KYB Reality Check

The Reality

A Shadow Flow is already running.

What every Luxembourg fund estate effectively has is a Shadow Flow running next to the Standard Flow — just not explicitly defined. The Shadow Flow is manual, experience-driven, and slower. A meaningful part of onboarding is operating outside the optimised flow.

Six patterns surface repeatedly across regulated-entity onboarding estates. Each one describes the second process — not a failure, but an undocumented capability that carries real operational and governance risk.

Provider data mismatch

Registry, payment, and identity data don't agree. The team resolves it by judgment, not by rule. The resolution logic isn't written down anywhere.

Layered UBO conflicts

Holding structures, fund-of-fund layers, nominee shareholders. The investor passes basic UBO screening, but the actual control path requires a manual investigation that isn't tracked.

Source-of-wealth grey zones

Document patterns the standard provider flow doesn't classify cleanly. Senior reviewers make the call — and the call doesn't always produce the same answer twice.

Manual document chasing

A reviewer emails the investor, then the fund admin, then the transfer agent. The cycle isn't tracked in the workflow tool. The elapsed time is invisible to management reporting.

Sensitive data via informal channels

Screenshots in chat, PDFs forwarded with personal data exposed, files sitting in inboxes longer than they should. Common. Rarely audited.

Decision-logic drift

Two reviewers, same edge case, different outcome. Not because either is wrong — because the rule isn't written down. The difference is undocumented experience.

Who This Is For

Structured for the teams that own the problem.

The Reality Check addresses the fund operations and compliance professionals who already know the second process exists — and need it documented, measured, and made explicit before it becomes a governance liability.

Role	What this addresses
Fund Operations Lead	The clean cases run themselves. The messy ones eat the team's week, and there is no good number to put on it. The Reality Check produces that number.
MLRO / Compliance Officer	Exception-handling answers exist in people's heads. Audit trail is solid on the standard flow; on the manual fallback, less so. The sprint closes that gap with explicit decision documentation.
Transfer Agent / Fund Administrator	Provider data conflicts arrive every day. The team resolves them with experience, but the resolution logic isn't written down. The sprint makes it explicit and consistent.
Onboarding Owner	Investor activation timing is unpredictable for layered structures, and the variance shows up downstream as commercial friction. The sprint surfaces what drives it — and what can be standardised.

Not the right fit

Funds that have already commissioned a full onboarding overhaul in the last 12 months.
Teams looking for an AI tool to drop into their stack.
Organisations shopping for a KYC/KYB platform replacement.

The Engagement

Three steps. Concrete deliverables at each.

A structured diagnostic and documentation sprint. No open-ended retainer, no vague transformation. Each step produces a defined output the fund keeps regardless of whether the next step proceeds.

Diagnostic · 90 minutes

Reality Session

A 90-minute working session with the fund's onboarding and compliance leads. IDCanopy walks through one or two real onboarding cases — one clean, one with exceptions — and surfaces the patterns that emerge.

✓2–3 specific blind spots identified, named, and quantified by frequency, time impact, and risk vector.
✓A one-page dual-process map specific to the fund's estate.
✓A view of what a remediation would scope to — before any commitment is made.

€2,000, applied as credit against the sprint if the engagement proceeds. The diagnostic stands on its own — no platform commitment, no obligation, and the findings are the fund's to keep regardless of what it implements next, or with whom.

Fixed scope · Two weeks · €20,000

Two-Week Sprint

Two weeks. Fixed scope. €20,000. The sprint takes what the Reality Session surfaces and produces a complete documentation and decision-logic package — everything needed to make the second process explicit, measurable, and consistent.

✓Documented current-state exception paths — the second process, made explicit.
✓Explicit fallback logic for non-clean cases: provider data conflicts, UBO chain depth, atypical source-of-wealth documentation.
✓Decision trees for manual review and escalation thresholds.
✓Provider and data-mismatch handling model.
✓Measurement structure for the manual-exception flow — so it stops being invisible.
✓Prioritised implementation roadmap, sequenced by ROI and risk.

The sprint does not

Replace existing KYB providers.
Require a platform switch.
Require AI tooling to deliver value.
Interrupt the operational team beyond a defined number of working sessions.

Optional · Separate decision

Implementation

If the fund wants help executing the roadmap, IDCanopy can work alongside existing providers — or, where it fits, connect the fund to UmbrellaID or other production-grade tooling.

No vendor lock-in. No obligation. The sprint deliverable stands alone. Implementation is a separate decision made with full knowledge of the findings — not a commitment required to proceed.

What We Typically Find

Five patterns that recur across regulated-entity onboarding estates.

These are structural patterns observed across reviewed Luxembourg fund administration estates — not claims about any specific client. The buyer should be able to recognise them without feeling audited by them.

01

30–40% of cases run through the unofficial flow.

The standard flow handles the clean majority. The remainder routes through manual handling that doesn't appear in the workflow report — invisible to management, visible only to the team carrying it.
02

Layered UBO structures take 4–8× longer than baseline cases.

The delay isn't recorded as a process issue — it's recorded as "investor delay." The operational cost is absorbed by the team, not surfaced in cycle-time reporting.
03

Provider-data conflicts get resolved differently by different reviewers.

Without an explicit conflict-resolution rule, identical inputs produce non-identical outcomes. The difference is experience, not error — but the inconsistency carries governance exposure.
04

Source-of-wealth review is the single largest source of unmeasured cycle-time variance.

Reviewers spend disproportionately on it. No one tracks how long. The tail is invisible to management reporting and absent from process-improvement conversations.
05

The reporting layer reports the standard flow.

Manual exceptions are absorbed by the team, not surfaced in management reporting. The COO sees the average. The team carries the tail. The gap between the two is the second process.

Why IDCanopy

Engineering-led. Delivered by the founding team.

The diagnostic stands independently of any IDCanopy product commitment. IDCanopy's credibility in this engagement rests on operational depth, not on a platform sale.

Twenty years in regulated identity infrastructure

IDCanopy's founding team brings two decades building KYC, KYB, AML, and digital-identity infrastructure across DACH banking, EU funds, and payments — including post-M&A transformation, insolvency-rescue at scale, and national payment infrastructure design.

Both sides of the buyer's question

IDCanopy has designed onboarding for regulated entities and evaluated KYC/KYB vendors. The Reality Session is shaped by that asymmetry — the team can read both the operational reality and the vendor landscape without a conflict of interest in either direction.

Diagnoses ship with operational artefacts, not opinions

Engineering-led methodology. Sprint outputs are working documents — exception-path maps, decision trees, measurement structures — not slide decks summarising what the team already knows.

Trusted by regulators and industry bodies

The founding team has served as domain expert for McKinsey, Bain, the EBA, and Gartner on identity and payments. The diagnostic framework reflects institutional-grade methodology, delivered at consulting-boutique pace and cost.

"Delivered by IDCanopy's founding team. The diagnostic stands independently of any IDCanopy product commitment."

Bernhard Reiterer

Founder & CEO · IDCanopy

Twenty years building regulated identity and KYC infrastructure across DACH banking, EU funds, and payments. Co-founder of IDCanopy (regulated identity orchestration). Former founder and CEO of SignD Identity — Austria's leading digital identity provider. Has consulted for McKinsey, Bain, EBA, and Gartner as a domain expert on payments and identity.

Common Questions

Three questions operations teams ask before engaging.

Direct answers.

"We can do this ourselves."

Yes — and you should. This engagement only works for teams that already know their process well. IDCanopy is not taking onboarding away from the fund. The question the Reality Session tests is whether the exception path is as explicit, measurable, and consistent as the standard path. Most teams know one and not the other.

"We already have a KYB provider."

Good — that means IDCanopy works with what the fund already has. The sprint doesn't replace providers. It defines the fallback logic, decision paths, and measurement structure around them. The output makes the existing stack more governable — not redundant.

"€20k sounds expensive."

A clean two-week sprint costs less than the operational overhead of one manual-exception case escalated to senior compliance. The Reality Session exists specifically so the fund can size that calculation against its own data before committing to the sprint.

Book a Reality Session

Request a Reality Session.

90 minutes with the fund's onboarding and compliance leads. Structured walk-through of real cases. Written output the fund keeps.

Commercial terms

The diagnostic stands on its own.

90 minutes. €2,000, applied as credit against the sprint if you proceed. No platform commitment, no obligation — the findings are the fund's to keep regardless of what it implements next, or with whom.

Request a Session Schedule directly →

bernie@idcanopy.com · Response within one business day.