Digital Member Onboarding (KYC/CIP)

Digital Member Onboarding lets new members and customers apply for an account online or on a phone, scanning their identity document and taking a selfie for a liveness check. It collects the information your Customer Identification Program requires, runs verification, sanctions screening and due-diligence questions, and routes anything that does not clear to your staff. Every application keeps its evidence and decision, ready for your BSA officer, auditors and examiners.

The problem it solves

Online account opening often grows from a form bolted onto the core system, with identity checks, sanctions screening and due-diligence questions handled by different vendors and reconciled by hand. Applicants abandon long forms, staff work exceptions from email and spreadsheets, and the evidence of how each customer was identified is split across systems. When examiners test the Customer Identification Program, assembling what was checked, what failed and who decided takes far longer than it should.

Who it’s for

• Credit unions and community banks opening accounts online
• Deposit operations and member services teams who work application exceptions
• BSA officers responsible for the Customer Identification Program
• Digital banking and product teams who own the account-opening experience
• Internal audit and examiners testing CIP and due diligence

1. ApplyThe applicant chooses a product and enters the information your CIP requires, on a phone or computer. Fields are kept to what the product and your policy need, and the applicant can save and return.
2. VerifyThe applicant scans the front and back of an identity document and takes a selfie. Document details are read by OCR, the liveness check confirms a live person is present, and the information is checked against the identity verification sources configured for your institution.
3. Screen and decideThe applicant is screened against OFAC and other lists you choose, and a customer risk rating is calculated from your methodology. Applications that pass every check proceed under your rules; anything that does not goes to a person.
4. Resolve and openStaff work exceptions from a queue, ask the applicant for more documents where needed, and record the resolution. Approved applications are opened in your core system and the CIP record is kept under your retention schedule.

Mobile-first application

An application designed for phones as well as computers, with save-and-return and only the fields your product and policy need.

Document capture and OCR

Identity documents scanned with the device camera, with name, address, date of birth and document number read into the application for the applicant to confirm.

Selfie and liveness check

A selfie compared with the document photo, with a liveness check to detect photos of photos, screens and masks.

Identity verification

Applicant information checked against the documentary and non-documentary verification sources configured for your institution.

Sanctions screening

Applicants and, for businesses, beneficial owners screened against OFAC lists and other lists you choose before an account opens.

Due-diligence questions

Questions about expected activity, occupation and source of funds asked according to product and answers, and stored with the application.

Beneficial ownership

For business accounts, beneficial owners and a controlling person identified and verified, with the certification captured.

Customer risk rating

A starting risk rating calculated from your methodology and passed to your AML monitoring.

Exception queue

Applications that do not clear routed to staff with the reasons, and worked to a recorded resolution.

Configurable decision rules

Your institution decides which results proceed, which go to review and which are declined; the rules are versioned and every change is recorded.

Electronic disclosures and consent

Account agreements and disclosures presented with E-SIGN consent, and the version each applicant accepted kept.

CIP record

For each customer, the information collected, the verification methods used, results, discrepancies and how they were resolved, retained under your schedule.

Applicant

Applies online, scans their document, takes a selfie and answers due-diligence questions

Onboarding specialist

Works exceptions, requests documents and records resolutions

BSA officer

Owns CIP procedures, decision rules and risk-rating methodology, and approves high-risk accounts

Digital product owner

Manages products, application content and disclosures

Auditor or examiner (read-only)

Views applications, CIP records and the audit trail, with no ability to change them

Administrator

Manages staff users, roles and integrations

Core banking

Approved applications opened in your core system, and existing member or customer records checked to avoid duplicates, mapped during implementation.

Identity verification services

Document authentication, OCR, liveness and data-source checks performed through the identity verification services configured for your institution.

Sanctions screening

Applicants screened through your existing screening system or the screening service configured for the product.

AML monitoring

Customer risk ratings, due-diligence answers and beneficial ownership passed to Moraph's AML & SAR Automation Hub or your own monitoring system.

Account funding

After opening, the applicant is handed to the funding method your institution already uses; Moraph does not hold or move funds.

Website and digital banking

The application starts from your website or digital banking, with your branding, and can hand the new customer to digital banking enrollment.

Single sign-on

Staff sign in through your identity provider (SAML or OpenID Connect).

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; changing decision rules is separate from working exceptions.

Biometric data handling

Selfies and liveness data are used only for verification, with notice and consent captured, and retained or deleted under the schedule you set to meet applicable biometric privacy laws.

Encryption and keys

Client data, including document images, is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every application, check result, decision, rule change and export is logged with the person or rule and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Moraph cloud

Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for institutions outside the US.

Dedicated environment

A single-tenant environment for institutions whose policies require isolation, scoped in the proposal.

Branch-assisted use

The same application can be used by staff in a branch or on a tablet with the applicant present, with the channel recorded.

CIP and policy review

We review your CIP procedures, risk-rating methodology and due-diligence requirements with your BSA officer and translate them into decision rules.

Products and content

Account products, eligibility questions, disclosures and branding are configured, and the application is reviewed by your compliance and product teams.

Verification services

Identity verification and screening services are connected and their results mapped to your decision rules.

Core integration

New customer and account creation and duplicate checks are connected to your core system. We need a contact from your core-system team and test access.

Testing

Test applications covering clean passes, mismatches, possible sanctions matches and business accounts are run and reviewed with your BSA officer before launch.

Training and go-live

Onboarding specialists are trained on the exception queue, and the launch is staged by product or channel as you choose.

• Verification results depend on the identity verification services and data sources configured. No check is conclusive on its own, and your institution decides how results are used under its CIP.
• Some applicants cannot complete document capture or a liveness check, for example because of their device, document type or a disability. Your procedures should provide another way to open an account, and the product supports routing them to staff.
• It does not replace your BSA officer's judgment. Decision rules are set and approved by your institution, and the product applies them as configured.
• It does not hold, move or fund accounts. Funding uses your existing methods, and accounts are opened in your core system.
• It is not a transaction monitoring system; ongoing monitoring happens in your AML system, such as Moraph's AML & SAR Automation Hub.
• It is designed for US CIP and due-diligence requirements. Onboarding in other countries may need different documents, checks and disclosures.
• How long an application takes depends on the applicant and on any exception review; the product does not promise an account-opening time.
• Lending applications and credit decisions are not included.

• Complete an application on a phone yourself, then try one where you stop and return later
• Run test applications with an address mismatch, a failed liveness check and a possible sanctions match
• Check that each check's result and reason would satisfy your examiners
• Open a business account with two beneficial owners and review the certification captured
• Change a decision rule and review the approval and version history
• Pull the CIP record for one test customer and compare it with what your procedures require