Onboarding Governance

Understand the topic

An onboarding system collects information; governance determines how that information becomes a justified decision. A company record, screening result or completed upload may answer one narrow question while leaving another unresolved. This collection helps reviewers preserve those distinctions: who the applicant is, which people own or control it, who can act for it, what a possible match means and which person has authority to decide the case.

The entity pages begin with roles and relationships. A director, shareholder, beneficial owner and authorized signer can be the same person, but they do not have to be. An ownership chart should show every relevant link and explain the evidence behind it. Multiplying percentages through a simple chain helps describe economic ownership; it does not automatically settle control, legal thresholds or complex arrangements. The worked examples show the calculation and its limits without assigning a universal beneficial-ownership rule.

Screening pages focus on review evidence rather than automatic conclusions. A possible PEP match needs identity and role assessment; PEP status is not proof of wrongdoing. A sanctions name similarity requires the applicable list context, supporting identifiers and an authorized escalation process. A similarity score is not a probability of criminality or a universal permission to release an account. Preserve uncertainty when the available evidence cannot support a definite conclusion.

Funding and risk reviews then connect the intended relationship with its documented context. Source of funds concerns the particular money involved, while source of wealth concerns how a person's broader assets accumulated. The evidence requested should answer the actual question under the applicable policy. A risk review records factors, changes, unresolved issues and the decision rationale. It should not turn nationality, a software status or an unexplained number into a substitute for relevant evidence and qualified judgment.

Review does not end at initial approval. Ownership changes, new activities, conflicting information or expiring evidence may create specific refresh tasks. A case-closure record should explain the decision at a point in time and preserve what remains outstanding. The privacy page separately records notices, processing purposes, lawful-basis assessments and choices. A checkbox acknowledging a notice is not automatically consent for every use, and withdrawing an optional preference does not by itself decide every legal retention obligation.

The sources include FATF standards and guidance, OFAC's own screening explanations, UK ICO guidance and provider documentation for technical workflow examples. Their scopes differ. FATF standards require implementation through applicable systems; OFAC and ICO materials address their respective frameworks; a provider callback describes a technical event. These pages are operational worksheets, not country-specific legal advice, a universal document checklist or a promise of approval. Adapt them with the responsible policy owners for the actual entity, activities, customers and markets, and keep the evidence necessary to explain each decision.