1. Is this person real?
Verify the identity document and that it belongs to the applicant before anything else. Every later check is only as good as the name it runs on.
Guide — KYC screening
KYC screening for fintech: what it covers and how to run it
A practical guide for fintech compliance teams — the checks a complete KYC screen needs, when to run them again after onboarding, and the mistakes that turn a clean result into a weak file.
The basics
What KYC screening is
Know Your Customer (KYC) is the part of an AML programme that establishes who a customer is and how much risk they bring. Screening is the step that checks that person — or that business and the people behind it — against the sources that would change the decision: sanctions and watchlists, politically exposed persons, adverse media and court records.
For a fintech the obligations are the same as a bank’s, but the setting is not. Customers arrive through an app rather than a branch, volume moves with marketing rather than headcount, and nobody meets the applicant. The screen has to run on its own, at onboarding and afterwards, and still leave a record a reviewer can follow.
What it covers
The six parts of a complete KYC screen
A sanctions check on its own is not KYC screening. Each part below answers a different question, and a gap in any one of them is a gap in the file.
2. Are they sanctioned?
A sanctions match is a stop, not a risk factor. It has to be resolved — true match or false positive — before the relationship goes any further.
3. Are they politically exposed?
Being a PEP is not a reason to refuse a customer. It is a reason for enhanced due diligence and senior sign-off — a different outcome from a sanctions hit, so it needs to be recorded as one.
4. What is known about them?
Adverse media and court records catch the risk that never reached a list. Keep the link to each source, so the decision can be checked rather than taken on trust.
5. Who is behind the business?
For merchants and business accounts (KYB), screen the directors and beneficial owners, not just the company name — and record the ownership rather than inferring it.
6. Has anything changed?
Lists change and so do customers. A clean result at sign-up says nothing about next year, which is why screening has to repeat on a cycle set by risk.
When it runs
Onboarding is the first screen, not the only one
Most fintechs build the sign-up check first and leave the rest for later. Below are the four occasions a customer should be screened, what to do at each, and what usually gets missed.
Step
When to screen
What to do — and the usual gap
01
Before the account opens
Verify the identity, then screen the person — and, for a business, its directors and owners — before the account is active. Usual gap: A business account opened on the company name before the people behind it were screened.
02
When the book changes hands
A new provider, a migration or an acquired portfolio: rescreen every customer once under your own rules. Usual gap: Old results carried over as if they were your own screening.
03
On a cycle set by risk
Rescreen higher-risk customers more often than the rest, on a cycle your risk assessment sets. Usual gap: One cycle for everyone, so the riskiest files are the least current.
04
When a match is disputed
Give anyone wrongly flagged a route to correction, and record how the match was resolved. Usual gap: The match is cleared, but nobody records why.
Common gaps
Where fintech KYC screening goes wrong
None of these are about the screening tool. They are about how the result is used and kept — which is what a reviewer looks at first.
Every match treated the same
A PEP, a news story and a sanctions entry handled by the same rule. Either good customers are refused, or a real hit is cleared as noise.
A result with no reasoning
“Cleared” with no note of what was checked, against which sources, or who decided. The screen happened; the file cannot show it.
Screened once, never again
The book grows, the lists move, and the only screen on file is the one from sign-up. The older the customer, the weaker the record.
Common questions
KYC screening for fintech, explained
What is KYC screening for fintech?
KYC screening checks who a customer is and whether they carry risk, before and throughout the relationship: verifying their identity, screening them against sanctions, PEP and watchlists, checking adverse media and, for business customers, identifying the beneficial owners. For a fintech it usually has to run automatically inside a digital onboarding flow, rather than as a manual review after the account is open.
Is KYC screening the same as AML screening?
They overlap. KYC screening is the customer-facing part of an AML programme — knowing who you are dealing with and whether they appear on a list or in the news for the wrong reasons. An AML programme covers more than screening, so map each obligation to a control. What SafetyNet covers is set out on the Control coverage page.
What is the difference between KYC, CDD and EDD?
KYC is the overall practice of knowing your customer. Customer due diligence (CDD) is the standard set of checks applied to everyone — identity, screening, the purpose of the relationship. Enhanced due diligence (EDD) is the deeper work applied to higher-risk customers, such as PEPs or those with adverse media: more sources, more context and a more senior decision.
Does KYC screening cover business customers (KYB)?
It should. Know Your Business (KYB) applies the same checks to a company and to the people behind it — directors, members and beneficial owners. In SafetyNet, link analysis maps those connections and KYC::DB records the ownership behind each business customer, so it is documented rather than assumed.
How often should existing customers be rescreened?
That depends on your own risk assessment and on what your regulator and sponsor bank expect — SafetyNet does not set it for you. Ongoing Monitoring supports daily, weekly, fortnightly, monthly, quarterly, half-yearly, yearly or custom cycles, so higher-risk customers can be rescreened more often than the rest of the book.
Can KYC screening run inside our own app?
Yes — most fintechs call it from their onboarding service rather than using a separate screen. How SafetyNet’s API fits into a payments onboarding flow, and what it returns, is covered on the Fintech & payments page.
Putting it into practice
This guide covers the practice. For how SafetyNet runs it inside a payments onboarding flow, see Fintech & payments. For every obligation mapped to a control, see Control coverage.
Ready to strengthen your risk avoidance program?
Join organizations worldwide using SafetyNet to meet KYC, AML and sanctions screening requirements with confidence, speed, and accuracy.