Fintech

Compliance by Design: Building KYC/AML Into Your Product

7 min readAbsolute Foundry

Compliance by design means building identity checks, screening and audit trails into the product from the first commit — so meeting KYC/AML obligations is a smooth part of the experience, not a panicked retrofit before launch. Bolted on late, compliance is your slowest, ugliest flow. Designed in, it's a genuine edge. We treat which one you get as a design decision made on day one.

Here's how our team approaches it, including the debate we have on every fintech build.

01 Reframe: onboarding is a product, not a gate

The instinct is to treat KYC as a wall users must climb before the "real" product. That instinct is why so much fintech onboarding leaks users. We design it like a checkout instead: progressive disclosure, clear status at each step, instant feedback, and only the friction the risk tier actually warrants.

The trade-off we weighedVerify everyone hard vs. tiered verification. Maximal checks up front feel safe and quietly kill conversion. Tiered verification — light checks for low limits, deeper checks as value rises — keeps good users moving while still escalating where risk demands. We land on tiered every time; it's better UX and better risk posture.

02 Build vs. buy, and what we never outsource

We don't build identity verification or sanctions screening from scratch — specialist vendors do that better. What we never hand off is the orchestration, the UX, and the audit layer, because that's where the product experience and your defensibility live. So the architecture is: vendors for the checks, our own layer for how they're sequenced, surfaced and recorded.

Sanctions/PEP screening at onboarding and continuously after.
Transaction monitoring with rules you can explain to a regulator in plain English.
An immutable audit trail — who did what, when, and why — on every decision.

03 Build for the audit you'll eventually have

We design assuming a regulator or partner bank will one day say "show me." If every check, override and data point is logged and exportable, that day is routine instead of an emergency. This is also a marketing asset: "compliant by default" is a trust signal customers feel, not just a box you tick.

Where we'd landTiered, checkout-grade onboarding; vendors for checks and our own orchestration/audit layer on top; continuous screening; and an exportable trail built for an audit from day one.

Key takeaways

Design onboarding like a checkout — tiered and low-friction for good users.
Buy identity/screening; own the orchestration, UX and audit layer.
Screen continuously and keep an explainable, immutable trail.
Build assuming an audit — compliance-by-default is also a trust advantage.

FAQ

Build KYC in-house or use a vendor?

Use specialist vendors for identity and screening; build the orchestration, UX and audit layer yourself — that's where the experience and defensibility live.

When should compliance enter the design?

At the wireframe stage. Retrofitting after launch is the expensive path.

Does this slow launch?

Designed in early, rarely — and it prevents the rebuild that genuinely delays you later.

We build fintech products compliance-first — see AbsolutePay.

Build it right