Managing KYC Dilemmas: In-house vs. Outsourced Solutions

When it comes to KYC, businesses usually maintain their own compliance team while outsourcing AML screening or biometric checks to automated KYC solutions. However, as companies scale, they eventually have to delegate even more of their user verification processes. 

But which due diligence procedures should companies retain in-house? And which should be delegated to a service provider? Let’s take a closer look.

What’s the difference between in-house and outsourced KYC?

In-house KYC is when businesses create and manage their own KYC department for onboarding new customers manually (including document checks, watchlist screening, etc.).

Companies are legally required to establish and maintain policies, controls and procedures to reduce and manage the risks of money laundering and terrorist financing. This includes:

• risk management
• customer due diligence
• ongoing monitoring
• record keeping
• reporting suspicious activity.

Moreover, an AML-regulated business must appoint an MLRO (Money Laundering Reporting Officer) responsible for the company’s compliance with anti-money laundering regulations.

Outsourced KYC are solutions provided by third-parties for KYC processes.
When it comes to deciding which processes to outsource, the general rule of thumb is to delegate services that are repetitive or labor intensive, and retain those which require access to additional research, sensitive data or contact with regulators. In any case, companies should retain control over outsourced KYC processes. This is especially true for regulated companies which must fulfill reporting requirements.

Businesses need to strike the right balance between in-house and outsourced solutions. How this balance is struck depends on the following factors:

• whether the business is regulated;
• the size of company and its needs;
• whether the company plans to enter / has already entered the international market.

For instance, if a business is non-regulated (e.g. car sharing services, e-commerce, peer-to-peer services and many others), it doesn’t need to conduct AML, PEP and adverse media screening.

Moreover, non-regulated businesses don’t have to follow mandatory verification requirements. However, it’s still important for them to know their customers to prevent money losses and reputational risks.

The pros and cons of in-house KYC 

Every regulated company has to nominate an MLRO and conduct AML training for their employees. However, if a company is small, it likely can’t afford a full-fledged compliance department, leading it to handle KYC requirements in-house. This is especially true for companies with a small number of customers or those which cannot afford a third-party verification provider. 

Let’s look at the pros and cons of building and managing in-house compliance teams.

Pros of an in-house compliance team

• Ability to tailor the team to company specifics;
• Total control over the processes; 
• No time wasted on communications outside the company; 
• Direct communication with users; 
• No need to integrate third-party solutions. 

However, building an in-house compliance team is costly and time-consuming—and it only works when the company doesn’t have many KYC checks to perform. 

Cons of an in-house compliance team

• Tedious and time-consuming manual work— a substantial team is needed to manually check users. Sumsub’s survey shows that the average manual check takes more than 10 minutes.  
• Management costs and challenges — to build an effective team, you need to find the right professionals, develop an internal process and maintain control over it. This requires time and money.
• Building your own IT infrastructure — companies need to be prepared to automate their KYC  for ensuring data security and preventing leaks.
• Human error — employees make mistakes and can occasionally let fraudsters in. Or, they can cause deliberate harm to your business if given too much control over the verification process. 
• Employee turnover — team members can come and go, but it’s an ongoing struggle to prevent data leaks when someone leaves.
• Data-enrichment — to improve the accuracy of  anti-fraud tools, businesses will need to aggregate data from various sources, stay aware of new threats, and constantly train artificial intelligence. This is a herculean task for a small, in-house compliance team. 
• Ongoing maintenance — as companies scale in new markets, their compliance teams must adapt accordingly. So, whenever a new market is entered, the compliance team will need expertise in working with local languages and documents. 

Sumsub’s survey of crypto businesses found that 76.9% of businesses manually verifying users plan to switch to automated verification.

Find out how YouHodler, a fintech platform, managed to operate globally and in full compliance while reducing manual work and cutting verification expenses by 50%. 

The pros and cons of outsourcing KYC

Most companies aim to grow their customer base, release new products and increase revenue. However, at a certain stage, growth can put undue strain on in-house compliance teams. That’s often when third-party KYC providers enter the picture. These solutions take full control over the compliance routing, allowing companies to focus on their core competencies. 

Pros of outsourced KYC 

Outsourcing automated KYC solutions can bring the following benefits:

• Cost reduction— automated KYC verification solutions help companies reduce costs by 40% (Sumsub’s statistics).
• Time-effective approach— for instance, at Sumsub, the average verification speed is 50 seconds, while some companies spend 9.8 minutes on average to verify one user. 
• Big data expertise—AI-powered solutions have the ability to capture, store and structure vast amounts of data, while algorithms filter and analyze the information, painting a clearer picture of the new customer in far less time. Plus, fraud protection based on AI algorithms reduces time spent on compliance tasks by 70%. 
• Scalability – If a business enters a new region, the provider offers legal support to familiarize it with regional regulations, which helps develop the right compliance policy and processes.

Plus, the provider’s technical team can integrate a specific verification solution that already contains all the required aspects of verification (eg, record-keeping and reporting) in a given region. 

•  Customization—it’s possible to build different flows for each client segment. 
• Analytics — the business can receive data about verification in real time and use this information to improve the customer experience. 

Cons of outsourced KYC 

The problems businesses can face while working with third-party KYC provider may include:

Third-party involvement— the personal data of customers goes through a third-party provider. This may cause data leaks if the provider doesn’t maintain adequate data protection mechanisms. Sumsub is registered with the Information Commissioner’s Office in line with the Data Protection Act 2018 and supports 256-bit TLS encryption on every device. 

The need to integrate and customize—companies still need to understand how the third-party service works in order to properly build the verification flow and customize it. Sumsub has a user-friendly sandbox and 24/7 customer support to help companies navigate integration.     

Conclusion 

When building KYC, businesses should consider their risk appetite along with guidance from regulators. A proper balance between in-house team and outsourced solutions can significantly cut costs, while keeping the company fully compliant with laws and protected from fraud.  

KYC is getting outsourced more than ever. This allows companies to save time and resources while focusing more on their core business activity. Earlier, only large and mid-sized companies could benefit from KYC providers. Now, businesses of all sizes are tending to delegate much of their compliance work to outsourced KYC providers while keeping the required in-house specialists.