Digital KYC onboarding with iDIN and AML screening

The scale-up was growing to 40 new business customers a week, and every customer followed the same route: email an ID, send a chamber of commerce extract, fill in a UBO form, wait. 2 compliance officers checked everything by hand across 4 systems. Average turnaround: 3 days. Drop-off: 1 in 4 applicants gave up before their first transaction.

At the same time DORA was approaching, and the regulator had asked for a demonstrable, reproducible acceptance process with a log per decision. The brief to RABZI: build an onboarding that completes in minutes, records every step, connects to the existing core application and survives an audit. Without a compliance vendor asking for 6 months and a percentage of revenue.

We started with the compliance officer at the table, not with a design. In 2 weeks we drew the acceptance policy as a decision tree: which check in which order, what may run automatically and what must go to a human. That decision tree became the spec and later the test script.

The architecture: a NestJS service with its own orchestration layer over the sources. iDIN through Signicat to identify the authorized signatory, chamber of commerce data and UBO structure through Company.info, document verification with Onfido for foreign directors, and sanctions and PEP screening with daily rechecks. Every step stores input, output, rule version and timestamp in an immutable audit table.

Cloud on Azure in the EU with Terraform, so the entire environment is reproducible; that was a DORA requirement and saved 2 weeks of documentation at audit time. Deliberately not built: automatic rejection. On a red flag the application goes to a reviewer with all evidence on 1 screen. That keeps a human in the loop where the law requires one.

A new customer starts onboarding on the company's own site, identifies with iDIN, sees their chamber of commerce data and UBOs already filled in, confirms or corrects, and signs digitally. In 8 out of 10 cases the account is active within 12 minutes. The other 2 land in a review queue with an expected response time of 1 working day.

The compliance team works from 1 dashboard: open reviews, red flags, rechecks and an exportable file per customer for the regulator. The file contains every decision with source and timestamp. The first external audit after go-live produced 0 findings on the onboarding process.