The request tends to land midweek: a sponsor bank wants the complete file on a business customer by Friday. The checks were carried out and the account was approved, yet the reasoning behind that approval lives only in the memory of an analyst who has since left.
According to a recent blog post on know-your-business (KYB) practice by AiPrise, this is a familiar failure in FinTech onboarding, and the problem is rarely missing checks. It is the missing record.
The post works through a hypothetical applicant, Northgate Supply LLC, a Texas restaurant equipment seller applying for a card programme. Its founder, Dana Reyes, holds 40%, while a Delaware holding company owns the remaining 60%.
AiPrise acknowledges that the bank, the customer and the growth team each define “good” differently, but argues the bank’s view must come first because it is the one that does not bend.
Before any customer is onboarded, a programme needs written foundations: a procedure setting out what is checked and against which sources, a documented risk model, approval authorities and lists of prohibited and higher-risk industries. Examiners read these first and judge every file against them. A promised check that was skipped becomes a finding.
Entity verification for Northgate throws up a trade name mismatch, a tax forfeiture caused by a late franchise tax filing and an EIN that is one digit out. None of it points to fraud.
The key, AiPrise says, is that a “didn’t match” outcome needs its own route, involving a customer query and a re-check, rather than being treated as an outright failure. Outside the US, registries can be far less reliable, so the file must record which source was used and its limits.
Tracing ownership through the holding company reveals Dana’s brother and sister at 30% each, making three beneficial owners. The chain should be charted, and Dana should certify that the picture is complete, a step many digital flows have quietly dropped.
Screening covers sanctions, PEP lists and adverse media, with every cleared hit explained in writing. A false PEP match on Dana’s brother was dismissed on date of birth and location, and that rationale belongs in the file.
The business itself must also be assessed: what it sells, where, at what volume and whether its activity fits the bank’s appetite. Documents serve as evidence, but a folder of PDFs without recorded conclusions is described as the most common weakness in files.
Northgate rates as medium risk, triggering a second reviewer, with both reviewers and their rationale recorded. After onboarding, periodic and event-driven refreshes keep the file current. AiPrise notes that FinCEN’s February 2026 relief made the timing of owner re-verification risk-based rather than optional.
Banks will also expect programme metrics, including decision times by risk tier, straight-through approval rates, avoidable document requests and QA error rates. Recurring gaps include ownership chains that stop at the holding company, missing certifications and undocumented reasoning. These are process failures, and at scale they demand tooling built to produce the record.
Read the full AiPrise post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
