KYC as a Service for Regulated Firms: A Buyer's Guide

The most common advice on KYC as a service is to compare features, prices and API documentation, then choose the provider that makes onboarding quickest. That's the wrong starting point. A regulated firm can outsource identity checks, but it can't outsource its responsibility for customer due diligence, financial-crime controls or the decisions made using vendor outputs.

A KYC provider is part of your control environment. The true test isn't whether its dashboard looks polished. It is whether your MLRO can explain how the service supports your risk assessment, how staff handle exceptions, and what evidence the firm can produce for the FCA.

Table of Contents

• Why KYC Procurement Is Really a Governance Decision
• The Components of a Modern KYC Service Stack
  • Build the workflow from decision to evidence
• Comparing the Four Delivery Models Side by Side
  • Embedded or managed, with different trade-offs
• How the FCA Pressures Test an Outsourced KYC Stack
  • Ask for the records, not the assurance
• A Practical Vendor Scorecard for Regulated Firms
• A UK Crypto Onboarding Scenario From First Ping to Audit
  • Treat triggers as part of the lifecycle
• Matching the Right Model to Your Firm's Profile

Why KYC Procurement Is Really a Governance Decision

If your shortlist begins with price per check or API latency, you're selecting a technology before deciding what control you need. The FCA's position is less convenient for procurement teams: a firm can't contract out its regulatory obligations and must take reasonable care to supervise outsourced contractors. It also needs enough information from a contractor to assess the effect of outsourcing on its systems and controls, as set out in the FCA Handbook's outsourcing rules.

That changes the vendor question. Don't ask only whether a provider can verify a passport. Ask whether your firm can show who approved the customer, which evidence informed that decision, how an override was authorised, and what happens when identity checks conflict with screening results. If those answers sit across disconnected systems, the vendor's automation may make an unclear process faster.

This is why FCA compliance requirements should shape the procurement brief before a product demonstration. Your operating model should define the firm's risk appetite, the MLRO's role, the provider's operational responsibilities and the firm's own decision rights. The provider can perform checks, organise evidence and route cases. Your firm still owns the control framework and the decisions made within it.

Practical rule: Buy evidence and workflow you can govern, not a pass rate you can't explain.

A defensible selection process starts with the customer and product risks, then specifies what the control must do and what evidence it must retain. Only then should you compare delivery models, test the vendor's coverage, and negotiate oversight and exit rights. A shortlisting exercise that reverses that order usually favours the slickest demonstration, not the strongest control.

The Components of a Modern KYC Service Stack

A KYC service isn't one check. It's a set of connected components that help a firm identify a customer, assess risk, reach a decision and maintain an appropriate record. Treating the service as a single black box makes it difficult to identify which control failed when an outcome looks wrong.

The UK digital-identity sector already reflects this overlap. A UK Government analysis identified 270 firms operating in the market in 2023/24, including 231 dedicated identity providers and 39 diversified firms. The sector generated approximately £2.05 billion in annual revenue, £858 million in gross value added, and supported 10,813 full-time-equivalent jobs. Financial services were served by 85% of providers; among dedicated providers, 42% cited customer onboarding, 37% fraud prevention, 32% KYC/AML support and 20% identity verification for account opening as use cases, according to the UK digital-identity sector analysis. Those figures point to a connected technology-and-controls function, not an isolated identity-check market.

Build the workflow from decision to evidence

Start with the customer record and identity evidence. The service may verify documents and use biometric checks, but the firm also needs to decide what to do when evidence is incomplete, inconsistent or inconclusive. Automation can recommend an outcome; it shouldn't convert an uncertain match into an unexplained approval unilaterally.

Next, consider the risk controls around identity: sanctions and PEP screening, address or residency checks, customer risk scoring, and case-management escalation. Some vendors bundle these tools. Others supply a verification API that must be connected to separate screening, monitoring and case-management products. In either arrangement, ask how the firm can see the evidence and decision path, not merely the final status.

A credible assessment measures operational performance across the workflow. Track straight-through-processing rate, false-positive rate, manual-review rate, median decision latency, abandonment rate and re-verification success. These are proposed measures for your own service assessment, not a claim that any single figure proves compliance. Compare them by customer type and risk path: a headline approval rate can conceal a process that routinely misroutes complex cases or leaves staff without enough evidence to decide.

Comparing the Four Delivery Models Side by Side

The four models in the opening table differ less in their marketing labels than in where they place the work, judgment and evidence. Choose based on your activity, customer mix and internal capacity. Don't select a delivery model only because it promises fewer clicks for the customer.

A pure-play identity-verification API is usually the cleanest choice when a firm has an established compliance operation and needs a specific verification capability. It can support document and biometric checks, but the firm may need to assemble the rest of the process: screening, risk assessment, case routing, monitoring and recordkeeping. This model offers control over system design, but the firm must own the joins between components.

A full AML suite is more suitable when a firm wants a connected workflow for verification, screening and ongoing monitoring. That can make case histories easier to review, but a single interface isn't proof that the workflow matches the firm's policies. Test whether staff can distinguish automated conclusions from compliance judgments and export the underlying evidence.

Embedded or managed, with different trade-offs

Embedded compliance within a core banking or custody platform may reduce integration work where the firm already relies on that platform. Its weakness is potential dependence on the host's workflow and evidence formats. Before buying, check whether the firm can export records, change rules and preserve access if it moves platforms.

A managed or co-sourced service puts more operational work with a third party. That can be useful when internal teams need specialist review capacity, but it doesn't remove the need for an accountable owner, quality assurance or escalation procedures. The contract should say who reviews borderline cases, who can approve exceptions and how the firm can inspect the service.

For each model, calculate total cost across the lifecycle: implementation, ongoing service, manual review, re-verification, exception handling and exit. A low unit price can be misleading if the firm must fund substantial internal work to turn vendor outputs into usable decisions.

How the FCA Pressures Test an Outsourced KYC Stack

A vendor pitch deck often demonstrates how a tool produces a result. An FCA-facing operating model must explain how the firm uses that result. The FCA says cryptoasset applicants using third-party AML tools need to describe their operational use in procedures, rather than only naming a vendor, as set out in its cryptoasset registration guidance. That distinction is where many outsourcing arrangements become thin: the platform is documented, but the responsibilities around it are not.

Supervisory evidence makes the practical risk clear. In 2022/23, approximately 18,000 firms were registered with the FCA for AML and counter-terrorist-financing supervision. The FCA found non-compliance in 4% of firms assessed through desk-based reviews by financial-crime specialists and 14% of those assessed through onsite visits. Weaknesses included inadequate customer and firm-wide risk assessments, due diligence that wasn't sufficiently risk-sensitive or granular, and weak compliance monitoring, according to the FCA's review of financial-crime controls at corporate-finance firms.

The FCA's survey of 270 responding corporate-finance firms found that 28 firms, or 10%, didn't retain documented customer due-diligence evidence, while 73 firms, or 27%, reported not using a customer-risk-assessment form. Approximately two-thirds appeared potentially non-compliant with at least one element of their anti-financial-crime framework. These findings are a warning against assuming that buying a tool creates a working control. A firm still needs documented assessments, evidence retention and monitoring that reflects its risks.

Ask for the records, not the assurance

Test whether staff can produce a decision log, an override log, a manual-review log, periodic re-verification evidence and a clear history of rule or model changes. The firm should also be able to show how it handles a false positive, how an unresolved case is escalated, and who can approve a change to the workflow.

The FCA's CDD multi-firm review found that although most firms had written identity-verification procedures, few gave practical guidance on alternative evidence when a customer lacked standard identification. That makes exceptions part of the control design, not an edge case to leave to staff discretion. A solid anti-money-laundering audit should test what happens when automated checks cannot verify a legitimate customer, as well as whether routine cases are processed correctly.

A Practical Vendor Scorecard for Regulated Firms

Use a weighted scorecard to stop a polished demo from dominating the decision. The weights below are procurement recommendations, not regulatory thresholds. Adjust them to reflect the firm's customer base, product risk and existing systems, but don't let price compensate for missing audit evidence.

Score each provider against documented evidence, not verbal assurances. For UK coverage, test whether the service handles British identity documents, address variations and customers whose evidence doesn't fit a standard automated route. For corporate onboarding, assess how the vendor supports ownership analysis, verification of relevant individuals and escalation where a structure is difficult to understand. The firm's own financial risk assessments should inform the test cases and the weightings.

Disqualify a vendor, regardless of price, if it can't provide UK sanctions and PEP list lineage, a replayable audit log, a clear account of model or rule updates, or access for UK remediation testing. Treat bundled screening with no separate evidence export as a serious weakness. If the firm can't inspect what drove a match or preserve the record independently, it may struggle to explain the outcome later.

Shortlist test: Ask each vendor to replay the same customer cases and show the evidence, decision route and available overrides.

Include representative customer cohorts: British passport holders, Companies House-linked directors, overseas founders, non-UK nationals resident in Britain, and higher-risk crypto customers. Compare completion, escalation and exception handling by cohort rather than relying on one aggregate accuracy claim. Ask the vendor to show what its system does when it cannot verify a legitimate person, when an identity attribute conflicts with another source, or when a screening match needs human assessment.

Then review the contract. Require clarity on service responsibilities, access to records, incident notification, retention and deletion, subcontracting, change management and exit assistance. A procurement scorecard that ignores those terms is incomplete: it evaluates the interface while overlooking the firm's ability to govern the service over time.

A UK Crypto Onboarding Scenario From First Ping to Audit

Consider a UK cryptoasset exchange preparing its FCA registration and onboarding retail customers, an overseas director-controlled company, a politically exposed person and customers whose transfers trigger additional due diligence. The useful test isn't whether every customer passes automatically. It's whether the exchange makes and records a defensible decision when cases diverge.

The retail customer enters the identity workflow, submits evidence and completes biometric checks where required by the firm's policy. The provider returns the verification result and supporting evidence. The exchange's rules route a straightforward case for approval, but a mismatch or weak signal sends it to manual review. Staff record the reason for their decision, not just the outcome.

The overseas company follows a different path. The exchange verifies the business and its directors, identifies beneficial owners, and screens relevant people. If the provider can't establish a legitimate person's identity from available evidence, the firm shouldn't turn a technical failure into an automatic rejection or override it without review. It should use documented fallback procedures, such as assessing alternative evidence, obtaining additional documents or referring the case for enhanced due diligence. The decision and rationale belong in the audit record.

Treat triggers as part of the lifecycle

For the politically exposed person, a screening match should prompt review and risk assessment, not an unexplained automatic decline. The exchange's procedures should specify which staff assess the match, what additional information they need and who approves the outcome. A vendor's match result is an input to the firm's decision.

Crypto firms also need to design for transaction-triggered CDD, not just account opening. Under the UK Money Laundering Regulations 2017, cryptoasset exchange providers and custodian wallet providers must apply CDD to a cryptoasset transfer worth at least the equivalent of €1,000, including transfers that appear linked. This differs from the general €15,000 occasional-transaction threshold applicable to many other regulated businesses. The regulation on when CDD applies makes linkage logic, currency conversion, threshold alerts and an auditable trigger record operational requirements for the workflow.

The evidence bundle should let the exchange reconstruct each case: collected identity evidence, screening results, risk assessment, system decision, reviewer action, override rationale, approval authority and monitoring outcome. Those records should connect to the exchange's written procedures and explain how the vendor is used in practice. A firm preparing for crypto exchange regulation should be able to explain that chain clearly in an authorisation interview, including where automation stops and accountable staff take over.

Matching the Right Model to Your Firm's Profile

A small UK crypto start-up should usually begin with a full AML suite or a carefully governed combination of verification and screening tools. Outsource evidence collection and routine checks, but keep risk appetite, approval authority, exceptions and MLRO oversight in-house. The common mistake is to treat the vendor's default rules as the firm's AML policy.

A mid-market payments or e-money issuer with high retail throughput should favour a connected platform that supports monitoring and re-verification, with internal owners responsible for the policy and review of exceptions. Where the UK electronic-money simplified-due-diligence exemption applies, eligibility depends on specific conditions: maximum stored value of €150; a non-reloadable instrument or one with a €150 monthly transaction limit usable only in the UK; exclusive use to buy goods or services; and no funding by anonymous electronic money. The exemption doesn't cover redemption or cash withdrawal above €50, including remote-payment redemptions above €50 per transaction. The issuer still needs sufficient monitoring to identify unusual or suspicious activity, as set out in the electronic-money due-diligence rules. Don't configure reduced onboarding checks as a permanent exemption from oversight.

A wealth or capital-markets firm dealing with complex ownership should choose a specialist KYB and case-management capability, not rely on an individual-document API to resolve corporate structures. Keep ownership analysis and material risk decisions with appropriately skilled staff.

A bank or authorised firm exploring tokenisation or digital-asset services should use a co-sourced model around existing governance, preserving internal ownership of risk appetite, approvals and monitoring oversight. The two recurring mistakes are buying automation without an exception route and assuming a vendor's compliance label proves the arrangement is adequate. Glentorion combines regulatory consultants with software, systems and AI engineers to support authorisation applications and management preparation for regulator interviews.

---

Glentorion helps financial and crypto businesses connect their operating model, AML procedures, evidence and regulatory application into a coherent arrangement. If you're selecting a KYC provider or preparing for an FCA authorisation discussion, visit Glentorion to discuss the regulatory work your firm needs.