How to design neobank KYC and KYB onboarding: screen order, which checks run when, tiered limits, rejections, RFIs, and what to log for audits.
Design neobank onboarding as a short funnel: consent, basic details, identity data and documents, an automated check, then a decision with limits that match the verification tier. Ask for more (source of funds, business ownership papers) only when the account needs it. BlindPay runs KYC and KYB inside its API, so the app owns the screens while BlindPay owns the checks for its payment flow.
Onboarding is where most neobanks lose users and where most audits start. This guide covers the screen order, which checks run when, how to handle rejections and requests for information, and what to keep for examiners. It is part of our guide to building a neobank.
This is educational content, not legal advice.
Key takeaways
KYC verifies a person. KYB verifies a business and the people who own or control it.
For an individual, you collect identity data, check an ID document against a selfie, and screen the name against sanctions and PEP lists. For a business, you verify the company exists, then run KYC on its owners. Under the US beneficial ownership rule, that means each person owning 25 percent or more of the equity, plus one individual with responsibility to control, manage, or direct the company. If you need definitions first, start with KYC vs KYB vs KYT and what KYB verifies.
Collect in the order that gets to a decision soonest. Here is a typical individual flow, with the check each step feeds.
| Step | Screen | Data | Check it feeds |
|---|---|---|---|
| 1 | Welcome | Terms of service, privacy notice, consent | Legal basis to process data |
| 2 | About you | Name, email, country, date of birth | Tier selection, sanctions and PEP screening |
| 3 | Identity details | Tax ID, phone, address | Identity match, address checks |
| 4 | Document | ID type and country, front, back if needed | Document authenticity |
| 5 | Selfie | Live photo | Face match against the document |
| 6 | Review | Summary and submit | Automated decision or manual review |
| Later | Limits | Source of funds, purpose of transactions | Enhanced review, higher limits |
On BlindPay, the customer data requirements follow this split. KYC Standard asks for the core identity fields, an ID document, and a selfie. KYC Enhanced adds a source of funds document and the purpose of transactions.
Business onboarding runs company checks first, then KYC on each owner.
BlindPay's KYB document list shows what reviewers expect. Plan for manual review on every business: on BlindPay, KYB Standard always goes to the compliance team for manual review.
Some checks run once at signup, some on every transaction, some on a schedule.
| Check | When it runs | Who usually runs it |
|---|---|---|
| Identity verification | Signup | Verification provider |
| Document and selfie match | Signup | Verification provider |
| Sanctions and PEP screening | Signup, then on list updates | You and your payment provider |
| Country risk tiering | Signup | Your rules plus provider rules |
| Transaction screening and Travel Rule | Each payin and payout | Payment provider |
| Rescreening | When lists change or on a schedule | You and your provider |
| Enhanced review | Higher risk or higher limits | Compliance team |
Sanctions lists change often. The OFAC sanctions list search is the public reference for US lists, and our guide on how often to rescreen covers ongoing screening.
Tiers let you approve on less data and ask for more only when the customer needs it.
Instead of asking every user for bank statements on day one, start with standard verification and default limits. When a user wants to send more, ask for source of funds then. The FATF Recommendations describe this risk-based approach to customer due diligence.
BlindPay's default limits, measured on the stablecoin amount, show how this works in practice:
| Limit | KYC Standard | KYB Standard | KYC Enhanced |
|---|---|---|---|
| Per transaction | US$10,000 | US$30,000 | US$50,000 |
| Daily | US$50,000 | US$100,000 | US$100,000 |
| Monthly | US$100,000 | US$250,000 | US$500,000 |
When a customer needs more, a limit increase request goes in with a supporting document, and compliance decides. Our guide to source of funds requests covers which documents work.
Illustrative numbers, not data from any real app. A neobank starts 1,000 signups in a month.
| Step | Users who finish | Lost at this step |
|---|---|---|
| Basics | 900 | 100 |
| Identity details | 780 | 120 |
| Document and selfie | 620 | 160 |
| Automated approval | 560 | 60 (manual review or rejection) |
The document step loses the most. Three fixes target it: use the camera with an on-screen frame, check blur and glare before upload, and let users resume on another device. If the team instead asked for a bank statement at signup, every user would hit a fourth upload. Deferring it to the limit increase moves that friction to the few who need it.
Treat them as product flows, not dead ends.
kyc_warnings or fraud_warnings, and a retry means creating a new customer with corrected data.customer.update webhook moves the customer to compliance_request, you fetch the open RFI, collect only those fields in your UI, and submit them. The status returns to verifying while BlindPay re-reviews.approved_rfi) while the request stays open. Remind them before it becomes a block.Statuses to map to screens: verifying, approved, rejected, pending_review, compliance_request, and approved_rfi.
Log the decision path, not only the final status.
US BSA recordkeeping rules require five-year retention for records kept under that chapter. Keep yours at least that long unless counsel says otherwise.
approved or rejected with no evidence.BlindPay puts KYC and KYB inside the payments API, so a neobank builds the screens and BlindPay runs the checks for its payins, payouts, and virtual accounts.
tos_id you pass when creating the customer.Your own obligations still apply to anything outside BlindPay's flow, such as balances you hold in your ledger. For the licensing side, see do you need a banking license.
Sketch your onboarding screens against the table above, then create test customers on a development instance, where KYC is auto-approved, to wire every status to a screen. The KYC basics guide lists the photo rules to put on your document screen.
The evidence examiners expect from automated risk monitoring: a 10-item evidence table, good vs poor practice, SAR timelines, RFIs, and a 30-day plan.
How to add a low-fee remittance feature to a US neobank: when the Remittance Transfer Rule applies, disclosures, 30-minute cancellation, and pricing.
Blockchain payments are legal for businesses in the US, EU, UK, Brazil, and Mexico, under different rules. What each country regulates, as of October 2026.