Who owns each KYC stage: the software, the provider or your compliance team?
Know your customer (KYC) work at a broker follows the four customer due diligence measures in Recommendation 10 of the Financial Action Task Force (FATF): verify the client from reliable, independent sources, identify any beneficial owner, understand the purpose of the relationship and keep monitoring it. The KYC and KYT entry defines the terms. This guide covers the machinery, starting with who does what, because a polished demo can hide which column a feature belongs to.
| Stage | The software | The verification or screening provider | Your compliance team |
|---|---|---|---|
| Registration | Collects identity, address, tax residency and purpose; no funding yet | Not involved | Sets the required data per country and client type |
| Identity and liveness | Captures documents and a live image or video, time-stamped | Checks the document, the face match and liveness | Chooses methods and the fallback when a check fails |
| Proof of address | Records the document, its issue date and an expiry | Checks the document, if offered | Decides which documents count and how recent |
| Sanctions and politically exposed person (PEP) screening | Sends names and dates of birth; shows hits in the queue | Matches names against sanctions and PEP lists | Clears or escalates every hit |
| Risk rating | Applies the scoring rules and flags | Supplies check results | Writes the rules and the risk appetite |
| Appropriateness test for contracts for difference (CFDs) | Runs the questionnaire, records the result, shows warnings | Not involved | Writes the questions and the pass mark |
| Review and approval | Routes files, enforces second approval, logs decisions | Not involved | Decides; senior management approves the highest-risk files |
| Funding gates | Blocks or caps deposits and withdrawals by KYC status | Not involved | Sets limits for unverified clients |
| Refresh and records | Tracks expiry and review dates; keeps files for the retention period | Re-runs checks | Sets refresh cycles and retention |
Take this table to every demo and ask the vendor to show the screen behind each software duty. The wider system around KYC is in the forex CRM guide.
Documents, liveness and the reviewer queue
The European Banking Authority (EBA) guidelines on remote customer onboarding, applying to EU credit and financial institutions since 2 October 2023, set out what a remote identity check should do. Without an employee present, the firm should run liveness detection, by asking the client to act or by analysing the data received, and match a live image to the document photo. With an employee on video, that person should be trained to spot deception. If the evidence is too poor to check, the process should restart or move to a face-to-face check.
The guidelines also shape the queue: records, images and video time-stamped, stored securely and readable later; where possible, a random sequence of client actions to guard against synthetic identities and coercion; and, where possible, random assignment of the employee who verifies each client, to avoid collusion between client and employee. Outside the EU, ask your adviser which methods your regulator accepts.
Second approval belongs where the risk is. FATF Recommendation 12 says firms should need senior management approval for a relationship with a foreign politically exposed person, and with a domestic one where the risk is higher, and FATF gives the same approval as an example of enhanced measures for other higher-risk clients. Route those files to the senior manager your policy names as approver, and stop one person from preparing and approving the same file.
How should deposits and withdrawals be gated on KYC status?
FATF expects identity to be verified before or while a relationship starts. Countries may let firms finish as soon as reasonably practicable afterwards, where the risks are effectively managed and this is essential to avoid interrupting normal business, but the firm then needs rules for what the client may do meanwhile, such as limits on the number, types or amount of transactions. If due diligence cannot be completed, the account should not be opened, or the relationship should end, and the firm should consider a suspicious transaction report.
In software, that means account states rather than one approved flag:
- Registered: profile and documents only; no deposits.
- Pending review: deposits blocked, or capped at your limit for unverified clients where your regulator allows it; no withdrawals.
- Approved: funding open; withdrawals paid to the client's own verified methods.
- Refresh due: new deposits paused or capped; withdrawals reviewed by compliance.
- Restricted: all funding held until compliance releases it, with the reason recorded.
FATF's examples of enhanced measures for higher-risk clients include requiring the first payment to come from an account in the client's name at a bank with similar due diligence standards. On the demo, ask to see a third-party deposit held for review rather than credited.
For stablecoin deposits, the USDT deposits guide explains why verification should come before a deposit becomes trading balance.
Re-verification, source of funds and record keeping
Document expiry is the easy trigger. Risk-based refresh is harder: FATF asks firms to keep due diligence data up to date, particularly for higher-risk clients. The EU's Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, which applies from 10 July 2027, caps the interval between updates at one year for higher-risk clients and five years for everyone else, requires a review when a client's circumstances change, and makes financial institutions re-check clients against targeted financial sanctions on every new designation.
Source of funds asks where this money came from; source of wealth asks how the client built their overall wealth. FATF says firms should take reasonable measures to establish both for foreign politically exposed persons, and gives information on either as an example of enhanced measures for other higher-risk clients. The software should request documents by risk level, attach them to the file and hold the money until a reviewer signs off.
Records outlive the relationship. FATF Recommendation 11 asks for due diligence records, account files and the results of any analysis to be kept for at least five years after it ends. Article 40 of Directive (EU) 2015/849 sets the same period, with deletion afterwards unless national law extends it by up to five years. From July 2027 the EU clock also starts when an application is refused, so rejected files need keeping too.
Do CFD clients need an appropriateness test?
In the EU, yes, for business without advice. Article 25(3) of the Markets in Financial Instruments Directive (MiFID II, Directive 2014/65/EU) requires the firm to ask about the client's knowledge and experience and to warn when a product is not appropriate, or when the information is too thin to judge. The execution-only exemption covers only non-complex instruments, and CFDs cannot qualify: MiFID II lists them as point 9 of Section C of Annex I, and Article 57 of Delegated Regulation (EU) 2017/565 excludes points 4 to 11 from non-complex treatment.
The European Securities and Markets Authority (ESMA) guidelines on appropriateness (ESMA35-43-3006, 12 April 2022) expect firms to limit the risk of clients retaking the test just to find the answers that pass; a client who still falls short can be allowed to proceed only after a warning. Firms could limit attempts in a period, use different question sets for retakes or add a cooling-off period. Warnings should not nudge clients to proceed, retake the test or ask for professional status, and firms that let clients proceed after a warning should check after the event whether their warnings work, for instance by tracking how many are followed by a trade. Outside the EU, check your own regulator's rule.
Questions to ask a KYC software vendor
- Which verification and screening providers have you connected, and is adding ours a configuration change or a project?
- Can files route to different queues by risk, country and client type?
- Can one person prepare and approve the same file? Show us the setting that prevents it.
- What happens to a deposit from a third-party name, or from a client whose passport expired yesterday?
- How are risk-based reviews scheduled, separately from document expiry dates?
- When a sanctions list changes, how are existing clients re-screened, and where do new hits appear?
- Is each KYC decision logged with the reviewer, the time and the evidence, and can we export the log?
- How long are closed and refused files kept, and how is their deletion recorded?
Where EntropyX Labs fits
Brokerage CRM is the customer-account layer and traders' room for regulated forex and CFD brokers. For KYC it supplies a document upload pipeline with reviewer queues, a document vault with expiry alerts, profile, address and tax-residency management, time-based one-time password (TOTP) and SMS two-factor authentication, a security event timeline per account, and roles for sales, support, compliance and finance. Document types, review steps and risk flags are configured to your compliance manual, and compliance rules gate funding and withdrawal actions on KYC status and your risk flags. It connects to MetaTrader 5 and runs self-hosted or in a managed cloud.
EntropyX Tickets shows each client's account state and KYC status on every ticket, and EntropyX PSP has risk hooks for an address-screening provider before a USDT stablecoin deposit is credited. As custom AI work, EntropyX Labs builds KYC and document AI pipelines that read documents in several languages, classify them, run ID and liveness checks and flag risk, then hand a reviewer a ready pack, with human-in-the-loop fallbacks and per-run logs.
Brokerage CRM does not list identity verification, liveness checks or sanctions and PEP data among its own features: identity and liveness checks come from the verification provider you choose or from a custom document AI pipeline, and sanctions and PEP data from the screening provider you choose, connected per engagement, with no fixed list. Every KYC decision is logged with the reviewer, the time and the evidence, IB partners pass the same KYC as clients, and risk is shown as the flags your team defines rather than a score. Two-person approval of KYC files, decision-log exports, review schedules by risk level and a CFD appropriateness questionnaire with retake limits are set up per engagement. Your KYC policy and every decision stay with your compliance team.
Sources and further reading
- FATF Recommendations (International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation, updated October 2025) — Read 13 November 2026: Recommendation 10, the four CDD measures, verification before or during the relationship, completion afterwards where risks are effectively managed and it is essential not to interrupt normal business, no account if CDD cannot be completed and an STR considered; interpretive note to Recommendation 10, paragraph 12, limits on the number, types or amount of transactions before verification, paragraph 20, enhanced measures including senior management approval, source of funds or wealth and a first payment from an account in the customer's name, paragraph 23, records kept up to date particularly for higher-risk customers; Recommendation 11, at least five years after the relationship ends; Recommendation 12, foreign politically exposed persons
- EBA Guidelines on the use of remote customer onboarding solutions (EBA/GL/2022/15) — Read 13 November 2026: apply from 2 October 2023 (EBA press release of 22 November 2022: all credit and financial institutions in scope of the Anti-Money Laundering Directive); time-stamped, securely stored records readable for ex-post verification (paragraph 26); interrupt and restart or redirect to face-to-face (40); liveness detection and matching to the document photo in unattended onboarding (41); a trained employee in attended onboarding (42); random sequences against synthetic identities or coercion and random assignment against collusion (43)
- Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation), OJ L, 19.6.2024 — Read 13 November 2026: Article 26(2), the period between updates shall not exceed 1 year for higher-risk customers and 5 years for all others; 26(3), review where the customer's circumstances change or a relevant fact becomes known; 26(4), credit and financial institutions verify on any new targeted financial sanctions designation; Article 77(3), 5 years from termination, the occasional transaction or the refusal; applies from 10 July 2027 (Official Journal text)
- Directive (EU) 2015/849 (Fourth Anti-Money Laundering Directive), OJ L 141, 5.6.2015 — Read 13 November 2026: Article 40(1), CDD documents and transaction records kept for five years after the end of the business relationship; personal data deleted afterwards unless national law provides otherwise; further retention not exceeding five additional years (Official Journal text)
- Directive 2014/65/EU (MiFID II), OJ L 173, 12.6.2014 — Read 13 November 2026: Article 25(3), information on knowledge and experience, a warning where the product is not appropriate or the information is insufficient; Article 25(4), execution-only limited to the listed non-complex instruments; Annex I, Section C, point (9), financial contracts for differences (Official Journal text)
- Commission Delegated Regulation (EU) 2017/565, OJ L 87, 31.3.2017 — Read 13 November 2026: Article 57(a), an instrument is non-complex only if it does not fall within points (4) to (11) of Section C of Annex I to MiFID II (Official Journal text)
- ESMA Guidelines on certain aspects of the MiFID II appropriateness and execution-only requirements (ESMA35-43-3006, 12 April 2022) — Read 13 November 2026: limit retakes, different question sets, cooling-off period (paragraph 23); warnings should not encourage proceeding, retaking or a professional upgrade (72); track the ratio of warnings followed by a transaction (74)
This guide is engineering and product guidance from EntropyX Labs, a technology provider. It is not legal, regulatory or investment advice.