Banking onboarding: what hinders the decision-making process.

Onboarding is the point where growth, risk, and regulation intersect. It is also where financial institutions lose revenue in two simultaneous ways: with legitimate customers who abandon the process and with fraudsters who manage to navigate it.

This article brings together what Brazilian legislation requires, why friction accumulates in current workflows, and which architectural decisions allow for the acceleration of account openings without increasing fraud exposure. Enjoy your reading!

What is digital banking onboarding and what steps does it involve?

Digital banking onboarding is the remote process by which a financial institution identifies, qualifies, assesses risk, and admits a new customer, whether individual or corporate, until the account is ready to operate.

The normative basis is found in Resolution CMN No. 4,753/2019, which mandates that institutions adopt procedures and controls capable of verifying and validating the identity and qualification of account holders and their representatives, when applicable, as well as the authenticity of the provided information. This same regulation allows for the opening and closing of accounts through any service channel offered by the institution, including electronic means, with only voice telephone channels prohibited.

A typical workflow goes through seven stages.

In many institutions, these stages have been organized as a linear funnel where every customer goes through all the verifications, in the same order and with the same rigor. This design tends to produce high abandonment and high fraud simultaneously, for reasons described in the next sections.

Does reducing friction in onboarding mean giving up security?

No, friction and security measure different things. Friction is the effort that the process requires from the customer, while security is the ability to distinguish a legitimate customer from a fraudster. A process can be cumbersome yet still insecure, and this combination is common.

Workflows that apply the same rigor to all profiles can be costly for the customer without proportionally increasing the work of the professional fraudster, who has time, a plan, and tools to navigate lengthy verification sequences. The practical effect is selective in the opposite direction of the intended goal: those with legitimate interest give up.

The relevant operational issue is where to apply additional verification and based on which signal. This approach is known as adaptive friction. Low-risk cases proceed uninterrupted. Ambiguous cases receive specific checks for the type of doubt raised. High-risk cases are blocked or referred for human analysis. The total friction in the system decreases, and the ability to discriminate increases.

However, there is a relevant caveat. Some of the friction serves a dissuasive function because it increases the cost of scaling up fraud and reduces the economics of industrialized fraud. What does not hold is the premise that more steps, in and of themselves, produce more security. The ability to discriminate depends on the quality of the signal collected, not the quantity of screens presented.

Why does banking onboarding generate so much friction and abandonment?

Three factors combine: real fraud pressure, fragmented architecture, and lack of measurement by stage.

The impact is measurable. It is very common for consumers to abandon the opening of a digital account when they perceive identity verification to be slow or complex, at the same time that these same consumers are more likely to open accounts through digital channels than before.

Expanding fraud pressure

A Serasa Experian reported 1,495,696 identity fraud attempts in the first quarter of 2026, a 36.6% increase compared to the same period the previous year, equivalent to about one attempt every five seconds, with potential estimated losses of up to R$ 1.98 billion if not blocked. The financial sector accounts for six out of ten occurrences, including banks, card issuers, payment methods, and credit companies.

The nature of the threat has also changed. In a publication from June 2026, Gartner identified deepfakes among the four critical threats for security leaders and advised that detecting deepfakes alone is not sufficient to prevent identity impersonation attacks. The recommendation is to protect biometric verification through detection of presentation attacks and injection attacks, combined with contextual risk signals. The distinction between the two vectors is operationally relevant: in a presentation attack, a fabricated image is shown to the camera; in an injection attack, synthetic media is inserted directly into the data flow without passing through the sensor.

In Brazil, Operation DeGenerative AI, led by the Civil Police of the Federal District, identified the use of deepfakes to fraudulently open accounts at digital banks, with at least 550 attempts and estimated movements of R$ 110 million.

Fragmented and sequential architecture

In most institutions, the workflow has grown through sedimentation. Each fraud incident led to a new verification, each regulation initiated a new step, and each vendor came in with its own integration. The result is a chain of synchronous calls, where the response time perceived by the customer equals the sum of the latencies of all providers, and where the same information is consulted multiple times by systems that do not share data with each other.

Fragmentation also means that existing signals do not reach the moment of decision. Device telemetry remains with the fraud department, registration data with the AML/CFT department, and bureau information with the credit department. This set is rarely observed in an integrated manner at the moment when the decision needs to be made.

Lack of measurement by stage

Without instrumentation, friction parameters are adjusted by perception and reaction to incidents. Metrics that characterize a mature operation are well-known and include manual review rates and average analysis time, confirmed fraud after approval, abandonment per stage of onboarding, cost per verification and approved case, and volume of false positives and false negatives. In the absence of measurement, the trend is to increase friction reactively, penalizing good customers without necessarily reducing fraud.

What does Brazilian regulation require in banking onboarding?

The applicable framework is organized into five layers, with obligations that directly affect the design of the workflow.

Account opening

Resolution CMN No. 4,753/2019 establishes the duty of verifying and validating identity, qualification, and authenticity of the information. It also requires institutions to close accounts where they verify serious irregularities in the provided information and that the criteria for defining the necessary information for identifying and qualifying the account holders, as well as the control procedures adopted, be formalized in an updated document, indicating a director responsible to the Central Bank for compliance with obligations.

AML/CFT and KYC

Circular BCB No. 3,978/2020 established a risk-based approach. It requires procedures aimed at knowing customers, ensuring due diligence in identification, qualification, and classification, with information stored in computerized systems and validation of the authenticity of identification information, including confrontation with databases. Risk must be evaluated regarding the likelihood of occurrence and the magnitude of financial, legal, reputational, and social-environmental impacts, with categories allowing for enhanced controls in higher-risk situations and simplified controls in lower-risk situations.

This last provision has a direct consequence on the design of the workflow: the regulation assumes differentiated controls by risk level. Applying maximum rigor to the entire base does not stem from regulatory requirement.

The circular also requires enhanced due diligence for high-risk clients, such as politically exposed persons, including understanding the purpose of the business relationship, approval from upper management, and identification of the source of funds, as well as identification of the ultimate beneficiary, even in complex corporate structures.

Sharing fraud indicators

Joint Resolution No. 6/2023 obliges financial institutions, payment institutions, and other entities authorized by the Central Bank to share data and information among themselves to support their fraud prevention controls, effective from November 1, 2023. BCB Resolution No. 343/2023 details the operation of the electronic registration and consultation system and the minimum set of information to be made available. The shared data must remain available to the Central Bank for ten years, and records relating to monitoring mechanisms for five years.

BC Protect+

This is the most recent amendment that requires immediate technical adjustment in the workflow. The service allows citizens to optionally inform the entire National Financial System, through the logged-in area of Meu BC, that they do not wish to open new accounts, whether current, savings, or payment accounts, and to reverse this statement at any time.

On the institution’s side, consultation to the system before opening checking and savings accounts and altering account holders or their representatives has now become mandatory. This rule applies even to new accounts in the same institution or conglomerate where the person already has a relationship, and it came into effect on December 1, 2025. Normative Instruction BCB No. 661/2025 establishes operational procedures and provides for 24/7 availability of consultations, except for scheduled or emergency maintenance.

Regarding the handling of exceptions, if the institution decides to open the account despite a recorded restriction, the decision must be documented and justified, applicable only in exceptional situations; if it decides to refuse solely due to the restriction, the reasons must be explained to the interested party.

Data protection

The entire workflow operates on personal data, including biometric data, which are classified as sensitive under the LGPD. Legal basis, minimization, retention periods, and transparency regarding automated decisions are requirements that impact architecture, not just the legal documentation of the project. The right to review automated decisions makes the recording of decision reasons a functional requirement.

Sectoral self-regulation

In addition to the regulatory framework, since October 2025, a group of banks has adopted stricter rules against “orange” accounts under self-regulation by Febraban, with documented criteria to identify suspicious accounts, refusal of transactions with signs of illegality, closure of illicit accounts with communication to the account holder, and reporting to the Central Bank.

How to automate the registration analysis without increasing the risk of fraud?

Automation that produces security gains impacts the decision, not just the data capture. Automated workflows that merely speed up filling out a poorly designed workflow also accelerate the entry of fraudsters. Five attributes characterize secure automation.

Segmentation before the decision

Distinct pathways for automatic processing, additional verification, and human analysis, with explicit and reviewable routing criteria. The goal of direct processing should be high, but not universal.

Signals that fraudsters cannot control

Declared data are low-cost to counterfeit. Device telemetry, typing and navigation patterns, IP reputation, age and history of the phone link, coherence between channel and profile, and speed of filling out forms are expensive to simulate at scale. Sectoral sharing of fraud indicators adds the market history, a signal that a newly created registration does not carry.

Biometrics as a layer, not as a verdict

In light of injection attacks, proof of life requires detection of injection, analysis of the integrity of the capture channel, and verification of the provenance of the video stream. A biometric verification with isolated decision-making authority constitutes a single point of failure.

Validation in shadow mode before the decision-making authority

New models should operate in parallel with the current policy, without impact on the decision, for a sufficient period to observe discrepancies. Subsequent promotion occurs through champion/challenger, with controlled traffic. This procedure allows verification of whether the performance observed in the lab holds in production.

Closed-loop learning cycle

Confirmed fraud, dispute, closure due to irregularity, and reversal of decision need to return as labels for the models. Without this feedback, performance degrades at the same pace as fraud patterns evolve.

How to integrate bureaus, KYC, and anti-fraud in a single decision workflow?

Integration is made possible through an orchestration layer that separates data sources from the risk policy. Providers become replaceable components, rules and models become versioned and testable artifacts, and the decision becomes a unique and traceable event, with all the signals that produced it associated with it.

Layers of architecture

Ingestion and normalization

Each bureau, KYC provider, anti-fraud engine, and regulatory base is encapsulated behind a stable data contract. The internal consumer references the attribute, not the provider. Replacing a provider becomes a business decision, not an engineering project.

Orchestration

Defines what to consult, when, and in what sequence. Three principles guide the design:

• Consultations independent of each other should be executed in parallel. A significant portion of perceived latency arises from unnecessary serialization.
• Consultations should cascade by cost, starting with the cheapest and quickest signals. When these signals already allow for sufficiently confident decisions, costly consultations are not triggered, which reduces time and cost per approved account.
• The behavior in case of provider unavailability should be defined in advance, including what decision is taken, with what degree of conservatism, and how the case is subsequently reprocessed.

Decision engine

Concentrates the policies. Deterministic rules cover what is normative and binary, such as restrictions recorded in BC Protect+ and sanction lists. Models cover what is probabilistic, such as fraud risk and AML/CFT risk. The rule delineates what is non-negotiable, while the model orders what remains ambiguous. Policies should be versioned, testable against historical data, and alterable without deploying a new version of the application.

Audit trail

Each decision records the consulted inputs, the version of each policy and model applied, intermediate scores, reasons, and outcomes. The same record satisfies the documentation requirement of Circular 3,978, the justification required by BC Protect+ for exceptional decisions, the retention periods of Joint Resolution No. 6, and the right to review provided for in the LGPD, in addition to allowing for technical analysis of decision errors.

Observability and feedback

Consolidated business and risk metrics, with granularity by stage, segment, and policy version.

Regarding the decision to build or buy, decision engines available on the market reduce deployment time, while competitive differentiation tends to focus on risk policy and the quality of proprietary signals. The most frequent arrangement combines contracted infrastructure with internally developed risk policy.

How to reduce the account opening time without increasing false positives?

The way consists of separating decision time from the level of access granted. The account can be opened quickly with limited operational capacity, and this capacity expands as trust increases. This way, a high-cost binary decision made with incomplete information is replaced by a sequence of smaller, reversible decisions.

Seven levers produce results, ordered by return on effort.

Progressive onboarding with limits by trust

Quick approval with limits appropriate to the residual risk, increased as behavior confirms the declared profile. A false positive no longer implies a definitive refusal.

Targeted additional verification

In ambiguous cases, the complementary check must correspond to the type of doubt. Suspicion about the document requires document re-verification. Suspicion about the device necessitates validation of channel ownership. Generic requests for additional documentation add friction without contributing information.

Threshold calibration through the cost curve

Defining the cutoff point is an economic decision and requires three frequently unconsolidated values: average value of the legitimate customer lost, average loss from approved fraud, and average cost of a manual review.

Prioritization of the human analysis queue

A substantial part of the opening time corresponds to waiting, not processing. The queue should be ordered by value and risk, the analyst should receive a previously consolidated file, and cases where human analysis historically confirms the automatic decision should be removed from the queue.

Reduction of accumulated latency

The tracking indicator is the 95th percentile, not the average. Abandonment concentrates on the tail of the distribution.

Instrumentation of abandonment by stage

Identifying the exact point of dropout converts hypothesis into diagnosis and often contradicts the expectation of the involved areas.

Systematic review of refusals

A relevant portion of the refusals corresponds to false positives recoverable through additional verification offered to the customer, with acquisition costs already incurred.

Monitoring indicators

The last two indicators should be read together. Isolated tracking of the cost per approved account tends to produce permeable workflows, while isolated tracking of confirmed fraud tends to produce unproductive workflows.

Final considerations

Onboarding determines the effective acquisition cost, the quality of the customer batch, exposure to fraud losses, and the degree of demonstrable compliance before the regulator. These are four indicators generally distributed among different areas, although produced by the same set of systems.

Institutions that treat these indicators as a unique architectural problem can adjust the balance between growth and risk within short timeframes, based on versioned policy and production data.

Success story

The principle that supports this integration has already been demonstrated in adjacent contexts of real-time risk decision-making. In one of the largest e-commerce and fintech operations in Brazil, with peaks exceeding a thousand purchases per minute, the available market anti-fraud solutions covered between 85% and 90% of transactions. 

Objective worked with the client’s Risk team to build a proprietary machine learning model. The chargeback rate fell from 2.8% to 0.3%, an approximately 89% reduction, without negative impacts on sales, gaining over 90% accuracy in prioritizing cases forwarded for manual analysis. To learn more about the details of this solution, check out the full success story.

The applicable reading for onboarding is that the additional coverage did not come from more verification steps, but from proprietary signals that the industry-shared databases did not contain, associated with a prioritization that directed human efforts to the cases of greatest real risk.

Objective operates in regulated environments, integrating software engineering, data, and artificial intelligence for financial institutions, focusing on critical system modernization, regulatory compliance automation, and high-volume fraud detection. Speak with a specialist.

Frequently asked questions on the topic