How to pick a KYC provider for a Pan-African business

While Know Your Customer and Anti Money Laundry (KYC/AML) activities are critical for many businesses, they can be expensive to handle in-house. The cost of manually handling reviews adds up quickly as you scale, and building in-house infrastructure takes time and resources that could be better spent honing your core business. For most businesses, the business-savvy option for verifying users is to partner with a KYC provider.

Choosing the right KYC provider to outsource can be challenging – especially for businesses in Africa that are active in multiple jurisdictions. The continent’s fragmented regulatory and business landscape means businesses looking to expand across borders must deal with KYC regimes with different requirements.

Making the right choice is further complicated by the number of providers in the market. Many global providers have some coverage on the continent, although lacking physical presence means they may lack local context and expertise in crucial areas. Local providers provide stiff competition with deepened expertise but may lack spread due to jurisdictional boundaries.

So, how do you hire a KYC provider that is perfect for your business? In this article, we explore how to choose a KYC partner for a Pan-African business, considering the peculiar market conditions and other relevant factors. But like with all projects involving external stakeholders, the first place to start is inside your business.

Understanding Your KYC Requirements

The first and most important step in picking a partner is figuring out the specific requirements of your business. There are two types of requirements to consider:

Business requirements

These are the business outcomes that you want the provider to help your business achieve. Outsourcing your KYC operations to a provider should do more than help you offset that aspect of the business; it should also improve your operations and, by extension, your bottom line.

Although business requirements are typically ubiquitous across companies, documenting them for your business helps you assess providers and benchmark their performance. Some common examples of business requirements are:

• Handling regulatory compliance so you can focus on your core business.
• Improving the customer onboarding experience.
• Reducing the number of manual KYC reviews.
• Reducing fraud by preventing the onboarding of fraudulent users.
• Reducing KYC costs.

KYC Requirements

These are the legal and operational requirements your business has to meet to stay on the right side of regulations. KYC requirements vary depending on your jurisdiction or industry. For example, companies in banking and finance usually have the strictest requirements around customer identification and verification. To stay on the right side of regulations, your needs will involve a combination of the following requirements:

• Customer Identification: identifying customers is the basis of most KYC operations and will likely be a requirement for any market you do business in. Usually, this is done by obtaining customer data like their name, date of birth, phone number, and address and verifying it against a government-issued document, e.g. national ID, voters cards, driver's license, etc.
• Biometric Authentication: This is the use of biometric information, like fingerprints, live videos, selfie images, etc., to verify the identity of a customer. It is legally required in most jurisdictions, especially for enhanced due diligence.
• ID Document Verification: This involves verifying that the ID document supplied by the user is authentic. This usually requires either looking up the document details in a government database or with a template.
• Customer due diligence: this is the process of gathering information about customers to understand their risk factors for financial crimes like fraud, money laundering, and terrorism financing.
• Electronic KYC (eKYC): this involves using digital technology to perform KYC operations and onboard customers. For companies looking to scale quickly, eKYC is the go-to choice as it allows them onboard customers faster.
• Know Your Business (KYB): this section of KYC is mandatory for organizations that service businesses. Usually, this involves checks on the
• AML Checks: Some businesses must also check customers' data against sanctions, Politically Exposed Person (PEP) lists, and EP and adverse media watchlists.
• Fraud Prevention: pattern matching fraudulent behaviour early can help you prevent fraud on your platform and increase customer trust, especially for businesses with a peer-to-peer product.
   

While the exact requirements may vary depending on the markets you’re active in, it is advisable to start with a minimum requirement list that you can use to filter your provider list.

Choosing a KYC Provider for Your Business

Now that you’ve properly assessed your business requirements, the next step is assessing the providers. Companies usually choose between local or global KYC providers, all of whom promise the best service. But how do you pick a KYC provider that’s perfect for your continent-wide service? Here are some questions to help you find the best KYC provider for your business.

1. How many jurisdictions is the provider active in?
   When searching for a partner, it is important to factor in your current business activity and future roadmap. Integrating a KYC provider takes up significant work hours, so finding a provider with some presence in the countries on your roadmap is advantageous in the long run. This way, the work to be done during future expansions is minimal.
   
   Global providers usually cover more markets than local providers, but may not be able to offer more than basic KYC for those markets. There’s also the risk of a lack of expertise about African markets since it is not their primary focus. On the other hand, local providers usually have more expertise and offer more services in their specific markets. However, they usually do not have the required cover to support multi-country activity. This means you will have to integrate a new provider for each country, racking up valuable work hours.
    
2. What KYC-AML products does the provider offer?
   Cross-checking the products the provider offers against your regulatory requirements is a critical step. While most providers offer similar or interchangeable products, there are usually slight differences, especially when cross-checking the products against the jurisdictions in which you do business. Ideally, you want to find a provider that knows the requirements for your markets and can meet them. An all-in-one solution with AML + KYC + KYB on a single platform (a good example of this is Smile Identity) that can be used in multiple markets is the best bet, as integration time is usually shorter.
    
3. How reliable are the provider’s data sources?
   Some providers market themselves as having their database of KYC information, but this is not always a good sign, as unofficial databases can be subject to several shortcomings, especially around user data privacy laws. Most African countries have either enacted or are in the process of enacting personal data laws that may render those databases illegal. In addition, regulatory requirements like the explicit declaration of the purpose of data collection and consent for storing and processing user data are usually breached by unofficial databases. Also, many of the databases are out of date and full of inaccuracies.
   
   For eKYC processes, there are two common ways for businesses to verify a customer’s identity: by querying government databases or comparing with document templates. Where available, access to official or government-backed databases can be a great option. However, official access is not consistently available in every country, often due to the unreliability of the database infrastructure or an outright absence of it.
   
   Document verification using document templates is the other efficient alternative. Document templates can be used to check against outdated or fraudulent ID types. It is essential to look out for providers with access to multiple document types, including old, new and updated templates. This kind of document coverage is essential, especially in countries with fragmented ID systems; more document types will ensure your users have the highest possibility of possessing one of your accepted documents. Ghana, for example, has nine (9) ID types that can be used for KYC purposes, including two versions of the country’s voter’s card (pre- and post-2020). Partnering with a provider that only covers one ID type means you will be unable to onboard a lot of users.
    
4. Can the provider help prevent fraud?
   Aside from regulatory compliance, KYC is also an essential tool for fraud prevention for businesses. Fraud can lead to financial loss, legal issues, reputational damage, and even the eventual death of a business if not properly managed. Therefore, it is important to know if your choice provider provides fraud prevention solutions and the kind of solutions they provide.
   
   Biometric/facial verification is an excellent tool for fraud prevention, as fraudsters are unlikely to want their faces in front of a camera. It is also a regulatory requirement for certain businesses. However, most global KYC providers fail at biometric verification for African skin tones. Local providers who have more accuracy are often single-market focused.
   
   Other anti-fraud tools you should be looking for include liveliness checks, selfie spoofs, and deduplication. Deduplication, in particular, is a critical solution to look out for as it counters one of the newer types of fraud observed on the continent - duplicate accounts. In practice, it prevents users from creating multiple accounts with the same service for fraud.
    
5. How does the provider cater to user experience?
   For most products, KYC is built into the customer onboarding flow. To prevent customer churn, the KYC process needs to prioritise accessibility. One key consideration is how their software developer kits (SDKs) work. When building for Africans, it is critical to account for variable smartphone quality and the low bandwidth environment. Your eKYC solution should be able to process various image sizes while preventing user drop-offs due to uploads taking way too long.
   In addition, ID types come in different sizes, and so have different aspect ratios for images. It is crucial to have guidance prompts that tell users how to position their documents to avoid verification failures.
    
6. What integration options does the provider offer?
   Since you will need to integrate with the provider through an API, evaluating their integration options is necessary. You want to go for a vendor offering seamless backend and frontend integration to reduce the time and cost of setting up the service. If you also provide your product across different kinds of devices, e.g. mobile (android or iOS), web, etc., providers with multiple integration options are great.
   Smile Identity offers a wide range of integration options for businesses, including:
   - SDKs: iOs, Android, Hosted Web, Flutter, REACT Native
   - Web/Mobile Web: Web Integration, Javascript SDK
   - Server-to-server libraries: Ruby, Java, PHP, Python, node.js
   - REST API
    
7. How well does the provider perform?
   Knowing how well a KYC provider performs for your use case is nearly impossible to judge without intimate knowledge of the product. This means that testing is the ultimate step before you make a decision.

Once you’ve narrowed down a list of partners you want to work with, reach out to them to set up a sandbox environment that you can test in. Once set up, make sure to test everything, including the integration process, time to set up, and different ID types. Make sure to test as many versions of the IDs as you can:  legitimate, fake, expired, older, etc. Also, test the speed of manual reviews and audit the results.

How Smile Identity performs compared to other providers

With document verification coverage in 52 African countries, Smile Identity offers the most comprehensive KYC solution for businesses on the continent, whether active in one or multiple jurisdictions.

Here’s how we stack up against global and local providers:

Schedule a demo with us if you want to scale your solutions in Africa while avoiding regulatory pitfalls.