The onboarding evolution: rethinking AML across the financial ecosystem

Group Senior Financial Crime Compliance Manager and MLRO at Revolut, Natalia Gburzyńska, leverages her multi-industry expertise to share AML best practices across the financial ecosystem.

Financial crime doesn’t stop at the borders of a single industry, so why should our defences? In this three-part series, Natalia Gburzyńska, Group Senior Financial Crime Compliance Manager and MLRO at Revolut, draws on her experience across ecommerce, big tech, telecom, insurance, traditional banking, and neobanking to take a 360° view of the customer lifecycle. Part 1 covers onboarding, Part 2 transaction monitoring, and Part 3 compliance and reporting. Across all three, she looks at what fincrime professionals can learn by looking beyond their own sector, and at the blind spots that bankers, fintechs, PSPs, merchants, and technology providers may not be considering today. 

We start where every customer relationship begins: onboarding.

Introduction: the dual mandate

In the fast-paced ecosystem of modern digital banking, customer onboarding is our most critical line of defence. As Money Laundering Reporting Officers (MLROs), we know executing robust Anti-Money Laundering (AML) and Know Your Customer (KYC) protocols is not just a regulatory obligation - it is fundamental to safeguarding the global financial system.

It is the moment an institution makes its first impression, setting the tone for user experience (UX). Concurrently, it is the frontline of defence against financial crime. This creates a well-documented tension: the business demands a frictionless journey to prevent abandonment, while compliance mandates strict data collection to prevent regulatory fines.

‘The onboarding journey is no longer just a regulatory checkpoint; it is a competitive differentiator. Whoever balances compliance and low friction wins the customer.’

Yet, the financial sector frequently falls into an echo chamber - banks benchmarking against banks, and fintechs looking only at fintechs. To innovate, fincrime professionals must look beyond their own industry. The most sophisticated defences against identity spoofing and automated attacks are often pioneered in ecommerce, gaming, and bigtech. These sectors assess risk invisibly, utilising behavioural telemetry and network graphing before a user ever uploads a document.

Having spent over a decade across the fincrime compliance 1st and 2nd lines of defence, and collaborating with a diverse range of these institutions throughout the industry, I have navigated their unique vulnerabilities firsthand. This leads to a fundamental realisation: designing onboarding flows merely to satisfy compliance checklists leaves our front doors wide open to sophisticated criminal networks.

Currently, the industry hyper-focuses on verifying the document rather than validating the intent. Understanding how different sectors approach this checkpoint - and where they leave themselves vulnerable - is the first step toward a resilient, cross-industry standard. Here is how varied financial sectors tackle onboarding from an MLRO's perspective, their structural weaknesses, and what we can learn from one another.

1.  Traditional banks: the legacy fortress

Institutional philosophy: Traditional banks possess generational consumer trust, counterbalanced by immense legacy technology debt. Their AML/KYC approach is historically robust, characterised by deep compliance hierarchies and comprehensive screening. However, their defensive posture is increasingly tested by agile, digital-first adversaries.

Risk profile: Operating on a ‘regulatory safety first’ mandate, their risk appetite is low. This defensive posture is designed to satisfy examiners and avoid fines, creating a culture of caution where checking boxes takes precedence over assessing dynamic, real-world risk.

Advantages (from the customer and ecosystem perspective): Customers perceive traditional banks as safe havens for capital. They possess vast resources for multi-layered screening against global sanctions and Politically Exposed Persons (PEPs). Sitting on decades of historical transactional data, they have an unparalleled advantage in identifying macro-trends in financial crime when properly aggregated.

Operational pain points: Banks have spent decades patching together disparate legacy systems. When alerts trigger, analysts must ‘swivel-chair’ between multiple screens to disposition a single case. Legacy name-matching algorithms kick legitimate applications into manual review queues, causing onboarding delays that span weeks. Furthermore, siloed data means customers often repeat KYC steps for different product lines.

The blind spot: In a rush to mimic neobanks, traditional banks are digitising flawed processes. Moving a manual utility bill check to a digital upload does not modernise AML; it makes it faster for syndicates to submit AI-generated forgeries. They index too heavily on static documents rather than validating intent.

The cross-industry lesson and what they should consider: Traditional banks must look to bigtech and ecommerce to understand true risk orchestration. Ecommerce merchants do not silo fraud and compliance data. Banks must break down the artificial walls separating Fraud, Cyber, and AML. An anomalous device login (Cyber) or a failed behavioural biometric check (Fraud) must instantly alter the AML risk score of the onboarding application in real time.

2.  Neobanks: balancing speed and security

Institutional philosophy: Unburdened by physical branches, neobanks treat onboarding as a core product feature and primary growth driver. Their mobile-first architecture prioritises agility, rapid deployment, and a frictionless user interface to capture market share.

Risk profile: Neobanks operate with a high-growth, technology-first risk appetite. Regulators increasingly penalise challengers for overly broad risk controls and failing to dynamically monitor accounts post-onboarding.

Advantages (from the customer and ecosystem perspective): The highly automated process delivers a superior UX. Relying on API-driven regtech, neobanks use Optical Character Recognition (OCR) and biometric liveness checks to cross-reference data in milliseconds. Customers can open fully funded accounts in under three minutes.

Operational pain points: This focus on frictionless speed makes neobanks prime targets for organised money mule networks. Because accounts can be opened and funded in minutes, criminal syndicates systematically mass-produce ‘burner’ accounts using either recruited individuals or stolen credentials. These accounts are then centrally controlled by illicit actors to rapidly funnel and structure dirty money, exploiting the neobank's lack of physical branch oversight and its heavy reliance on purely automated, transaction-level screening.

The blind spot: Neobanks inadvertently pass the buck to the broader ecosystem. When optimised risk models accept a synthetic identity to preserve ‘frictionless’ metrics, that persona gains a legitimate foothold. Fraudsters use this low-friction entry to build credit histories, weaponising them to attack larger institutions.

The cross-industry lesson and what they should consider: Neobanks must move beyond universally frictionless onboarding and implement dynamic smart friction by looking at adjacent digital industries. From online gaming, they should adopt behavioural biometrics to analyse how applicants interact, flagging anomalous keystrokes or copy-pasted names to catch bots instead of relying solely on static IDs. Similar to the gig economy and platforms like Uber and Airbnb, they should leverage device intelligence to continuously assess environmental context, detecting GPS spoofing, SIM-swapping, or single devices spawning multiple profiles.

3. Cryptocurrency exchanges: securing the digital frontier

Institutional philosophy: Emerging from an ethos of decentralisation, crypto platforms operate at the volatile intersection of digital innovation and traditional regulation. To secure fiat on/off ramps, they have rapidly matured compliance postures, bridging borderless assets and the traditional financial system.

Risk profile: Exchanges manage a high-risk profile driven by advanced threat vectors and globally fragmented laws. Their core challenge is balancing a user base culturally averse to data sharing with strict, localised AML mandates.

Advantages (from the customer and ecosystem perspective): Exchanges utilise a ‘Tiered KYC’ approach. Users can create accounts and deposit crypto with minimal friction (Tier 1). Rigorous friction - biometric scanning and source-of-wealth declarations - is strategically reserved for critical chokepoints like fiat withdrawals or high-volume trading (Tiers 2 and 3).

Operational pain points: The sector struggles with ‘chain-hopping’ and obfuscation. Determining the true source of wealth is incredibly difficult when funds originate from decentralised wallets or coin mixers. Furthermore, syndicates increasingly deploy AI deepfakes to spoof Tier 2 biometric step-ups.

The blind spot: There is a dangerous over-reliance on static identity checks at the expense of contextual asset behaviour. Verifying a physical passport ignores the digital wallet's context. If a new user immediately receives funds from a darknet mixer and attempts a fiat cash-out, their authentic driver's license is irrelevant to the actual laundering risk.

The cross-sector lesson and what they should consider: Crypto platforms must shift focus from authenticating the user to analysing the asset context. Looking at payment networks and contextual velocity, global credit networks monitor real-time routing and velocity. Crypto platforms should similarly flag rapid successive hops or interactions with high-risk smart contracts, regardless of how clean the user's ID is. Furthermore, borrowing from capital markets and asset surveillance, where clearinghouses track the actual movement of shares to identify wash trading, exchanges must adopt on-chain asset surveillance. They should quarantine tokens showing historical obfuscation before they reach the fiat off-ramp.

4.  Insurance companies: bridging the intermediary gap

Institutional philosophy: Operating in a highly intermediated landscape, insurance relationships are frequently managed by brokers. Historically, onboarding heavily weights actuarial and underwriting risk, treating financial crime risk as a secondary compliance exercise rather than a core metric.

Risk profile: While money velocity is lower than transactional banking, the sector is highly vulnerable to complex layering. Life insurance and annuities are attractive laundering vehicles, as illicit actors exploit the industry's focus on health risk to obfuscate the origin of funds.

Advantages (from the customer and ecosystem perspective): Onboarding is deeply integrated into asset underwriting, often facilitated by brokers providing consultative experiences. The sector excels at assessing long-term physical risks, gathering comprehensive data to price risk accurately.

Operational pain points: Disintermediation is the primary hurdle. Because brokers ‘own’ the client, insurers suffer from delayed or fragmented KYC data. Unmasking the Ultimate Beneficial Owner (UBO) in commercial insurance is a manual, international process. The sector is also targeted by ‘premium leakage’- cleaning money through deliberate overpayments followed by early cancellations and clean refunds.

The blind spot: There is a systemic oversight regarding Beneficiary KYC at onboarding. Insurers rigorously underwrite the policyholder but ignore the ultimate beneficiary until the payout phase. By the time a claim is triggered, illicit funds have already integrated into the legitimate system.

The cross-sector lesson and what they should consider: Insurers must modernise data flows and restrict funds routing by adopting strategies from more agile financial sectors. Rather than waiting for static PDFs, they can learn from the embedded compliance of neobanks and embed risk APIs directly into broker sales portals to screen policyholders and beneficiaries instantly during the quoting phase. Additionally, mirroring the data orchestration of payment processors - where acquiring banks require direct API feeds for sub-merchant KYC rather than trusting manual files - insurers must demand digital transparency from brokers to establish a unified, real-time risk view from day one.

5.  Credit unions: scaling community trust

Institutional philosophy: Defined by community focus and membership bonds, credit unions prioritise personal relationships. Onboarding is a high-touch process where verifying an applicant’s eligibility (the ‘bond of association’) is as critical as verifying their identity.

Risk profile: Historically, their localised nature mitigated laundering risks. Today, operating on tight margins with constrained compliance resources makes them attractive ‘soft targets’ for digital threat actors seeking the path of least resistance.

Advantages (from the customer and ecosystem perspective): They excel at highly personalised customer service. Deep community knowledge provides a qualitative layer of risk assessment that algorithmic models at mega-banks cannot replicate.

Operational pain points: The primary struggle is resource starvation. Lacking capital for Tier-1 AI risk engines, their digital onboarding is often clunky, leading to high youth abandonment rates. Manual compliance teams struggle to meet expanding regulatory requirements.

The blind spot: Attackers actively weaponise the sector's ethos. Syndicates know credit unions index highly on ‘customer service’. They use social engineering to push synthetic identities through manual channels, knowing frontline staff are culturally trained to be accommodating rather than suspicious.

The cross-sector lesson and what they should consider: Credit unions must overcome resource constraints through industry collaboration. Looking at the banking-as-a-service model of fractional compliance, instead of buying expensive infrastructure, they should leverage cloud-based regtech to access top-tier behavioural analytics on an affordable, pay-per-use basis. Furthermore, they should adopt the consortium intelligence utilised by global payment networks, which fight fraud collectively. Credit unions must plug into shared threat registries, ensuring an attack on one branch instantly inoculates the entire ecosystem.

6.  Funds and wealth management: illuminating complex wealth

Institutional philosophy: Wealth management focuses on bespoke relationship building, prioritising a seamless, ‘white-glove’ experience for High-Net-Worth Individuals (HNWIs) and institutions rather than treating onboarding as a transactional checkpoint.

Risk profile: Despite client prestige, the sector is highly vulnerable to high-value money laundering. Heavy reliance on offshore jurisdictions, trusts, and opaque corporate vehicles makes it a prime target for illicit actors.

Advantages (from the customer and ecosystem perspective): Clients receive an exceptional experience. Relationship managers shield them from administrative burdens while developing a holistic understanding of their family structure and business empire.

Operational pain points: The primary struggle is UBO obfuscation. Onboarding requires painstakingly peeling back layers of shell companies and offshore trusts across fragmented registries to verify the true Source of Wealth (SoW).

The blind spot: The ‘VIP Loophole’. There is a systemic belief that wealth equals low risk. Launderers exploit the fact that relationship managers - whose compensation relies on maintaining assets - are terrified of introducing friction or offending VIP clients by demanding invasive wealth clarifications.

The cross-sector lesson and what they should consider: Wealth management must adopt the advanced data orchestration seen in other tech-forward sectors. Taking a lesson from ecommerce network graphing, they should stop relying on static paper certificates and instead use network graphing to instantly visualise hidden connections between a VIP's offshore trust, corporate entities, and sanctioned jurisdictions, just as merchants map IP subnets to uncover fraud. They must also follow the lead of bigtech in breaking down internal silos by unifying data across sales and compliance. If a VIP claims Swiss tax residency but their portal logins consistently originate from a high-risk jurisdiction, this discrepancy must automatically alter their AML risk score, bypassing relationship manager bias entirely.

Conclusion

The future of AML and KYC onboarding does not lie in collecting more documents. It lies in context, behaviour, and cross-industry intelligence. Criminals do not respect the boundaries between a neobank, a crypto exchange, and an ecommerce platform - they exploit the gaps between them. Until fincrime professionals stop looking at their own sector's compliance checklists and start adopting the agile, behaviour-driven defences of the broader digital economy, they will continue to lose the digital arms race.

About Natalia Gburzyńska

As a Group Senior Financial Crime Compliance Manager and MLRO at Revolut, I drive global compliance strategies across banking, big tech, and payments. Leveraging experience at Meta, Dojo, Amazon, and SEB, I specialise in managing high-stakes exams and bridging business operations with regulators worldwide. Holding CFE and CAMS credentials, I deliver strategic counsel on complex financial crime typologies, designing airtight risk controls that ensure regulatory excellence while maintaining business agility.

 

 

About Revolut

Revolut is a global financial superapp and licensed bank designed to simplify all things money. Founded in 2015, we empower millions of customers worldwide to manage, spend, save, and invest their wealth from a single intuitive platform. From seamless international transfers and currency exchange to advanced budgeting tools and smart investments, Revolut actively breaks down traditional financial borders. Our mission is to build a borderless economy, delivering true financial freedom everywhere.