# KYC/AML Integration Know Your Customer (KYC) and Anti-Money Laundering (AML) workflows are integrated into the identity-svc and payment-svc microservices to comply with financial regulations across all 7 Wave-1 operating markets. The system implements a tiered verification model that balances regulatory compliance with user experience — enabling basic access with minimal friction while requiring enhanced verification for higher-value operations. ## KYC Verification Workflow Unverified: User Registration Unverified --> DocumentUpload: Submit ID Document DocumentUpload --> PendingAutoReview: Document Upload Plus Selfie PendingAutoReview --> AutoVerified: Automated Checks Pass PendingAutoReview --> ManualReviewQueue: Automated Checks Inconclusive ManualReviewQueue --> Verified: Manual Review Approved ManualReviewQueue --> Rejected: Manual Review Failed AutoVerified --> Verified: Verification Complete Rejected --> DocumentUpload: Resubmit Documents Verified --> EnhancedDD: High-Value Transaction Trigger EnhancedDD --> FullyVerified: Enhanced Due Diligence Pass EnhancedDD --> Suspended: EDD Failed or Suspicious Activity Suspended --> UnderInvestigation: AML Alert Triggered UnderInvestigation --> Cleared: Investigation Complete No Issue UnderInvestigation --> Blocked: Confirmed Suspicious Account Frozen Cleared --> Verified: Reinstated FullyVerified --> [*] `} /> ## KYC Verification Tiers ## Document Upload and Verification Flow >App: Upload ID document photo App->>Identity: POST /kyc/documents (encrypted upload) Identity->>Storage: Store document (AES-256, per-user key) Identity->>OCR: Extract document data (name, DOB, ID number) OCR-->>Identity: Extracted fields User->>App: Take selfie App->>Identity: POST /kyc/selfie (encrypted upload) Identity->>FaceMatch: Compare selfie to ID photo FaceMatch-->>Identity: Match score (0-100) Identity->>Sanctions: Screen against sanctions lists Sanctions-->>Identity: Clear or flagged alt Automated Pass (score above 85 and sanctions clear) Identity-->>App: KYC Tier 1 Approved else Inconclusive (score 60-85 or partial match) Identity->>Queue: Add to manual review queue Queue->>Reviewer: Assign for review Reviewer->>Queue: Approve or reject with notes Queue-->>Identity: Review decision Identity-->>App: KYC result notification else Automated Fail (score below 60 or sanctions hit) Identity-->>App: KYC Rejected with reason end `} /> ### Accepted Identity Documents per Country ## Automated Verification Pipeline The automated verification pipeline processes KYC submissions without human intervention for clear-cut cases: 1. **Document Quality Check** — Verify image is clear, not blurry, properly lit, all corners visible 2. **OCR Extraction** — Extract name, date of birth, ID number, expiry date from the document 3. **Document Authenticity** — Check for signs of tampering, validate document format against known templates per country 4. **Face Matching** — Compare selfie to ID photo using biometric face matching (threshold: 85% for auto-approve, 60-85% for manual review, below 60% for auto-reject) 5. **Liveness Detection** — Verify the selfie is a live person (not a photo of a photo, screen capture, or mask) 6. **Data Cross-Reference** — Validate extracted data against user-provided registration data 7. **Sanctions Screening** — Screen name and ID number against OFAC, EU, UN, and local sanctions lists 8. **PEP Screening** — Check against Politically Exposed Persons databases 9. **Duplicate Detection** — Check if the same ID document has been used for another account ## Manual Review Queue When automated verification is inconclusive, submissions are routed to the manual review queue: ## AML Monitoring ### Transaction Monitoring Rules Real-time screening of all financial transactions against configurable rules: ### Sanctions Screening All users and counterparties are screened against global and local sanctions lists: - **OFAC** — U.S. Office of Foreign Assets Control Specially Designated Nationals (SDN) list - **EU Sanctions** — European Union consolidated sanctions list - **UN Sanctions** — United Nations Security Council consolidated list - **Local Lists** — Country-specific sanctions and watchlists (FIC in South Africa, NFIU in Nigeria, FRC in Kenya) - **Screening Frequency** — At onboarding, on every transaction, and daily batch re-screening of all active users - **Fuzzy Matching** — Name matching with configurable similarity threshold to catch transliterations and spelling variations ### Suspicious Activity Reports (SARs) When AML monitoring identifies suspicious activity: 1. **Automated SAR Generation** — System generates a draft SAR with transaction details, user profile, and rule triggers 2. **Compliance Officer Review** — Draft SAR reviewed and enriched by compliance officer within 24 hours 3. **Filing** — SAR filed with the relevant Financial Intelligence Unit (FIU) per country 4. **Record Keeping** — SAR records retained for minimum 5 years with full audit trail 5. **Tipping Off Prevention** — User is not notified that a SAR has been filed ### FIU Filing per Country ## KYC/AML Integration Architecture IDENTITY_LAYER IDENTITY_LAYER --> SCREENING_LAYER SCREENING_LAYER --> REVIEW_LAYER PAYMENT_LAYER --> SCREENING_LAYER IDENTITY_LAYER -->|KYC tier| PAYMENT_LAYER `} /> ## Compliance Checks Summary ## KYC/AML KPIs