Skip to content

Independent architecture study

From documents to account opening

Digital User Onboarding and KYC in Financial Services on AWS

Opening an account requires more than reading an identity document. This independent architecture study combines document extraction, face comparison, external screening and retained records, with customer prompts when the application needs more information.

An independent architecture study based on public AWS guidance. A design exercise, not a client engagement.

Workload
Digital account onboarding and Know Your Customer checks
Constraint
Identity evidence, screening and retained records must support the decision
Approach
Managed document analysis with external checks and customer updates
  • Minutes, not daysAccount opening ambitionDesign target. The AWS guidance frames this as an onboarding goal, not a measured result or a guaranteed completion time.

What makes this difficult

  • Documents are only evidence

    Extracted text and a face comparison contribute evidence, but neither alone establishes document validity or completes the institution’s onboarding decision.

  • Incomplete applications stall

    Missing documents interrupt the process, so the application needs a clear way to request more information and resume the checks.

  • Screening depends on coverage

    External identity and screening sources vary by jurisdiction, making source selection and handling uncertain matches important parts of the design.

Follow an account application

An applicant supplies documents, receives any follow-up requests and moves through identity checks, screening and record retention.

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  1. 01

    Collect the application evidence

    Provides ID andselfieApplicantCollects thedocumentsOnboarding app

    The applicant uploads identity documents and a selfie through the onboarding application, giving the workflow the evidence it needs to begin automated processing.

    Illustrative example Illustrative example: an applicant submits identity documents and a selfie.

  2. 02

    Compare faces and read the documents

    Collects thedocumentsOnboarding appCompares thefacesRekognitionReads documenttextTextractChecks theapplicationVerification layer

    Rekognition compares the selfie with the document photo while Textract extracts text, producing separate evidence inputs for the application’s identity and completeness checks.

    Illustrative example Illustrative example: extracted fields and a face comparison reach the verification layer.

  3. 03

    Ask for what is missing

    Collects thedocumentsOnboarding appChecks theapplicationVerification layerRequestsmissing itemsSES and SNS

    If the application lacks required documents, the workflow sends a request through SES or SNS so the applicant can provide more evidence before screening continues.

    Illustrative example Illustrative example: the applicant receives a request for a missing document.

  4. 04

    Check identity and external records

    Checks theapplicationVerification layerAccessesscreening dataAWS Data ExchangeSuppliesexternal dataData providers

    Once documents are complete, the verification layer performs identity checks and uses third-party screening data through Data Exchange to support due diligence on the applicant.

    Illustrative example Illustrative example: external screening evidence informs the onboarding decision.

  5. 05

    Keep the supplied records

    Collects thedocumentsOnboarding appRetainssupplied dataS3 Glacier

    The application stores the applicant’s supplied data for long-term retention in S3 Glacier, with retention and retrieval choices set by the institution’s requirements.

    Illustrative example Illustrative example: supplied documents enter the selected archival storage class.

  6. 06

    Confirm successful account creation

    Checks theapplicationVerification layerSends accountnoticeSES and SNS

    After identity verification and due diligence are completed successfully, the workflow sends the applicant an account creation notice so they know the outcome.

    Illustrative example Illustrative example: the applicant receives confirmation that the account is open.

  • Request
  • Data
  • Later, queued
  • Control

The hard part

Keep identity evidence separate from the decision

Reading a document, comparing faces and screening an identity answer different questions. The verification layer brings these results together rather than treating a face match as complete approval. The reference includes DMV verification; a South African implementation would need appropriate local identity sources and a defined process for uncertain or conflicting evidence.

Compares thefacesRekognitionExtracts thefieldsTextractCombines theevidenceVerification layerSuppliesscreening dataAWS Data ExchangeRequests missingitemsSES and SNS
Illustrative: an incomplete application prompts a document request before external screening proceeds after completion.

Why this design

  1. Use managed document analysis

    Chosen
    Use Rekognition for face comparison and Textract for document text extraction.
    Because
    These services provide the document processing capabilities used by the reference architecture.
    Cost
    The application still needs acceptance criteria and a route for uncertain results.
    Reconsider when
    Evaluate specialist verification services when local document coverage or required checks exceed this design.

  2. Access screening data through a shared layer

    Chosen
    Consume third-party screening data through AWS Data Exchange.
    Because
    The reference places external data access behind this managed service.
    Cost
    Vendor subscriptions, coverage and data freshness remain responsibilities of the institution.
    Reconsider when
    Use direct integrations when required local sources are unavailable through Data Exchange.

  3. Archive retained evidence

    Chosen
    Use an S3 Glacier storage class for long-term retention of supplied data.
    Because
    The reference separates retained onboarding records from active application processing.
    Cost
    Retrieval cost and access time depend on the selected storage class and retrieval option.
    Reconsider when
    Keep frequently accessed records in an appropriate readily accessible storage class.

Cost and operating assumptions

  • Document processing

    Rekognition image processing and Textract page processing grow with submitted evidence, including documents that need to be resubmitted.

  • Screening subscriptions

    Data Exchange costs depend on the selected third-party data products and their commercial terms.

  • Record retention

    Archived data volume, storage class, retention choices and retrieval activity determine the record storage bill.

  • Customer communication

    SES and SNS usage follows status updates, missing-document requests and completion notices, with channel-specific pricing.

Assumptions behind the numbers

The supplied guidance provides no monthly total; pricing depends on usage, region and options, including document volumes, screening subscriptions and archival retrieval needs.

How it stays reliable

  • Handle inconclusive evidence

    Design an exception path for unreadable documents, uncertain face comparisons and potential screening matches rather than automatically treating them as approval.

  • Resume incomplete applications

    Preserve application progress and track missing evidence so a follow-up upload can resume the appropriate checks.

  • Keep an audit trail

    CloudWatch and CloudTrail support operational monitoring and API auditing; application decision records need their own deliberate design.

  • Test record retrieval

    Choose retention and retrieval settings for the institution’s requirements and test access to archived evidence before relying on the archive.

When this is a poor fit. A poor fit as a complete onboarding solution where required local identity sources, document coverage or exception handling have not been established.

Full technical detailThe numbered AWS flow, every service and the Well-Architected notes.

How the AWS guidance describes it

  1. Onboarding application. The user starts onboarding and supplies documents, including a driving licence in the reference example, for the KYC process.
  2. AI and ML processing. Uploaded documents enter automated processing through the architecture’s AI and ML services.
  3. Amazon Rekognition. Rekognition compares the user’s selfie with the picture in a valid document as an input to user verification.
  4. Amazon Textract. Textract extracts text from the uploaded documents using optical character recognition.
  5. Amazon SES and Amazon SNS. The application requests missing documents or provides status updates through email or notifications.
  6. Identity verification and due diligence. After documents are complete, the reference performs DMV identity verification and necessary due diligence, including sanctions checks.
  7. Third-party data APIs. The integration layer connects to sanctions, politically exposed person and adverse-media data sources.
  8. AWS Data Exchange. Third-party data is consumed through Data Exchange for checks against the applicant.
  9. Amazon S3 Glacier. Data supplied by the user is stored for long-term retention.
  10. Customer notification. The user receives a successful account creation notice after identity verification and due diligence are complete.

Well-Architected

Operational Excellence
CloudWatch and CloudTrail support monitoring and auditing while AWS operates the managed service infrastructure.
Security
Managed service security and audit integrations support the design, alongside application-specific access and data controls.
Reliability
AWS manages the scalability of services such as Textract and Rekognition.
Performance Efficiency
Managed services make it easier to evaluate processing patterns against workload requirements.
Cost Optimisation
Usage-based managed services let processing capacity follow business demand.
Sustainability
Managed and serverless building blocks reduce the need to retain excess processing capacity.