---
title: "Neobank KYC and KYB onboarding: screen order, tiered limits, and fewer drop-offs"
seoTitle: "Neobank KYC and KYB onboarding: flow, checks, mistakes"
description: "How to design neobank KYC and KYB onboarding: screen order, which checks run when, tiered limits, rejections, RFIs, and what to log for audits."
date: "2026-10-08"
updated: "2026-10-08"
category: "compliance"
author: "BlindPay Team"
howto:
  name: "How to design KYC onboarding for a neobank"
  steps:
    - name: "Collect consent and the basics"
      text: "Show the terms of service and privacy notice first, then ask for name, email, country, and date of birth. Country decides the verification tier, so ask for it early."
    - name: "Capture identity data and documents"
      text: "Collect tax ID, address, and an ID document with a selfie. Use the camera on mobile and check image quality before upload."
    - name: "Submit and show a waiting state"
      text: "Send the data to your verification provider and show a clear waiting screen. Automated checks often finish in about a minute; manual reviews take longer."
    - name: "Handle the decision"
      text: "On approval, open the account with the limits of that tier. On rejection, show what to fix. On a request for information, ask only for the missing items."
    - name: "Raise limits when activity needs it"
      text: "Start every customer on default limits and collect source of funds or other documents only when a customer needs more."
faq:
  - q: "What is the difference between KYC and KYB onboarding in a neobank?"
    a: "KYC verifies a person: identity, address, tax ID, and a selfie against an ID document, plus sanctions and PEP screening. KYB verifies a company: legal name, registration, formation documents, and the people behind it. In the US, beneficial owners are anyone owning 25 percent or more plus one person who controls or manages the company. Business onboarding takes longer because ownership documents usually need a human review."
  - q: "How long does neobank KYC take?"
    a: "Automated KYC can finish in about a minute when the document and selfie are clean. On BlindPay, KYC Standard is automated and typically completes in about 60 seconds. Enhanced KYC, required for individuals from high-risk countries, is reviewed manually and typically takes up to one business day. Business verification always goes through manual review, so plan a waiting state into the app."
  - q: "How do neobanks reduce onboarding drop-off?"
    a: "Ask for the minimum first and defer the rest. Collect country early so you know the tier, use the phone camera for documents, check photo quality before upload, save progress between sessions, and show a clear waiting state. Ask for source of funds only when a customer needs higher limits instead of on day one. Each extra field at signup costs completions."
  - q: "What should a neobank do when KYC is rejected?"
    a: "Tell the user what to fix in plain words, not a code. Common causes are blurry documents, a name or birth date that doesn't match the ID, and a screenshot instead of a photo. On BlindPay, rejection feedback arrives in warning fields on the customer, and a retry means creating a new customer with corrected data rather than editing the rejected one."
  - q: "What should a neobank log for KYC audits?"
    a: "Log who was verified, at which tier, with which data and documents, what each check returned, who reviewed manual cases, and when. Keep sanctions screening results and any requests for information with their responses. US BSA rules generally require records to be kept for five years. Store decisions, not just final statuses, so an examiner can follow the path."
---

Design neobank onboarding as a short funnel: consent, basic details, identity data and documents, an automated check, then a decision with limits that match the verification tier. Ask for more (source of funds, business ownership papers) only when the account needs it. BlindPay runs KYC and KYB inside its API, so the app owns the screens while BlindPay owns the checks for its payment flow.

Onboarding is where most neobanks lose users and where most audits start. This guide covers the screen order, which checks run when, how to handle rejections and requests for information, and what to keep for examiners. It is part of our [guide to building a neobank](/resources/more/how-to-build-a-neobank).

This is educational content, not legal advice.

**Key takeaways**

- Ask for country first. It decides the tier, the documents, and whether review is automated.
- Tiered limits let you approve fast on light data and ask for more only when activity grows.
- Rejections need human-readable fixes. Requests for information should ask only for what's missing.
- KYB is slower by design: ownership and control need a human review.
- Log decisions and evidence, not just statuses.

## What is the difference between KYC and KYB in a neobank?

KYC verifies a person. KYB verifies a business and the people who own or control it.

For an individual, you collect identity data, check an ID document against a selfie, and screen the name against sanctions and PEP lists. For a business, you verify the company exists, then run KYC on its owners. Under the US [beneficial ownership rule](https://www.law.cornell.edu/cfr/text/31/1010.230), that means each person owning 25 percent or more of the equity, plus one individual with responsibility to control, manage, or direct the company. If you need definitions first, start with [KYC vs KYB vs KYT](/resources/more/kyc-vs-kyb-vs-kyt) and [what KYB verifies](/resources/more/what-is-kyb).

## What data should each onboarding step collect?

Collect in the order that gets to a decision soonest. Here is a typical individual flow, with the check each step feeds.

| Step | Screen | Data | Check it feeds |
| --- | --- | --- | --- |
| 1 | Welcome | Terms of service, privacy notice, consent | Legal basis to process data |
| 2 | About you | Name, email, country, date of birth | Tier selection, sanctions and PEP screening |
| 3 | Identity details | Tax ID, phone, address | Identity match, address checks |
| 4 | Document | ID type and country, front, back if needed | Document authenticity |
| 5 | Selfie | Live photo | Face match against the document |
| 6 | Review | Summary and submit | Automated decision or manual review |
| Later | Limits | Source of funds, purpose of transactions | Enhanced review, higher limits |

On BlindPay, the [customer data requirements](/docs/learn/customers) follow this split. KYC Standard asks for the core identity fields, an ID document, and a selfie. KYC Enhanced adds a source of funds document and the purpose of transactions.

## How does business onboarding (KYB) work?

Business onboarding runs company checks first, then KYC on each owner.

1. Collect legal name, tax ID, formation date, country, and address.
2. Upload the formation document and a proof of ownership document.
3. List beneficial owners above 25 percent and a control person, each with their own KYC data.
4. Screen the company and every owner.
5. Route to manual review and show a waiting state.

BlindPay's [KYB document list](/docs/kb/kyb-documents) shows what reviewers expect. Plan for manual review on every business: on BlindPay, KYB Standard always goes to the compliance team for manual review.

## Which checks run when?

Some checks run once at signup, some on every transaction, some on a schedule.

| Check | When it runs | Who usually runs it |
| --- | --- | --- |
| Identity verification | Signup | Verification provider |
| Document and selfie match | Signup | Verification provider |
| Sanctions and PEP screening | Signup, then on list updates | You and your payment provider |
| Country risk tiering | Signup | Your rules plus provider rules |
| Transaction screening and Travel Rule | Each payin and payout | Payment provider |
| Rescreening | When lists change or on a schedule | You and your provider |
| Enhanced review | Higher risk or higher limits | Compliance team |

Sanctions lists change often. The [OFAC sanctions list search](https://sanctionssearch.ofac.treas.gov/) is the public reference for US lists, and our guide on [how often to rescreen](/resources/more/ongoing-sanctions-screening-how-often-to-rescreen) covers ongoing screening.

## How do tiered limits cut drop-off?

Tiers let you approve on less data and ask for more only when the customer needs it.

Instead of asking every user for bank statements on day one, start with standard verification and default limits. When a user wants to send more, ask for source of funds then. The [FATF Recommendations](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html) describe this risk-based approach to customer due diligence.

BlindPay's default limits, measured on the stablecoin amount, show how this works in practice:

| Limit | KYC Standard | KYB Standard | KYC Enhanced |
| --- | --- | --- | --- |
| Per transaction | US$10,000 | US$30,000 | US$50,000 |
| Daily | US$50,000 | US$100,000 | US$100,000 |
| Monthly | US$100,000 | US$250,000 | US$500,000 |

When a customer needs more, a [limit increase request](/docs/learn/limit-increase) goes in with a supporting document, and compliance decides. Our guide to [source of funds requests](/resources/more/source-of-funds-crypto-off-ramps) covers which documents work.

## Worked example: where does a funnel lose users?

Illustrative numbers, not data from any real app. A neobank starts 1,000 signups in a month.

| Step | Users who finish | Lost at this step |
| --- | --- | --- |
| Basics | 900 | 100 |
| Identity details | 780 | 120 |
| Document and selfie | 620 | 160 |
| Automated approval | 560 | 60 (manual review or rejection) |

The document step loses the most. Three fixes target it: use the camera with an on-screen frame, check blur and glare before upload, and let users resume on another device. If the team instead asked for a bank statement at signup, every user would hit a fourth upload. Deferring it to the limit increase moves that friction to the few who need it.

## How should rejections and requests for information work?

Treat them as product flows, not dead ends.

- **Rejection.** Show the reason in plain words and what to do next. On BlindPay, feedback arrives in `kyc_warnings` or `fraud_warnings`, and a retry means creating a new customer with corrected data.
- **Request for information.** Compliance pauses the review and asks for specific items. On BlindPay, a `customer.update` webhook moves the customer to `compliance_request`, you fetch the open [RFI](/docs/learn/rfi), collect only those fields in your UI, and submit them. The status returns to `verifying` while BlindPay re-reviews.
- **Approved with an open RFI.** The customer can transact (`approved_rfi`) while the request stays open. Remind them before it becomes a block.

Statuses to map to screens: `verifying`, `approved`, `rejected`, `pending_review`, `compliance_request`, and `approved_rfi`.

## What should you log for audits?

Log the decision path, not only the final status.

- Data and documents submitted, with timestamps and the tier.
- Each check's result: identity, document, selfie, sanctions, PEP.
- Manual reviewer, decision, and reason.
- Requests for information, responses, and dates.
- Limit changes and the documents behind them.

US BSA recordkeeping rules [require five-year retention](https://www.law.cornell.edu/cfr/text/31/1010.430) for records kept under that chapter. Keep yours at least that long unless counsel says otherwise.

## What are common onboarding mistakes?

- Asking for every document up front, including ones only high-limit users need.
- Asking for country last, after the user has already uploaded a document the tier won't accept.
- Showing a raw error code on rejection.
- Letting users edit identity data after approval without re-verification.
- Running sanctions screening once and never again.
- Logging only `approved` or `rejected` with no evidence.

## How does BlindPay fit?

BlindPay puts KYC and KYB inside the payments API, so a neobank builds the screens and BlindPay runs the checks for its payins, payouts, and virtual accounts.

- **Consent first.** Each customer accepts BlindPay's [terms of service](/docs/learn/terms-of-service) on a hosted page, which returns a `tos_id` you pass when creating the customer.
- **Two KYC tiers.** KYC Standard is automated and typically completes in about 60 seconds. KYC Enhanced adds source of funds and purpose of transactions and is reviewed manually. Individuals from [high-risk countries](/docs/kb/supported-countries) must use Enhanced.
- **KYB with ownership.** Owners above 25 percent are verified with their own KYC data.
- **Statuses by webhook,** so your app can show the right screen at each step.
- **Default limits per tier** with a documented increase path.

Your own obligations still apply to anything outside BlindPay's flow, such as balances you hold in your ledger. For the licensing side, see [do you need a banking license](/resources/more/do-you-need-a-banking-license-for-a-neobank).

## What to do next

Sketch your onboarding screens against the table above, then create test customers on a development instance, where KYC is auto-approved, to wire every status to a screen. The [KYC basics guide](/docs/kb/kyc-basics) lists the photo rules to put on your document screen.