O KYC process it can be structured as KYC modular...with independent checks triggered according to risk and need, or as an Enterprise Suite, which brings together multiple layers in a broader structure. For startups and SMEs, the choice shouldn't begin with the question "which solution has more features?", but with another: what risks does the operation really need to control now? Buying complexity before you need it increases cost, integration, and friction. Adopting little control for a sensitive operation creates the opposite problem. The best design is proportional to the business.
This logic changes the conversation about identity verification. A workflow can begin with registration checks and document validation, adding... liveness and KYC In specific situations, other checks can be reserved for higher-risk clients or transactions. In an Enterprise Suite, many of these capabilities may already be organized within an extensive platform, with governance, monitoring, and integrations for larger operations. Neither model is automatically better. The right decision depends on scope, risk, cost, volume, and operational maturity.
Summary
- Modular KYC separates checks into components that can be triggered according to risk.
- Enterprise suites make more sense when volume, governance, and complexity justify a large-scale structure.
- Startups and SMEs benefit when they design the workflow before contracting technology.
- Onboarding time, cost per query, reprocessing, and assurance level should guide the evolution.
What changes when modular KYC is incorporated into the design?
The main change is to stop treating KYC as one giant, indivisible form. In the modular model, each verification addresses a specific need: identity, document, facial recognitionProof of life, risk assessment, ultimate beneficiary identification, or monitoring. This allows for streamlining the process when there are signs of increased exposure without imposing the same work schedule on everyone. This approach directly relates to the idea of proportionality. according to the FATFThe risk-based approach guides the prioritization of resources precisely in the areas of greatest risk.
Throughout my career, I began applying technology to my work as a lawyer because I saw an opportunity to streamline outdated routines. This experience continues to serve as a good benchmark for product development: technology should remove unnecessary work, not create a new layer of digital bureaucracy. In KYC (Know Your Customer), this means using more verification when it reduces a significant risk and avoiding turning legitimate controls into a tedious process for any user.
Modular KYC or Enterprise Suite: which model best suits your operation?
A startup with a product in validation should hardly be born carrying the same architecture as an institution with millions of clients, multiple jurisdictions, and dedicated compliance teams. The opposite is also true: a regulated, high-volume operation should not depend on an improvised collection of checks without central governance. The mistake lies in choosing based on the appearance of robustness. For an SME, operational flexibility It can be worth more than an extensive list of features that will remain underutilized.
| Criterion | KYC modular | Enterprise Suite |
|---|---|---|
| Scope | Components selected according to need. | Comprehensive set of integrated features |
| Cost | It tends to keep track of the verifications used. | It is better justified with scale and widespread use. |
| Integration | It can evolve in stages. | It requires a more comprehensive design. |
| Governance | It needs to be built as it grows. | It typically caters to more complex structures. |
| Best-case scenario | Startups and SMEs with varying needs | Large, regulated, and multi-team operations |
To visualize broader applications, it is worth observing how a structure geared towards financial services It combines identity, biometrics, evidence, and integration. For smaller businesses, the reference doesn't need to be copied in its entirety. It serves to show where an architecture can grow when new risks, products, and volumes emerge.
How do you set the level of assurance without overdoing the control?
The first step is to map risks and requirements, not suppliers. List what could go wrong, which standards apply, how much a false positive costs, how much fraud costs, and what evidence the company would need to present in a dispute. FinCEN organizes the due diligence. This framework focuses on four key areas: identifying the customer, identifying end beneficiaries, understanding the relationship to define the risk profile, and maintaining continuous monitoring. Even outside the context of US regulations, this structure helps to separate problems that many companies lump together in a single step.
Select checks that address specific risks.
If pain is personification, Facial biometrics for signature It can reinforce authorship. If the concern is real presence, then... biometric proof of life adds another type of evidence. If the flow needs to confirm line ownership or identity context, technologies such as Open Gateway They can occupy another layer. Mixing everything from the start may seem safer, but safety without calibration also generates cost, abandonment, and manual review.
When we announced the adoption of Open Gateway at ZapSign, I specifically highlighted the reinforcement against identity fraud. This logic is useful here: a new layer needs to solve a new problem or reinforce a clearly vulnerable point. Adding controls without knowing what risk they reduce is architecture by anxiety, not by evidence.
Define the level of trust required for each journey.
O British guide to identity This shows that the parts of the verification process do not need to occur simultaneously and that trust can be built progressively at four levels: low, medium, high, and very high. This reinforces a valuable operational point: the level of assurance can increase according to the risk. A simple disclosure may require less evidence; a sensitive financial transaction, a relevant registration change, or an action with a high potential for fraud may require a step-up.
How do I test the model before scaling it?
After mapping risks and selecting checks, evaluate integration and cost. A modular solution loses some of its benefit when each component requires isolated manual operation. Therefore, the architecture should communicate with existing systems. electronic signature API This illustrates the logic well: the gain lies not only in the function itself, but in connecting it to the registration, contract, and activation flow. Technology needs to disappear into the journey, not force the team to manage silos.
The pilot should be small enough to allow for corrections and realistic enough to reveal attrition. Choose an onboarding flow, a risk level, and a controlled volume. Compare approval, abandonment, time, and need for human intervention. A project of regulated digital product It also needs to translate requirements into budget: it's not enough to prove that the verification works; it's necessary to demonstrate that the cost makes sense in light of the loss avoided and the conversion preserved.
What KPIs show if modular KYC is working?
Four indicators provide a fairly objective initial overview: onboarding time, cost per consultation, volume of reprocessing, and level of assurance achieved. I would add abandonment rate and percentage of manual review when the flow has a direct impact on conversion. A cheap KYC that multiplies reprocessing can be expensive. A very rigorous KYC that reduces registration completion can also be costly. The best approach combines security, cost, and experience, the same balance discussed in analyses on... friction in the digital experience.
Check out these related articles as well:
- Understand the steps to implement KYC in a company.
- See how liveness and KYC complement each other in identity validation.
- Learn about resources for validating the signer's identity.
Flexibility is more valuable when there is a clear rule for evolution.
For startups and SMEs, the KYC modular It tends to make more sense when the operation still needs to learn, test, and grow without hiring an architecture larger than the problem. The Enterprise Suite gains an advantage when scale, governance, multiple teams, and regulatory requirements make centralization valuable. The decision is not ideological. It's economic and operational. Start with the risk, choose the checks, define the assurance, integrate, test, and measure. If identity is part of the journey you are designing, then... ID ZapSign You can be included in this evaluation.
Frequently Asked Questions (FAQ)
Modular KYC is an architecture where verifications are separated into independent components, such as identity, document, biometrics, risk, and monitoring. The company activates each module as needed for the customer journey. This makes it easier to adjust controls, costs, and experience without rebuilding the entire process every time a new requirement arises.
An Enterprise Suite tends to make more sense when the company operates on a large scale, has multiple teams, needs to centralize governance, and faces more complex regulatory requirements. In these scenarios, the breadth of the platform can reduce fragmentation and facilitate controls. The cost, however, needs to be compared to the actual use of the functionalities.
Not necessarily. Security depends on how controls are chosen and applied to the risk. A well-calibrated modular workflow may require strong checks in sensitive operations and maintain simpler processes where exposure is lower. The problem arises when modularity becomes a lack of governance, criteria, or monitoring.
Start by looking at onboarding time, cost per consultation, approval rate, abandonment rate, reprocessing, and volume of manual reviews. Also, record the level of assurance achieved in each journey. Isolated metrics are misleading: reducing costs can worsen fraud, while increasing security without calibrating the flow can decrease conversion.
Choose a well-defined risk journey, select only the necessary checks, and establish criteria for approval, rejection, and human review. Run the pilot with controlled volume and compare time, cost, conversion, and failures. The decision to add new modules should come from the observed results, not the amount of resources available.
Getúlio Santos is the CEO of ZapSign, a lawyer, technology enthusiast, and entrepreneur.
