambling Commission — Age, identity and financial verification

Make the decision record explainable

Our proposed record contains the customer reference, check type, supplier and policy version, evidence timestamps, result category, reviewer where relevant and the reason for the final decision. A pass flag alone is insufficient to reconstruct whether the right control ran. Separate a technical timeout from a failed check and a manual-review referral. Do not automatically translate vendor risk scores into approval without a policy owner defining the interpretation.

Design for legitimate exceptions

Test name changes, transliteration, unsupported documents, accessibility needs and a person who cannot complete the usual device flow. Agree a route that keeps the required assurance while allowing a qualified reviewer to resolve the case. The aim is not to bypass a failed control; it is to distinguish a genuine mismatch from a tool limitation. Give the customer an understandable next step without exposing sensitive fraud-detection rules.

Compare suppliers with a representative test set

Use authorised, appropriately protected test material and a documented evaluation plan. Compare completion, referral and failure rates by supported document and journey type rather than one blended pass rate. Track time to a resolved decision, repeated document requests and successful appeals. Review false accepts and false rejects using a defensible ground-truth process. A supplier with a fast first response may still create an expensive manual queue.

Close the lifecycle

Define when a material change prompts review, how accounts are protected after enrolment, and how evidence access is logged and withdrawn. Document retention and deletion responsibilities with the appropriate privacy and compliance owners; do not invent one universal retention period. Before launch, rehearse vendor unavailability and a disputed decision. Record what remains restricted, how the case is escalated and who can authorise a resolution. Reassess the workflow when the supplier or policy version changes.