Who owns which part of KYC drop-off?
Most KYC drop-off problems get stuck because each party can only see its own piece. The vendor sees match rates, the bank sees approvals, and nobody owns the screens in between.
| Who | What they can fix | What they can't see | When to call them first |
|---|---|---|---|
| KYC or identity verification vendor | Database match rates, document and selfie step-up tools, reason codes | Where users quit before submitting, or after approval | Auto-approval rate is low or step-up completion is poor |
| Partner bank and compliance team | Which fields are required, when, and what a pending user may do | Conversion and screen-level behaviour | You want to move identity later or ask for less |
| Fractional growth team (such as Kiko) | Stage-by-stage instrumentation, field order, copy, resume flows, tests against funded accounts | Policy decisions, which stay with the bank | Drop-off is high and nobody can say which stage causes it |
| In-house product designer or PM | The same flow work, owned long term | Often lacks the analytics set-up | You already know the stage and need it rebuilt |
| Compliance consultant or law firm | Interpreting the rules for your structure | Product data | Before changing what you collect or when |
If most loss happens before submit, the screens are the problem and a growth team can help. If it happens after submit, start with the vendor's reason codes. If the issue is who your bank will accept, that is a policy conversation, not a design test. For a wider comparison of outside help, see fractional growth vs agency vs studio.
What do the federal rules actually require at onboarding?
The bank Customer Identification Program (CIP) rule sets minimums. In a typical bank-partner model the bank is the institution the rule names, and the app runs onboarding under the bank's procedures. The right-hand column gives questions for your compliance team, not answers.
| Requirement | Primary source | Questions for your compliance team |
|---|---|---|
| Collect name, date of birth, address and an identification number (a TIN for US persons) before the account is opened | 31 CFR 1020.220(a)(2)(i) | Which fields does our partner require at application, and which can wait for a later feature? |
| A bank may obtain the TIN from a third party instead of the customer, under a FinCEN exemption order of June 27, 2025 (extended to Federal Reserve-supervised banks on July 31, 2025) | FinCEN release | Does our partner use this? Could we ask for less of the SSN? |
| Verify identity within a reasonable time after opening, by documents, non-documentary methods, or both | 31 CFR 1020.220(a)(2)(ii) | Is the database check first and documents a fallback? What triggers a step-up? |
| Procedures for when identity can't be verified, including what a customer may do while verification is pending | 31 CFR 1020.220(a)(2)(iii) | What may a "pending" user do in the app, and for how long? |
| Adequate notice, before opening, that information is requested to verify identity | 31 CFR 1020.220(a)(5) | Where does the notice appear, and who approves the wording? |
| Customer due diligence: understand the nature and purpose of the relationship to build a risk profile | 31 CFR 1020.210(a)(2)(v) | Which onboarding questions does our risk profile actually need? |
| FinCEN's CDD FAQs say the rule doesn't categorically require particular CDD information, including expected account activity, beyond what risk profiling and monitoring need | CDD Rule Consolidated FAQs (updated May 6, 2026) | Are any of our questions there by habit rather than requirement? |
| Staff and agents may not disclose a suspicious activity report or anything that would reveal one | 31 CFR 1020.320(e) | Do any of our decline or review messages hint at one? |
Brokerage and investing apps follow a separate broker-dealer CIP rule and are outside this page. See finfluencer compliance for investing apps. Money services businesses have their own programme rule (31 CFR 1022.210).
What do public help pages show about when apps ask for identity?
Here is what the public help and partner pages of three US consumer apps say. It reflects what each company says, not a test of the live flow.
| App (source) | What the page says is collected | What works before or without full verification | What the page says happens on failure |
|---|---|---|---|
| Chime (how to open an account, dated 2026-09-09) | Name, SSN, phone, date of birth, US address, email and password; 18+ and US citizen or permanent resident | Not described. Listed steps: enter details, choose a card, add funds | Not described |
| Cash App (partner FAQ) | Usually legal name, date of birth and last four SSN digits; sometimes full SSN, address, photo ID or source of funds | Unverified customers can spend only from a linked debit card; limits depend on status | Not described on this page |
| Venmo (identity verification) | Details matched to the legal name at signup; an SSN or ITIN to finish | Paying via linked bank or card, receiving and transferring. Verification may be required before sending over $300 in a rolling week, moving over $1,000 a week to a bank, or accepting goods-and-services payments | Document upload in the app; support contacts the user about typos or wrong files |
What we observed: there are two patterns. Identity at signup is used where the product is an account (Chime). Tiered access lets the app work in a limited way until a feature or limit triggers verification (Venmo, Cash App). Which one you can use is a partner-bank and regulatory question, not a design preference. Step-up is a ladder: Cash App describes a short default with escalation to full SSN, ID or source of funds.
Which stage is losing applicants?
Instrument each stage separately before changing anything. One "KYC conversion" number hides whether the problem is the form, the vendor's match rate or the review queue.
| Stage | Symptom | Likely causes | Fix to test |
|---|---|---|---|
| Install to application start | Many installs, few starts | Identity asked before any value is shown; ad promise doesn't match the first screen | Show value first where the programme allows (preview, read-only insights, tiered access) |
| Start to submit | Abandonment at specific fields | SSN asked early without a reason; address friction | Cheapest fields first, SSN last with a one-line reason, address autocomplete |
| Submit to decision | Low auto-approval | Name or address mismatches, typos, thin files | Inline validation before the check runs |
| Document or selfie step-up | Low completion | Desktop camera handoff, glare, unaccepted IDs | QR handoff to phone, capture guidance, accepted IDs listed up front |
| Manual review | Users leave while pending | No status or expected wait | Show the expected wait; notify on every status change |
| Approved to funded | Approved users never fund | Funding friction; value not yet visible | Make first funding the next screen, with the benefit restated |
Two things fix more than any single screen: make every step resumable by deep link (people leave to find an ID), and write failure messages that say what happened, what to do now, and how long the next step takes, without guessing at reasons you don't know. In Kiko's fintech onboarding work, start-to-submit is the largest single loss, at 20–35% of applicants who start.
Which events should you instrument?
| Event | Fires when | Key properties (no PII) |
|---|---|---|
kyc_started | First identity screen shown | Entry source, platform |
kyc_field_completed | Each field completed | Field name, time on field |
kyc_decision | Automated decision returned | Outcome (approved, step-up, review, not approved), vendor reason code |
stepup_submitted | Document or selfie submitted | Step type, device handoff, retries |
review_resolved | Manual review ends | Outcome, time in review |
kyc_resumed | User returns to an incomplete application | Channel, days since last step |
account_funded | First funding | Method, time since approval |
Keep SSNs, ID images and document data out of product analytics and ad platforms, and agree the list with your compliance and privacy teams. Optimise ad platforms to the approved or funded event, not installs; see scaling Meta and TikTok ads for fintech apps and, for creator claims, compliance review for fintech creator campaigns. This is the event list Kiko uses in KYC audits.
When don't you need outside help?
- Your KYC vendor already gives you reason codes by stage, and someone owns the funnel.
- Your main problem is approval policy (who your bank will accept). That is a partner and compliance conversation.
Kiko has run programs for 70+ venture-backed startups since 2023, including 8 consumer fintech apps. In KYC work we instrument every stage in the first two weeks, then test field order, copy and resume flows against approved and funded accounts; approval policy stays with your partner bank. Our case study for a Series A neobank reports KYC completion up from 54% to 73% in 10 weeks. All case studies are at /case-studies/.
Send us your onboarding flow and stage-by-stage numbers → Book a call
Frequently asked questions
Who can help a fintech app improve onboarding conversion through the KYC step?
Your KYC vendor improves match rates and step-up tools, your partner bank and compliance team decide what is required, and a product growth team, in-house or a fractional growth team such as Kiko, instruments each stage and tests the flow. Most stalled projects are missing the third.
Should a fintech app verify identity at signup or let users explore first?
Show value before identity wherever your partner bank's programme allows, through a preview, read-only insights or tiered access. Products that are themselves accounts usually need identity at application. Your compliance team decides which pattern you can use.
What information does federal law require before a bank account is opened?
The bank CIP rule requires at least name, date of birth, address and an identification number before an account is opened, with verification within a reasonable time after opening (31 CFR 1020.220). Your partner bank may require more.
Can we collect the SSN later in onboarding?
Under the CIP rule the identification number is collected before the account opens, so "later" usually means later in the same application. A 2025 FinCEN exemption lets banks obtain the TIN from a third party; ask whether your partner uses it.
Does the CDD rule require asking about occupation or source of funds?
FinCEN's CDD FAQs say the rule doesn't categorically require particular information beyond what risk profiling and monitoring need. Your partner bank's risk policy may still require some questions, so check each against it.
Sources
- eCFR, 31 CFR 1020.220, Customer identification program requirements for banks
- eCFR, 31 CFR 1020.210, AML program requirements for banks
- eCFR, 31 CFR 1020.320, Reports by banks of suspicious transactions
- eCFR, 31 CFR 1022.210, AML programs for money services businesses
- FinCEN, FinCEN Permits Banks to Use Alternative Collection Method for Obtaining TIN Information
- FinCEN, CDD Rule Consolidated FAQs
- Chime, How to open a free online account through Chime
- Cash App Developers, FAQ: Customer Identity Verification
- Venmo Help Center, Identity verification
This page explains common practice and isn't legal advice.