KYC vs AML Screening: What Each Control Actually Does

I still see onboarding tickets where someone writes “KYC passed” and treats that as the whole financial-crime check. The customer uploaded a passport, the face matched, the name parsed cleanly. Then a possible watchlist hit shows up an hour later and the same team asks why we are holding a “verified” account.

Those are two different questions. KYC answers *who is this person, and can we prove it*. Screening answers *does that identity show up on a list we have to care about*. Mixing them into one checkbox is how a valid document and a sanctioned party end up in the same activation job.

What KYC actually hands you

Know Your Customer is the identity file. You collect a legal name, date of birth, nationality, and whatever evidence your KYC vendor requires: document images, a liveness check, sometimes proof of address. Customer due diligence sits on top of that file. You decide how much evidence you need for this product, this country, this risk band.

That work is necessary. It is also incomplete on its own. A clean ID says the name is real enough to open an account. It does not say the name is absent from sanctions, PEP, or other restricted-party files. If your onboarding state machine stops at “document verified,” screening never runs, or it runs as a best-effort side job that nobody owns when it comes back REVIEW.

Enhanced due diligence adds investigation depth after a PEP match, high-risk geography, or another risk trigger. Review the customer relationship, source of funds, and supporting evidence, then document the outcome.

What screening consumes

AML screening takes the identity you already trust and compares it to watchlists. The useful input is a legal name plus a stable externalId you minted. Date of birth, nationality, aliases, and document numbers help the matcher. They do not replace the KYC file. If you send a display name from the signup form and skip the legal name your KYC vendor returned, you will clear people you should have reviewed, or you will flood the queue with junk.

Connect the legal name and your stored externalId to the Naiza AML screening API. Persist the screening id on the customer record and route AUTO_CLEAR, REVIEW, or CONFIRMED into onboarding. Naiza connects screening with ongoing monitoring, full transaction monitoring, and investigation cases.

Treat those three outcomes as product states, not dashboard decorations.

• AUTO_CLEAR means no material match. Activate if the rest of your policy is happy.
• REVIEW routes a potential match to investigation. Hold activation, open a case, and compare the supporting identity fields.
• CONFIRMED means your workflow should stop or stay held until compliance records an outcome.

If you cannot show support the screening id when a customer asks why the account is pending, the integration is unfinished. The KYC session id and the screening id are different keys. Keep both.

Where teams get the wiring wrong

Connect identity verification and AML screening as consecutive steps in onboarding. KYC supplies structured customer identity; Naiza screens it against watchlists and links the result to the customer record and investigation case.

Store the identity evidence and screening result together. Date of birth, aliases, and nationality give investigators more context when reviewing later sanctions or PEP matches.

I keep the two systems loosely coupled. KYC can retry a blurry page without a second screening. Screening can re-run when a list updates without another selfie. That split is the point of watchlist screening versus OFAC-only thinking: one control watches lists over time, the other proves identity once.

If you are still deciding whether to build the matcher, start with in-house screening versus an AML API. The operational question is the same either way. Who owns the review queue, and which onboarding state waits for REVIEW?

Do not let the KYC vendor’s “approved” webhook close the account. Wait for the screening result, or park the account in a pending state support can explain. Pending is cheaper than activating someone you will unwind after a confirmed hit.

The line I write on the diagram: KYC produces the name. Screening judges the name. Neither step is optional, and neither step is the other.