--- title: Automating customer onboarding, KYC and risk | SUMāTO description: How customer onboarding is automated with due diligence, what Colombia and Mexico each require, and where human judgement still has to sit in it. image: https://sumatogroup.com/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png --- [Skip to content](https://sumatogroup.com/en/insights/blog/automatizar-onboarding-clientes-kyc#main-content) - [INSIGHTS](https://sumatogroup.com/en/insights) - [SUPPORT](https://sumatogroup.com/en/support) - [CONTACT](https://sumatogroup.com/en/contact) EN [Español](https://sumatogroup.com/insights/blog/automatizar-onboarding-clientes-kyc) [English](https://sumatogroup.com/en/insights/blog/automatizar-onboarding-clientes-kyc) [![SUMāTO Group — home](https://sumatogroup.com/hs-fs/hubfs/BRANDING/SMT%20-%20LOGO.png?width=40&height=40&name=SMT%20-%20LOGO.png)](https://sumatogroup.com/en) - [HOME](https://sumatogroup.com/en/) - About #### SUMāTO - [About us→](https://sumatogroup.com/en/about-us) - [Terms→](https://sumatogroup.com/en/legal) - [Legal→](https://sumatogroup.com/en/legal) - [Cookies→](https://sumatogroup.com/en/legal) - [Data protection→](https://sumatogroup.com/en/legal) #### METHODOLOGIES - [Design Thinking→](https://sumatogroup.com/en/methodologies#design-thinking) - [Lean Startup→](https://sumatogroup.com/en/methodologies#lean-startup) - [PMI→](https://sumatogroup.com/en/methodologies#pmi) - [Scrum→](https://sumatogroup.com/en/methodologies#scrum) #### Vendors - [AWS→](https://sumatogroup.com/en/vendors#aws) - [Cisco→](https://sumatogroup.com/en/vendors#cisco) - [Dahua→](https://sumatogroup.com/en/vendors#dahua) - [Fortinet→](https://sumatogroup.com/en/vendors#fortinet) - [Huawei→](https://sumatogroup.com/en/vendors#huawei) - [Microsoft→](https://sumatogroup.com/en/vendors#microsoft) - [OCI→](https://sumatogroup.com/en/vendors#oci) - [Panduit→](https://sumatogroup.com/en/vendors#panduit) - Capabilities #### TECHNOLOGY - [Artificial Intelligence→](https://sumatogroup.com/en/artificial-intelligence) - [Data Analytics→](https://sumatogroup.com/en/data-analytics) - [Automation→](https://sumatogroup.com/en/automation-rpa) - [Cybersecurity→](https://sumatogroup.com/en/cybersecurity) - [Cloud→](https://sumatogroup.com/en/cloud) #### SEGMENTS - [SMB→](https://sumatogroup.com/en/smb) - [Enterprise→](https://sumatogroup.com/en/enterprise) - [Government→](https://sumatogroup.com/en/government) - Consulting #### Assessments - [AI Readiness→](https://sumatogroup.com/en/ai-readiness-assessment) - [Analytics→](https://sumatogroup.com/en/data-analytics-maturity-assessment) - [Cloud→](https://sumatogroup.com/en/cloud-readiness-assessment) - [Cybersecurity→](https://sumatogroup.com/en/cybersecurity-assessment) - [Enterprise Architecture→](https://sumatogroup.com/en/enterprise-architecture-assessment) - [IT Maturity→](https://sumatogroup.com/en/it-maturity-assessment) - [IT Strategy→](https://sumatogroup.com/en/technology-strategy-assessment) - [Process Automation→](https://sumatogroup.com/en/process-automation-assessment) #### Consulting & Architecture - [AI First→](https://sumatogroup.com/en/ai-first) - [BCP→](https://sumatogroup.com/en/business-continuity-plan) - [DRP→](https://sumatogroup.com/en/disaster-recovery-plan) - [Enterprise Architecture→](https://sumatogroup.com/en/enterprise-architecture-togaf) - [Enterprise Transformation→](https://sumatogroup.com/en/enterprise-transformation) - [IT Strategic Plan→](https://sumatogroup.com/en/it-strategic-plan) - [Strategic Consulting→](https://sumatogroup.com/en/strategic-consulting) - Operations #### INFRASTRUCTURE - [Data Center→](https://sumatogroup.com/en/data-center) - [Managed Services→](https://sumatogroup.com/en/managed-services) - [VDI→](https://sumatogroup.com/en/vdi) - [Intelligent Video Surveillance→](https://sumatogroup.com/en/video-surveillance) #### SECURITY - [NOC→](https://sumatogroup.com/en/noc) - [SOC→](https://sumatogroup.com/en/soc) #### USERS - [Modern Desktop→](https://sumatogroup.com/en/modern-desktop) - [Help Desk→](https://sumatogroup.com/en/help-desk) - Industries Industries - [Banking & Finance→](https://sumatogroup.com/en/banking-finance) - [Insurance→](https://sumatogroup.com/en/insurance) - [Government→](https://sumatogroup.com/en/government) - [Healthcare→](https://sumatogroup.com/en/healthcare) - [Telecommunications→](https://sumatogroup.com/en/telecommunications) - [Retail & Consumer→](https://sumatogroup.com/en/retail) - [Manufacturing→](https://sumatogroup.com/en/manufacturing) - [Energy, Oil & Gas→](https://sumatogroup.com/en/energy-oil-gas) - [Education→](https://sumatogroup.com/en/education) - [Logistics & Transportation→](https://sumatogroup.com/en/logistics-transport) - [Legal Services→](https://sumatogroup.com/en/legal-services) - [Engineering & Construction→](https://sumatogroup.com/en/engineering-construction) - Resources #### CONTENT - [Blog→](https://sumatogroup.com/en/insights) - [Use cases→](https://sumatogroup.com/en/use-cases) #### EVENTS - [Webinars→](https://sumatogroup.com/en/webinars) EN [Español](https://sumatogroup.com/insights/blog/automatizar-onboarding-clientes-kyc) [English](https://sumatogroup.com/en/insights/blog/automatizar-onboarding-clientes-kyc) Search - There are no suggestions because the search field is empty. [automatizacion](https://sumatogroup.com/en/insights/tag/automatizacion) # Automating customer onboarding: verification, risk and the file [Andrés Lozada](https://sumatogroup.com/en/insights/author/andres-lozada) · May 14, 2019, 8:00:00 AM · 7 min read **Onboarding a customer combines three things: gathering information, verifying it, and deciding whether to accept the risk. The first two automate well and consume most of the time; the third is a decision with regulatory consequences, and automating it completely is neither the objective nor usually permissible.** Below: why onboarding gets abandoned halfway, what automates in each stretch, what each country requires, how the risk decision is designed, and what to measure. Onboarding has a feature that sets it apart from other administrative processes: it happens while the customer can still walk away. Every additional step, every document that has to be sent again and every day of waiting translates directly into abandoned applications. And at the same time it carries requirements that cannot be skipped. That tension — do it fast and do it properly — is exactly the ground where automation contributes, provided it is clear which part can resolve itself and which cannot. ## Why it gets abandoned halfway The causes repeat. The first is **asking up front for everything that might be needed later** rather than what is required to begin. A long form deters before it contributes. The second is **asking twice for the same data**, because the uploaded document is not read and the information is requested again in a field. It is the most visible sign of a process that does not integrate its own pieces. The third is **silence**. A file under review with no indication of how much remains generates queries to the service channel and, after a few days, abandonment. The automation that retains most is not the one that decides: it is the one that informs. ## What automates in each stretch **Collection** improves when the form adapts: asking only what the customer type and product require, and pre-filling everything derivable from an uploaded document. **Document verification** resolves well with automatic reading: extracting the data from the identity document and contrasting it with what was declared catches most inconsistencies without intervention. Checking validity and internal coherence is rules work. **Consulting external sources** — restrictive lists, confirming a company exists, tax standing — is pure integration and should resolve in seconds. **Assembling the file**, which is what will stand as evidence in a review, requires no judgement and is nonetheless usually done by hand. It is among the stretches that return most time and receive least attention. ## What each country requires In **Colombia**, supervised entities operate under a risk-management system for money laundering and terrorism financing, with explicit obligations on customer knowledge, segmentation and reporting. In **Mexico**, the anti-money-laundering framework defines vulnerable activities, identification thresholds and notices to the authority. They agree in substance — know the customer, score their risk, keep evidence, report — and differ in thresholds, deadlines and formats. The practical consequence is the same as in other regulated processes in the region: **an implementation designed for one country arrives incomplete at the other**, and the design has to contemplate both from the start if the operation is regional. To this is added personal data protection, which here is particularly sensitive: the file contains identity documents and frequently financial information. Habeas Data in Colombia and the federal data protection law in Mexico condition who may access it and how long it is kept. ## The risk decision, and why it is not fully automated Scoring a customer combines objective signals — economic activity, location, product requested, results of the checks — with judgement. The objective part calculates itself and should, because a consistent calculation beats one that depends on who is reviewing. What should not run unsupervised is rejection. A negative decision affects a person or a company and, in several contexts, can be appealed. A model that rejects without anybody able to explain why is an operational problem before a technical one: somebody will have to answer that question. The design that holds automates the low-risk path, routes the rest to review with all the evidence gathered, and records which signals led to each outcome. That traceability is what a review asks for, and reconstructing it afterwards is far more expensive than generating it as you go. ## The corporate case, which is the hard one Onboarding a person is relatively bounded: a document, some checks, a decision. Onboarding a company introduces a different problem — establishing who actually controls it, and that chain can run several levels deep. Both frameworks require identifying the beneficial owner, and it is the point where most files end up incomplete. The information usually exists in public registries, but scattered and in formats that do not lend themselves to automated lookup, so the stretch ends up resolved by hand with criteria that vary by whoever does it. What can be automated is the scaffolding: requesting the corporate documentation at the right moment, extracting the declared structure, contrasting it with what the available sources return, and flagging the discrepancies. The decision on a complex structure stays human, and arrives with the preparatory work done rather than starting from nothing. ## The file as the product of the process It is worth inverting the usual framing. The objective of onboarding is not to approve a customer: it is to **produce a defensible file** that also happens to let you operate with that customer. Seen that way, several decisions change. Evidence is stored at the moment it is obtained rather than reconstructed at the end. Every external check is recorded with its date and result, because "we checked" without a date is not evidence. And periodic refresh stops being an annual project and becomes a continuous flow. That last part is what usually fails: organisations with impeccable onboarding and thousands of files that have not been refreshed in years. The refresh is straightforward to automate and almost never is, because it belongs to nobody: the onboarding team considers the customer handed over, and the servicing team never owned the file. ## What to measure Four figures describe the whole process. **Time to first transaction**, the business metric. **Abandonment rate by stage**, which shows exactly where people are lost. **Share resolved without intervention**. And **share of files passing a quality review**, the risk metric. The last two are deliberately in tension, and that tension is healthy: raising automation at the cost of file quality moves the problem to a future audit, where it costs considerably more. The starting point comes from mapping the real process and its per-stage times, waiting included. It is common to find that verification takes minutes and the file waits days for an internal signature. A [process automation assessment](https://sumatogroup.com/en/process-automation-assessment) produces that map with feasibility and a recommended order, and where the process touches sensitive personal data the design decision is taken together with [cybersecurity](https://sumatogroup.com/en/cybersecurity) rather than after it. ## Frequently asked questions ### Which part of onboarding should be automated first? Document verification and external source checks, because they are deterministic and fast. And assembling the file, which requires no judgement and is usually done by hand despite consuming considerable time. ### Can the decision to accept or reject a customer be automated? The objective scoring yes, and it should be: a consistent calculation beats one that depends on who reviews. Rejection without supervision is different, because it affects a person or company and can be appealed; somebody must be able to explain why. ### Does the same design work in Colombia and Mexico? Not without adapting it. Both frameworks require knowing the customer, scoring risk, keeping evidence and reporting, but they differ in thresholds, deadlines and formats. A design built for one arrives incomplete at the other. ### Why are applications abandoned halfway? Asking up front for everything that might be needed later, asking twice for the same data, and silence: a file under review with no indication of how much remains generates queries and then abandonment. ### What has to be recorded? Every external check with its date and result, and the signals that led to each decision. "We checked" without a date is not evidence, and reconstructing traceability after a review costs far more than generating it as you go. ### What is the hardest part of corporate onboarding? Identifying the beneficial owner. The information exists in public registries but scattered and in formats that resist automated lookup, so it ends up resolved by hand with criteria that vary by who does it. Next step [Automation and RPA](https://sumatogroup.com/en/automation-rpa)[Process Automation Assessment](https://sumatogroup.com/en/process-automation-assessment)[Cybersecurity](https://sumatogroup.com/en/cybersecurity) [automatizacion](https://sumatogroup.com/en/insights/tag/automatizacion) ![Andrés Lozada](https://sumatogroup.com/hs-fs/hubfs/SPEAKERS/AL.jpeg?width=56&height=56&name=AL.jpeg) Andrés Lozada May 14, 2019, 8:00:00 AM [LinkedIn](https://www.linkedin.com/in/andreslozada/) ### Explore more from SUMāTO [Enterprise AI](https://sumatogroup.com/en/artificial-intelligence) [Enterprise Transformation](https://sumatogroup.com/en/enterprise-transformation) [Strategic Consulting](https://sumatogroup.com/en/strategic-consulting) [AI Agent](https://sumatogroup.com/en/artificial-intelligence) [AI Contact Center](https://sumatogroup.com/en/artificial-intelligence) [Cybersecurity](https://sumatogroup.com/en/cybersecurity) ### Related Posts #### [Automating inventory: the supply chain data nobody trusts](https://sumatogroup.com/en/insights/blog/automatizar-inventario-cadena-suministro) **Inventory is the part of the supply chain where the system and the warehouse disagree, and every downstream calculation inherits that disagreement....** #### [Data quality: why two teams bring different figures to the same meeting](https://sumatogroup.com/en/insights/blog/calidad-datos-cifras-distintas-comite) **When two teams bring different figures for the same metric, there is almost never a calculation error: there are two definitions coexisting. Data...** #### [When not to automate: the cases where waiting is the right answer](https://sumatogroup.com/en/insights/blog/cuando-no-automatizar-un-proceso) **Automating the wrong process does not improve it: it entrenches the error and runs it faster, with fewer people watching. There are at least six...** ![SUMāTO](https://sumatogroup.com/hs-fs/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png?width=200&height=100&name=SUM%C4%81TO%20%7C%20LOGO%201000x500.png) Strategic technology planning consultants. AI, Analytics, Cloud and Cybersecurity ## Navigation [Home](https://sumatogroup.com/en) [Capabilities](https://sumatogroup.com/en/artificial-intelligence) [Consulting](https://sumatogroup.com/en/strategic-consulting) [Operations](https://sumatogroup.com/en/managed-services) [Industries](https://sumatogroup.com/en/banking-finance) [Resources](https://sumatogroup.com/en/insights) ## SUMāTO [About](https://sumatogroup.com/en/about-us) [Terms](https://sumatogroup.com/en/legal#terminos) [Legal & Privacy](https://sumatogroup.com/en/legal) [Data protection](https://sumatogroup.com/en/legal) Cookies ## [Contact](https://sumatogroup.com/en/contact) [sales@sumatogroup.com](mailto:sales@sumatogroup.com) Mexico HQ Mexico City, Mexico [+52 55 8897 5791](tel:+525588975791) Bogotá Bogotá, Colombia [+57 601 724 5059](tel:+576017245059) © 2026 SUMāTO Group. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Andrés Lozada", "url" : "https://sumatogroup.com/en/insights/author/andres-lozada" }, "datePublished" : "2019-05-14T13:00:00.000Z", "headline" : "Automating customer onboarding, KYC and risk | SUMāTO", "mainEntityOfPage" : { "@id" : "https://sumatogroup.com/en/insights/blog/automatizar-onboarding-clientes-kyc", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://sumatogroup.com/hubfs/BRANDING/Logo_SUMATO_Original%20-%201000x500.png" }, "name" : "SUMāTO Group" } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Document verification and external source checks, because they are deterministic and fast. And assembling the file, which requires no judgement and is usually done by hand despite consuming considerable time." }, "name" : "Which part of onboarding should be automated first?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The objective scoring yes, and it should be: a consistent calculation beats one that depends on who reviews. Rejection without supervision is different, because it affects a person or company and can be appealed; somebody must be able to explain why." }, "name" : "Can the decision to accept or reject a customer be automated?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Not without adapting it. Both frameworks require knowing the customer, scoring risk, keeping evidence and reporting, but they differ in thresholds, deadlines and formats. A design built for one arrives incomplete at the other." }, "name" : "Does the same design work in Colombia and Mexico?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Asking up front for everything that might be needed later, asking twice for the same data, and silence: a file under review with no indication of how much remains generates queries and then abandonment." }, "name" : "Why are applications abandoned halfway?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Every external check with its date and result, and the signals that led to each decision. \"We checked\" without a date is not evidence, and reconstructing traceability after a review costs far more than generating it as you go." }, "name" : "What has to be recorded?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Identifying the beneficial owner. The information exists in public registries but scattered and in formats that resist automated lookup, so it ends up resolved by hand with criteria that vary by who does it." }, "name" : "What is the hardest part of corporate onboarding?" } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://sumatogroup.com/#organization", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "MX", "addressLocality" : "Huixquilucan", "addressRegion" : "Estado de México", "postalCode" : "52787", "streetAddress" : "Av. Vialidad de la Barranca No. 6, Torre 1, Suite 400, Piso 4, Col. Bosques de las Palmas" }, "alternateName" : [ "SUMāTO Group", "SUMATO Group", "Sumato Group", "SUMATO", "SUMaTO", "SUMaTO Group", "SUMTO", "SUMTO Group" ], "areaServed" : [ { "@type" : "Country", "name" : "México" }, { "@type" : "Country", "name" : "Colombia" }, { "@type" : "Place", "name" : "Latinoamérica" } ], "contactPoint" : { "@type" : "ContactPoint", "areaServed" : "Latinoamérica", "availableLanguage" : [ "es", "en" ], "contactType" : "sales", "email" : "sales@sumatogroup.com" }, "description" : "SUMāTO is a Latin American technology consulting and integration firm founded in 2016, with a presence in Mexico and Colombia. It designs, implements and operates artificial intelligence, data analytics, automation, cybersecurity and cloud on the systems a client already runs, under governance frameworks such as NIST AI RMF and ISO/IEC 42001.", "foundingDate" : "2016", "knowsAbout" : [ "Inteligencia Artificial", "IA Generativa", "Agentes de IA", "Analítica de Datos", "Big Data", "Automatización de Procesos (RPA)", "Ciberseguridad", "Computación en la Nube", "Continuidad del Negocio y Recuperación ante Desastres", "Arquitectura Empresarial", "Transformación Digital" ], "legalName" : "SUMāTO Group", "location" : [ { "@type" : "Place", "address" : { "@type" : "PostalAddress", "addressCountry" : "MX", "addressLocality" : "Huixquilucan", "addressRegion" : "Estado de México", "postalCode" : "52787", "streetAddress" : "Av. Vialidad de la Barranca No. 6, Torre 1, Suite 400, Piso 4, Col. Bosques de las Palmas" }, "name" : "SUMāTO MX", "telephone" : "+52 55 8897 5791" }, { "@type" : "Place", "address" : { "@type" : "PostalAddress", "addressCountry" : "CO", "addressLocality" : "Bogotá", "streetAddress" : "Cra. 45 # 103-34, Of. 202" }, "name" : "SUMāTO CO", "telephone" : "+57 601 724 5059" } ], "logo" : { "@type" : "ImageObject", "height" : 500, "url" : "https://sumatogroup.com/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png", "width" : 1000 }, "name" : "SUMāTO", "sameAs" : [ "https://www.linkedin.com/company/sumatogroup", "https://www.youtube.com/@sumatogroup", "https://torre.ai/teams/SUMaTOGroup", "https://www.cbinsights.com/company/sumto-group", "https://elioplus.com/profiles/channel-partners/57295/sumato-group" ], "telephone" : "+52 55 8897 5791", "url" : "https://sumatogroup.com" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://sumatogroup.com/#website", "@type" : "WebSite", "description" : "Technology consulting in AI, data, automation, cybersecurity and cloud across Latin America.", "inLanguage" : "en", "name" : "SUMāTO", "publisher" : { "@id" : "https://sumatogroup.com/#organization" }, "url" : "https://sumatogroup.com" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://sumatogroup.com/en", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://sumatogroup.com/en/insights/blog/automatizar-onboarding-clientes-kyc", "name" : "Automating customer onboarding: verification, risk and the file", "position" : 2 } ] } ```