Banking Onboarding: What is holding back the decision process

Onboarding is the point where growth, risk, and regulation intersect. It is also where financial institutions lose revenue in two simultaneous ways: from legitimate customers who abandon the process and from fraudsters who successfully navigate it.

This article brings together what Brazilian legislation requires, why friction accumulates in current processes, and which architectural decisions allow for faster account openings without increasing fraud exposure. Enjoy your reading!

What is digital banking onboarding and what steps does it involve?

Digital banking onboarding is the remote process through which a financial institution identifies, qualifies, assesses risk, and admits a new client, whether an individual or a legal entity, until the account is ready for operation.

The normative basis is in CMN Resolution No. 4,753/2019, which requires institutions to adopt procedures and controls capable of verifying and validating the identity and qualification of account holders and their representatives, when applicable, as well as the authenticity of the information provided. The same regulation allows for account openings and closures through any service channel provided by the institution, including electronic means, with only voice phone channels being prohibited.

A typical process goes through seven steps.

In many institutions, these steps have been organized as a linear funnel where every customer goes through all checks, in the same order and with the same rigor. This design tends to produce both high abandonment rates and high fraud rates for the reasons described in the following sections.

Does reducing friction in onboarding mean sacrificing security?

No, friction and security measure different things. Friction is the effort that the process requires from the customer, while security is the ability to distinguish a legitimate customer from a fraudster. A process can be cumbersome and still be insecure, and this combination is common.

Processes that apply the same rigor to all profiles come at a high cost to legitimate customers without proportionately increasing the workload for professional fraudsters, who have time, scripts, and tools to navigate long verification sequences. The practical effect is selective in the inverse direction intended: those with legitimate interest give up.

The relevant operational question is where to apply additional verification and based on what signal. This approach is known as adaptive friction. Low-risk cases proceed uninterrupted. Ambiguous cases receive a specific check for the type of doubt raised. High-risk cases are blocked or referred for human analysis. Total friction in the system decreases while the capacity for discrimination increases.

There is a pertinent caveat. Some friction serves a deterrent purpose, as it increases the cost of large-scale attacks and reduces the economics of industrialized fraud. What is unsustainable is the premise that more steps inherently produce more security. The capacity for discrimination depends on the quality of the collected signal, not the quantity of screens presented.

Why does banking onboarding generate so much friction and abandonment?

Three factors combine: real fraud pressure, fragmented architecture, and lack of measurement by step.

The impact is measurable. It is very common for consumers to abandon the opening of a digital account when they perceive identity verification as time-consuming or complex, while these same consumers are more likely to open accounts through digital channels than before.

Expanding fraud pressure

Serasa Experian recorded 1,495,696 identity fraud attempts in the first quarter of 2026, a 36.6% increase compared to the same period last year, equivalent to about one attempt every five seconds, with potential losses estimated at up to R$ 1.98 billion if they were not blocked. The financial sector accounts for six out of ten occurrences, including banks, card issuers, payment methods, and credit companies.

The nature of the threat has also changed. In a publication from June 2026, Gartner identified deepfakes among the four critical threats for security leaders and advised that deepfake detection alone is not sufficient to prevent identity impersonation attacks. The recommendation is to protect biometric verification through presentation attack detection and injection attack detection, combined with contextual risk signals. The distinction between the two vectors is operationally relevant: in presentation attacks, a fabricated image is displayed to the camera; in injection attacks, synthetic media is inserted directly into the data stream, bypassing the sensor.

In Brazil, Operation DeGenerative AI, conducted by the Civil Police of the Federal District, identified the use of deepfakes for the fraudulent opening of accounts in digital banks, with at least 550 attempts and an estimated movement of R$ 110 million.

Fragmented and sequential architecture

In most institutions, the process grew through sedimentation. Each fraud incident led to a new verification, each regulation led to a new step, and each supplier introduced its own integration. The result is a chain of synchronous calls, where the response time perceived by the customer equals the sum of latencies from all providers, and where the same information is queried more than once by systems that do not share data with each other.

Fragmentation also means that existing signals do not reach the decision moment. Device telemetry remains with the fraud area, registration data with the AML/CFT area, and bureau information with the credit area. The whole set is rarely observed in an integrated manner at the moment a decision needs to be made.

Absence of measurement by step

Without instrumentation, friction parameters are adjusted based on perception and reaction to incidents. The metrics that characterize a mature operation are well-known and include manual review rate and average analysis time, confirmed frauds after approval, abandonment by step of onboarding, cost per verification and approved case, and volume of false positives and false negatives. In the absence of measurement, the tendency is to increase friction reactively, penalizing good customers without necessarily reducing fraud.

What does Brazilian regulation require in banking onboarding?

The applicable framework is organized into five layers, with obligations that directly impact the design of the process.

Account opening

CMN Resolution No. 4,753/2019 establishes the duty to verify and validate identity, qualification, and the authenticity of information. It also determines that institutions close accounts in which they identify serious irregularities in the information provided and that the criteria for defining the information necessary for identifying and qualifying holders, as well as the control procedures adopted, be formalized in a document kept up-to-date, indicating to the Central Bank the responsible director for compliance with obligations.

AML/CFT and KYC

BCB Circular No. 3,978/2020 established a risk-based approach. It requires procedures aimed at knowing customers, ensuring due diligence in identification, qualification, and classification, with storage of information in computerized systems and validation of the authenticity of identification information, including by cross-referencing with databases. Risk must be assessed regarding the probability of occurrence and the magnitude of financial, legal, reputational, and socio-environmental impacts, with categories that allow for enhanced controls in higher-risk situations and simplified controls in lower-risk situations.

This last provision has a direct consequence on the design of the process: the regulation presupposes differentiated controls by level of risk. Applying maximum rigor to the entire base does not stem from regulatory requirement.

The circular also requires enhanced due diligence for high-risk customers, such as politically exposed persons, including understanding the purpose of the business relationship, approval from senior management, and identification of the source of funds, in addition to identifying beneficial ownership, even in complex corporate structures.

Sharing of evidence of fraud

Joint Resolution No. 6/2023 requires financial institutions, payment institutions, and others authorized by the Central Bank to share data and information with each other to support their anti-fraud controls, effective from November 1, 2023. BCB Resolution No. 343/2023 details the operation of the electronic registration and consulting system and the minimum set of information to be provided. The shared data must remain available to the Central Bank for ten years, and records related to monitoring mechanisms for five years.

BC Protect+

This is the most recent change and requires immediate technical adaptation in the onboarding process. The service allows citizens to inform the entire National Financial System, through the logged area of Meu BC, that they do not wish to open new accounts, whether checking, savings, or payment accounts, and to reverse this notification at any time.

From the institution’s side, it became mandatory to check the system before opening checking and savings deposit accounts and before changing account holders or their representatives. The rule also applies to new accounts within the same institution or conglomerate where the person already has a relationship and came into effect on December 1, 2025. BCB Instruction No. 661/2025 establishes operational procedures and provides for availability of consultation 24 hours a day, seven days a week, except for scheduled or emergency maintenance.

Regarding the handling of exceptions, if the institution decides to open the account despite a recorded restriction, the decision must be documented and justified, applicable only in exceptional situations; if it decides to refuse solely due to the restriction, the reasons must be explained to the interested party.

Data protection

The entire process operates on personal data, including biometric data, classified as sensitive by the LGPD. Legal basis, minimization, retention periods, and transparency regarding automated decisions are requirements that impact architecture, not just the legal documentation of the project. The right to review automated decisions makes it essential to record the reasons for the decision.

Sectoral self-regulation

In addition to the regulatory framework, since October 2025, a group of banks has adopted stricter rules against dummy accounts within the self-regulation of Febraban, with documented criteria for identifying suspicious accounts, refusal of transactions with signs of illegality, closure of illicit accounts with communication to the holder, and reporting to the Central Bank.

How to automate the account analysis process without increasing fraud risk?

Automation that enhances security focuses on the decision, not just the data capture. Automated flows that only speed up the completion of a poorly designed onboarding process will similarly speed up the entry of fraudsters. Five attributes characterize secure automation.

Segmentation before the decision

Distinct paths for automated processing, additional verification, and human analysis, with explicit and reviewable routing criteria. The goal of direct processing should be high without being universal.

Signals that fraudsters cannot control

Declared data is low-cost to falsify. Device telemetry, typing and navigation patterns, IP reputation, age, and history of the telephone link, coherence between channel and profile, and speed of completion are costly to simulate at scale. Sectoral sharing of fraud indications adds market history, a signal that a newly created account does not carry.

Biometrics as a layer, not as a verdict

In light of injection attacks, proof of life requires detection of injection, analysis of the integrity of the capture channel, and verification of the origin of the video stream. A biometric verification with isolated decision-making authority constitutes a single point of failure.

Shadow mode validation before decision authority

New models should operate in parallel with the existing policy, without affecting the decision, for a sufficient period to observe divergences. Subsequent promotion occurs by champion/challenger, with controlled traffic. It is the procedure that allows verifying whether the observed performance in the lab holds up in production.

Closed learning loop

Confirmed fraud, disputes, closure due to irregularity, and reversal of decision need to feedback into the models as labels. Without this feedback, performance degrades at the same speed that fraud patterns evolve.

How to integrate bureaus, KYC, and anti-fraud measures into a single decision process?

Integration is made possible by an orchestration layer that separates data sources from risk policy. Providers become replaceable components, rules and models become versioned and testable artifacts, and the decision becomes a unique, traceable event, with all the signals that produced it associated with it.

Architecture layers

Ingestion and normalization

Each bureau, KYC provider, anti-fraud engine, and regulatory database is encapsulated behind a stable data contract. Internal consumers refer to the attribute, not the supplier. Replacing a provider becomes a business decision, not an engineering project.

Orchestration

Defines what to consult, when, and in what sequence. Three principles guide the design:

• Independent queries must be executed in parallel. A significant portion of perceived latency stems from unnecessary serialization.
• Queries should occur in cascade by cost, starting with the cheapest and fastest signals. When these signals already allow deciding with sufficient confidence, costly queries are not triggered, reducing time and cost per approved account.
• The behavior in case of unavailability of a provider should be defined in advance, including which decision is made, with what degree of conservativeness, and how the case is reprocessed later.

Decision engine

Concentrates policies. Deterministic rules cover what is normative and binary, such as recorded restrictions in BC Protect+ and sanction lists. Models cover what is probabilistic, such as fraud risk and AML/CFT risk. The rule delineates what is non-negotiable, and the model orders what remains ambiguous. Policies must be versioned, testable against historical data, and alterable without deploying a new version of the application.

Audit trail

Each decision records the inputs consulted, the version of each policy and model applied, the intermediate scores, the reasons, and the outcome. The same record meets the documentation requirement of Circular 3,978, the reasoning required by BC Protect+ in exceptional decisions, the retention periods established in Joint Resolution No. 6, and the right to review stipulated in LGPD, as well as allowing for the technical analysis of decision errors.

Observability and feedback

Consolidated business and risk metrics, with granularity by step, segment, and policy version.

Regarding the decision to build or to buy, decision engines available in the market reduce implementation time, while competitive differentiation tends to concentrate on risk policy and the quality of proprietary signals. The most common arrangement combines contracted infrastructure with internally developed risk policy.

How to reduce account opening time without increasing false positives?

The path is to separate decision time from the access level granted. The account can be opened quickly with limited operational capacity, and this capacity expands as confidence increases. This way, a high-cost binary decision made with incomplete information is replaced by a sequence of smaller and reversible decisions.

Seven levers produce results, ordered by return on effort.

Progressive onboarding with limits by trust

Quick approval with limits compatible with residual risk, expanded as behavior confirms the stated profile. False positives cease to imply definitive refusal.

Targeted additional verification

In ambiguous cases, the supplemental check should correspond to the type of doubt. Suspicion about the document requires re-verification. Suspicion about the device requires validation of ownership of the channel. Generic requests for additional documentation add friction without adding information.

Calibration of the threshold by cost curve

Defining the cutoff point is an economic decision and requires three values that are often not consolidated: average value of a lost legitimate customer, average loss from an approved fraud, and average cost of a manual review.

Prioritization of the human analysis queue

A substantial part of the account opening time corresponds to waiting, not processing. The queue should be ordered by value and risk; the analyst should receive the consolidated dossier in advance, and cases where human analysis historically confirms the automatic decision should be removed from the queue.

Reduction of accumulated latency

The monitoring indicator is the 95th percentile, not the average. Abandonment concentrates on the tail of the distribution.

Instrumentation of abandonment by step

Identifying the exact point of abandonment converts hypothesis into diagnosis and often contradicts the expectations of the involved areas.

Systematic review of refusals

A significant portion of refusals corresponds to recoverable false positives through additional verification offered to the customer, with acquisition costs already incurred.

Monitoring indicators

The last two indicators should be read together. Isolated tracking of the cost per approved account tends to produce permeable processes, and isolated tracking of confirmed fraud tends to produce unproductive processes.

Final considerations

Onboarding determines the effective customer acquisition cost, the quality of the customer batch, exposure to losses from fraud, and the degree of demonstrable compliance to the regulator. These are four indicators generally distributed among different areas, yet produced by the same set of systems.

Institutions that treat these indicators as a single architectural problem are capable of adjusting the balance between growth and risk in short timeframes, based on versioned policy and production data.

Success story

The principle supporting this integration has already been demonstrated in adjacent contexts of real-time risk decision-making. In one of the largest e-commerce and fintech operations in Brazil, with peaks exceeding a thousand purchases per minute, available market anti-fraud solutions covered between 85% and 90% of transactions.

Objective worked with the client’s Risk team to build its own machine learning model. The chargeback rate dropped from 2.8% to 0.3%, an approximately 89% reduction, without negative impact on sales, with over 90% accuracy gain in prioritizing cases sent for manual analysis. For more details about this solution, check out the complete success story.

The applicable reading for onboarding is that additional coverage did not come from more verification steps, but from proprietary signals that the shared industry databases did not contain, associated with prioritization that directed human effort to the cases of highest real risk.

Objective operates in regulated environments, integrating software engineering, data, and artificial intelligence for financial institutions, focusing on modernizing critical systems, automating regulatory compliance, and detecting high-volume fraud. Speak to a specialist.

Frequently asked questions about the topic