Infrastructure and regtechSoftware only

KYC, AML screening, and transaction monitoring platform testing

FintechAssuranceLabs engineers test identity verification, KYC, and AML platforms, the category of products like Sumsub, Onfido, Alloy, and Sardine. KYC and AML platform testing covers document and liveness checks, sanctions and PEP match logic and false positive rates, transaction monitoring rules and thresholds, case management, and the SAR and STR exports that regulated clients file.

What breaks in verification, screening, and monitoring

A KYC or AML vendor earns a fee per check plus a subscription for screening, monitoring, and case management, while the regulated client stays responsible for every decision the platform returns. Sources below were checked on 2026-09-16.

Injected video passes the liveness check. A virtual camera feeds generated video into the capture SDK, and the liveness model scores frames that no camera captured. ISO/IEC 30107-3:2023 evaluations miss this path, because the standard treats attacks away from the biometric capture device as out of scope. FinCEN alert FIN-2024-Alert004 (13 November 2024) lists a third-party webcam plugin during a live verification check as a red flag. The vendor bills a check fee on a fraudulent approval, and under paragraph 19(a) of the EBA remote onboarding guidelines (EBA/GL/2022/15) the client's remedial measures should include a review of all affected business relationships.
Matching engine release moves scores under the client's threshold. A release changes transliteration handling, and a true match drops from 88 to 82 under a client threshold of 85. The Framework for OFAC Compliance Commitments (2 May 2019) names screening that did not account for alternative spellings among the root causes of apparent violations. For a bank chartered, or a money transmitter licensed, under the New York Banking Law, 3 NYCRR 504.3(b)(3) requires, to the extent applicable, end-to-end pre- and post-implementation testing of the Filtering Program, including, as relevant, data matching, whether OFAC sanctions list and threshold settings map to the institution's risks, and matching logic. The client's annual compliance finding under 504.4 then rests on testing of a superseded version, and the screening subscription goes up for replacement.
Sanctions list update applied on the nightly batch. The list service loads the OFAC SDN list and the EU consolidated list once a night, so a morning designation reaches rescreening of existing customers the next day. An EU client offering instant credit transfers must verify its users immediately after new or amended EU targeted financial restrictive measures enter into force, and at least once every calendar day, under Article 5d(1) of Regulation (EU) 260/2012, applicable since 9 January 2025. That client's breach traces back to the screening subscription it pays for.
Rolling window keyed on load time. The monitoring engine aggregates cash deposits by load time instead of transaction date. A deposit file arrives two days late, two $9,000 cash deposits on consecutive days land in separate windows, and the structuring rule for cash kept under the currency transaction report threshold of more than $10,000 (31 CFR 1010.311) never fires. 31 CFR 1020.320(a)(2)(ii) requires a SAR for a transaction conducted or attempted by, at, or through the bank that involves or aggregates at least $5,000 and that the bank knows, suspects, or has reason to suspect is designed to evade Bank Secrecy Act requirements. The monitoring subscription misses the pattern the client bought it to catch.
SAR due date calculated on the wrong clock. Case management gives every case a 60-day due date, including named-suspect cases. Under 1020.320(b)(3), a bank files no later than 30 calendar days after initial detection of facts that may constitute a basis for filing, may delay 30 more calendar days only when no suspect was identified on the date of detection, and never delays beyond 60 calendar days. Every named-suspect case filed on day 31 or later is late. The same queue delays Canadian reports that FINTRAC guidance requires as soon as practicable after the reporting entity completes the measures that establish reasonable grounds to suspect.

Licence flag and the evidence regulated clients request from a vendor

KYC and AML platforms carry licence flag "no": the bank, payment institution, or money services business using the platform holds the licence and the AML obligations, and applies due diligence, contract terms, and audit rights to the vendor.

Security reports and questionnaires

Enterprise clients ask for a SOC 2 report, an ISO/IEC 27001 certificate where the vendor holds one, a penetration test report, and a security questionnaire. The June 2023 Interagency Guidance on Third-Party Relationships states that a banking organization may consider reviewing SOC reports. On 11 September 2026 the agencies proposed guidance (FDIC FIL-58-2026) that would replace the 2023 guidance once finalised.

United States

SR 26-2 (17 April 2026) superseded SR 11-7 and the 2021 interagency statement on BSA/AML model risk. The guidance sets no enforceable standards, is expected to be most relevant to banking organizations above $30 billion in total assets, and excludes deterministic rule-based processes from the model definition. SR 26-2 calls validation of vendor models an important element and ongoing monitoring and outcomes analysis sound practice, which covers match scoring and liveness decisions that statistical models produce. Part 504 adds a vendor selection process (504.3(c)(5)) and five-year retention of records supporting the annual finding (504.4). Clients ask for:

rule and threshold test results per rule version, with expected and actual alerts;
match score tables per name variant and list version, before and after each release;
false positive and false negative counts on labelled data at each threshold;
release notes naming every change to scoring, rules, and list handling.

European Union

EBA/GL/2022/15 has applied since 2 October 2023: the client's pre-implementation assessment should include impersonation fraud tests (paragraph 14(d)) and end-to-end testing (14(e)), and the client should ensure the provider reports proposed changes to the onboarding process and modifications to the solution (48(c)). The EBA outsourcing guidelines (EBA/GL/2019/02) say an institution should not rely solely on third-party certifications and reports over time for critical or important functions (paragraph 92). Under DORA, the client lists the vendor in its register of information (Article 28(3)), and a contract supporting a critical or important function sets precise quantitative and qualitative performance targets (30(3)(a)) and unrestricted rights of access, inspection, and audit (30(3)(e)(i)). Clients ask for impersonation test results and latency and availability measured against those targets. EU AML testing covers the due diligence rules.

Canada

FINTRAC identity verification guidance allows the government-issued photo identification method for a person who is not physically present, with a process that authenticates the document. The reporting entity must still determine that the document is valid and current and that the name and photo belong to the person, and stays responsible when an agent or mandatary verifies identity. OSFI Guideline B-10 applies to federally regulated financial institutions and treats technology companies that deliver financial services as third parties. Clients ask for authenticity results per document type and security feature, and expired document rejection records; the FINTRAC requirements page maps the reporting duties.

Verification, screening, and monitoring test scenarios

Document authenticity. Genuine, altered, expired, and screen-recaptured synthetic documents, with machine-readable zone mismatches.
Liveness. Printed photo, screen replay, and mask attacks, plus virtual camera and SDK hook injection, with the decision and risk signal per attempt.
Retries and billing. Client timeouts retried with one idempotency key produce one check, one invoice line, and one stored image set; API and webhook testing covers signed result webhooks.
Name matching. Transliterations, reordered tokens, missing middle names, and company suffixes, scored with and without date of birth, per threshold and per release, as the sanctions screening false positive guide describes.
List changes. Designations added, amended, and removed during the day, with time from publication to rescreening.
PEP status. Customers leaving office, family members, and close associates, with enhanced due diligence approvals.
Rule thresholds. Amounts one cent below, at, and above each threshold, windows across midnight and time zones, and late files.
Outcomes analysis. A labelled synthetic population with planted patterns, producing the transaction monitoring rule test matrix and the false positive and false negative rate report from KYC, AML and fraud testing.
Case management and exports. Alert grouping, four-eyes approval, immutable audit trails, due dates per jurisdiction, SAR XML and FINTRAC API validation, surfaced rejections, and account data masked in logs.

Integrations and protocols to cover

Verification APIs and mobile SDKs: document capture, ePassport chip reads under ICAO Doc 9303, liveness sessions, signed result webhooks, and eIDAS electronic identification.
Sanctions and PEP data: OFAC SDN list files, the EU consolidated financial sanctions list, the UN Security Council consolidated list, and PEP data feeds.
Transaction ingestion: core banking event streams, ISO 8583 authorisations, ISO 20022 pacs.008 and camt.053 messages, and Nacha files.
Regulatory reporting and analyst access: FinCEN BSA E-Filing SAR XML batch files, FINTRAC API report submission, SAML or OpenID Connect sign-in, and audit log export to the client's SIEM.

Standards

Services

Guides

How to reduce false positives in sanctions screening: testing for false alerts and missed matches

Blog posts

Sample deliverable

Sample, synthetic data

rule and threshold test matrixRule and threshold test matrix: transaction monitoring, disputes, collections, expense, market data, and claims rules

Rule and threshold test matrix: transaction monitoring, disputes, collections, expense, market data, and claims rules
Rule ID	Rule and reference	Test values below, at, and above the boundary	Expected outcome	Actual outcome	Result
TM-STR-01	Transaction monitoring structuring rule: open an alert when one customer makes two or more cash deposits on one business day, each below USD 10,000.00, that total more than USD 10,000.00. Built on 31 CFR 1010.313(b): multiple currency transactions shall be treated as a single transaction if the institution knows they are by or on behalf of any person and total more than $10,000 during any one business day	Below: two cash deposits totalling USD 9,999.99; at: two cash deposits totalling USD 10,000.00; above: two cash deposits totalling USD 10,000.01	The USD 9,999.99 and USD 10,000.00 totals open no structuring alert; the USD 10,000.01 total opens a structuring alert and a currency transaction report flag	The USD 9,999.99 and USD 10,000.00 totals opened no structuring alert; the USD 10,000.01 total opened a structuring alert and a currency transaction report flag	Passed, 3 of 3 test values, run 2026-09-14
SAN-SCORE-01	Sanctions name-match score threshold: open a screening alert and hold the payment when the name match score against a sanctions list entry is 85 or higher. Configured screening policy; no regulation sets the score	Below: match score 84; at: match score 85; above: match score 86, each for a synthetic customer name against a synthetic list entry	Match score 84 opens no alert; match scores 85 and 86 open a screening alert and hold the payment	Match scores 84 and 85 opened no alert and released the payment; match score 86 opened a screening alert and held the payment	Failed: the comparator uses greater than 85 instead of 85 or higher; defect DEF-2210, critical severity, blocks release
CBK-DL-13.1	Chargeback response deadline for Visa Dispute Condition 13.1 (Merchandise/Services Not Received): block submission of the response package after the network time limit. Visa Core Rules and Visa Product and Service Rules, 18 April 2026 edition, section 11.2.3, Table 11-2: the Dispute Response time limit is 30 calendar days from the Dispute Processing Date, with listed regional exceptions for some domestic transactions	Below: calendar day 29 after the Dispute Processing Date; at: calendar day 30; above: calendar day 31, all dates counted in UTC	Calendar days 29 and 30 accept the response package for submission; calendar day 31 blocks submission and marks the dispute case as expired	Calendar days 29 and 30 accepted the response package for submission; calendar day 31 blocked submission and marked the dispute case as expired	Passed, 3 of 3 test values, run 2026-09-14
COL-CALL-01	Regulation F call frequency: block a further collection call to a person about a particular debt after seven calls within seven consecutive days. 12 CFR 1006.14(b)(2)(i)(A) and (b)(2)(ii): subject to the exclusions in (b)(3), a debt collector is presumed to comply if it places a telephone call to a particular person about a particular debt not more than seven times within seven consecutive days, and is presumed to violate the rule if it places calls in excess of that frequency	Below: sixth call to one person about one debt within seven consecutive days; at: seventh call; above: eighth call	The sixth and seventh calls are placed; the eighth call is blocked by the dialer and rescheduled after the seven-consecutive-day period	The sixth and seventh calls were placed; the eighth call was blocked by the dialer and rescheduled after the seven-consecutive-day period	Passed, 3 of 3 test values, run 2026-09-14
EXP-RCPT-01	Expense policy receipt threshold: require a receipt before submission of a non-lodging expense of USD 75.00 or more. 26 CFR 1.274-5(c)(2)(iii)(A)(2): except as provided in (c)(2)(iii)(B), documentary evidence is required for any expenditure other than lodging of $75 or more, except that documentary evidence for transportation charges is not required if not readily available	Below: meal expense of USD 74.99; at: meal expense of USD 75.00; above: meal expense of USD 75.01	The USD 74.99 meal expense submits without a receipt; the USD 75.00 and USD 75.01 meal expenses are blocked until a receipt is attached	The USD 74.99 and USD 75.00 meal expenses submitted without a receipt; the USD 75.01 meal expense was blocked until a receipt was attached	Failed: the rule uses greater than USD 75.00 instead of USD 75.00 or more; defect DEF-2213, medium severity, fix scheduled for the next release and does not block this release
MD-ENT-01	Market data non-professional subscriber entitlement: grant the non-professional entitlement only to a natural person who is not registered or qualified in any capacity with the SEC, the CFTC, any state securities agency, or any securities exchange or association; not engaged as an investment adviser under Section 202(a)(11) of the Investment Advisers Act of 1940, whether or not registered; and not employed by an exempt bank or organization to perform functions that would require registration. Nasdaq Equity 7, Section 147(d)(4)(A), as quoted in SEC Release No. 34-94466 of 18 March 2022	Below: natural person with no registration and no adviser role; at: natural person acting as an unregistered investment adviser; above: subscriber account opened in a company name	Only the natural person with no registration and no adviser role receives the non-professional entitlement; the unregistered investment adviser and the company account receive the professional entitlement	The natural person with no registration and the unregistered investment adviser received the non-professional entitlement; the company account received the professional entitlement	Failed: the status attestation checks registration only, so subscriber counts reported to the exchange are wrong; defect DEF-2211, high severity, blocks release
CLM-AUTO-01	Claim auto-approval limit: approve a claim without adjuster review when the payable amount after the deductible is XTS 2,500.00 or less. Configured claims authority limit; no regulation sets the amount	Below: payable amount of XTS 2,499.99; at: payable amount of XTS 2,500.00; above: payable amount of XTS 2,500.01	The XTS 2,499.99 and XTS 2,500.00 claims are approved automatically and queued for payment; the XTS 2,500.01 claim goes to adjuster review with no payment queued	The XTS 2,499.99 and XTS 2,500.00 claims were approved automatically and queued for payment; the XTS 2,500.01 claim went to adjuster review with no payment queued	Passed, 3 of 3 test values, run 2026-09-14

Rule IDs, defect IDs, customers, claims, and run dates are synthetic, USD appears only where a regulation states the threshold in USD while configured limits use XTS (the ISO 4217 test code), and rule references were checked on 2026-09-16 against eCFR, the Visa Core Rules and Visa Product and Service Rules of 18 April 2026, and SEC Release No. 34-94466.

Questions

What is KYC verification?

KYC verification is the part of customer due diligence that confirms a customer is the person or entity the customer claims to be. Under 31 CFR 1020.220, a US bank obtains a name, a date of birth for an individual, an address, and an identification number before opening an account, and verifies the identity with documents or non-documentary methods. Remote KYC verification usually compares an identity document with a live selfie or video.

False positives vs false negatives

In sanctions screening and transaction monitoring, a false positive is an alert that review shows to be legitimate activity or a different person, and a false negative is a sanctioned party or suspicious transaction that produces no alert. A lower match or rule threshold generally trades fewer false negatives for more false positives, so testing measures both counts on labelled data at each threshold.

How to reduce false positives in AML?

AML false positives fall when name screening uses secondary identifiers such as date of birth, nationality, and country to discount name-only matches, when monitoring rules are segmented by customer type and product, and when the transaction data feeding the rules is complete and correctly mapped. Each tuning change needs a regression run on known true matches and a sample of activity below the new threshold, so false negatives do not rise unseen.

Scope testing for your verification and screening platform

Send your check types, list sources, monitoring rules, and client jurisdictions, and we return a test scope with the evidence regulated clients request in vendor due diligence.

Scope your testing