Identity Verification for Neobanks to Meet KYC at Scale

In July 2025, the Financial Conduct Authority (FCA) fined Monzo £21,091,300 for inadequate financial crime systems and controls between October 2018 and August 2020. The FCA also found that the bank repeatedly breached a later restriction by opening accounts for more than 34,000 high-risk customers. Some customers had even supplied well-known London landmarks as home addresses. This case underscores the importance of robust onboarding and ongoing monitoring to prevent costly regulatory penalties.

The enforcement action shows that a fast digital journey needs strong data validation, customer risk assessment, and post-onboarding controls to prevent control gaps and false rejections, which can undermine trust and growth.

The duties depend on the licensed entity, product, customer, and jurisdiction, so understanding regional compliance helps build confidence in managing varied requirements across the UK, EU, and USA.

How does Identity Verification for Neobanks Work?

There is no single mandatory sequence for every digital bank. A flow may use documents, government or credit databases, electronic IDs, biometrics, or a combination of these methods. The correct mix depends on the law, product risk, and the evidence available for that customer. However, a well-designed neobank onboarding process usually follows seven connected stages, which are essential for effective identity verification and compliance.

1. Collect the required customer information. Capture the name, date of birth, address, and identification details required by the relevant framework. Provide the customer with any required privacy, identity-check, or account-opening notices at this stage.
2. Assess the session before adding friction. Device, network, location, and behavior signals can reveal automation, emulation, data reuse, or inconsistencies. These signals should be collected lawfully and used as risk indicators, not treated as proof of fraud in and of themselves.
3. Verify the identity evidence. Authenticate a government-issued document, compare customer data with an independent source, use an approved digital identity, or combine these methods. The evidence must be suitable for the relevant market and risk level.
4. Bind the evidence to the applicant. Where the journey uses biometrics, compare the live face with the identity record and apply liveness or injection defenses. This helps prevent a valid identity document from being used by the wrong person.
5. Screen the customer for relevant financial crime risk. Run sanctions, politically exposed person, watchlist, and adverse media checks required by law and internal policy. The exact screening scope differs by market and customer risk.
6. Make and explain the decision. Approve a complete low-risk case, request more evidence, route the case to review, or reject it. Reason codes and the evidence behind the outcome help analysts resolve cases and help product teams find avoidable drop-off.
7. Monitor after the account opens. Update customer risk when information, behavior, or screening status changes. KYC should be integrated with ongoing monitoring and re-verification, rather than ending at the approval screen.

No layer works well in isolation. When checks run through a single KYC verification process, the decision can retain the document result, biometric result, screening context, and review history for the same session. This continuity makes exceptions easier to investigate and produces a clearer audit trail.

What KYC Requirements Apply to Neobanks?

A licensed digital bank does not receive a lighter rulebook simply because it serves customers through an app. A financial app that operates through a sponsor bank, by contrast, may perform some onboarding tasks, but the parties still need to define who performs, reviews, and evidences each control. Two companies marketed as neobanks can have very different legal duties.

Across major markets, the recurring expectations are to identify the customer, verify the identity using suitable independent evidence, apply a risk-based approach, keep records, and monitor the relationship. However, the specific data, timing, screening,g and escalation requirements differ.

The FCA’s April 2022 review of six challenger banks covered more than 8 million customers. It found inadequate checks on income and occupation at some firms, and some banks had no customer risk assessment in place for certain customers. The regulator’s conclusion remains useful: fast account opening cannot come at the expense of robust financial crime controls.

How Can Neobanks Reduce Identity Fraud Without Blocking Genuine Customers?

A document check answers whether an identity document appears valid. It does not, by itself, prove that the applicant controls the identity, understands the application, or intends to use the account lawfully. Fraud prevention must therefore combine identity evidence with session context, reuse patterns, and account-opening risk.

Relevant signals can include device integrity, IP and location consistency, impossible travel, repeated identity data, copy-and-paste behavior, abnormal completion speed, and links to earlier applications. However, one weak signal should rarely decide the case. A risk engine should combine signals, preserve the reasons, and route uncertain cases to a proportionate next step.

Use risk-based friction

• Let complete, low-risk applications follow the shortest path permitted by the applicable policy.
• Ask for stronger evidence, such as NFC, an eID, an additional document, or a fresh biometric capture, when the risk signals justify it.
• Send ambiguous cases to trained review with the evidence and reason codes already attached.
• Reject or restrict the application when the evidence cannot support a reasonable, policy-compliant decision.

Measure conversion and risk together.

Approval rate alone can hide fraud, while rejection rate alone can hide lost customers. Therefore, teams should review the funnel with both commercial and risk outcomes in view.

• Completion, approval, and abandonment rates by journey stage, false rejection, retry, and successful recovery rates, manual-review rate, queue age, and analyst overturn rate
• Confirmed fraud, account misuse, and financial loss after approval
• Performance by country, document type, device, and customer segment. The effect of each rule change is tested through a controlled pilot before full rollout

What Breaks When Neobank Identity Verification Scales?

The most damaging problems are usually ordinary control gaps repeated at high volume. Three failure modes deserve attention before a new market, product, or acquisition campaign goes live.

Growth Outpaces Control Capacity

Cloud infrastructure can quickly absorb more applications, but investigators, review queues, rule governance, and quality assurance do not scale automatically. The FCA said Monzo’s controls failed to keep pace as its customer base grew almost tenfold, and the bank later opened more than 34,000 high-risk accounts in breach of a restriction. Therefore, volume forecasts should include the expected number of exceptions, reviews, and alerts, not just successful sign-ups.

False Rejections Remain Hidden Inside the Funnel

A single overall pass rate does not show whether genuine customers failed because of glare, an unsupported document, a poor translation, a database mismatch,h or an overly strict rule. Many of those customers may leave without trying again. Teams should keep stage-level reason codes, offer safe recovery routes, and compare approval quality before and after each rule change.

Cross-Border Coverage is Assumed Rather Than Tested

Each market introduces different documents, scripts, address formats, data sources, and fraud patterns. A model that performs well on one country’s passports may perform differently on another country’s identity cards. Before launch, test the documents and customer conditions expected in that market, then monitor pass rates and review outcomes by document type and language.

How Shufti Helps Neobank Verify Customers at Scale

Shufti manages the full compliance lifecycle in one configurable workflow, from sign-up and onboarding through authentication, monitoring,g and remediation. Teams route checks by geography, product, CT, and risk, and reason codes with case context explain every flagged decision- the same stage-level visibility this article recommends for reducing false rejections. 

For cross-border operations, Shufti verifies 10,000+ actively processed document types across 240+ countries and territories, in 150+ languages. The linked QQ Pay case study describes how one KYC and AML platform supported its expansion. Founder and CEO Maninder Bhullar said, “We are building toward a digital bank model, modular, globally compliant, and crypto-ready, and Shufti is helping us get there.”