Onboarding Case Closure: Decisions, Reasons and Audit Trail

Separate technical completion from the business decision

An identity provider may report that processing is complete while returning an adverse or retryable result. Sumsub's verification-webhook documentation, for example, separates review status from the review answer and rejection information. Map those fields explicitly and preserve their provider identifiers rather than converting every completed event into approved.

Record the operator's own decision as a separate event with an authorized reviewer or approved decision process. It should refer to the evidence available at that time and the policy version used. A later provider update should create a reviewable change, not silently overwrite the history of what the operator decided.

Assemble the minimum complete closure packet

Include the applicant identity, relevant entity roles, evidence inventory with versions and dates, material checks, exceptions and the reason for the outcome. Distinguish approved, declined, withdrawn, duplicate and incomplete cases as defined by policy. An incomplete case closed for inactivity should not appear in reporting as a completed due-diligence approval.

State any remaining conditions, permitted activity and follow-up owner. Link related cases where an application is retried or corrected. Keep original evidence accessible only to authorized roles while exposing concise status information to teams that need it. FATF's recordkeeping standard supports reconstructable review records; actual retention duties and periods require the applicable legal assessment.

Check communication and downstream effects

Record which outcome was communicated, through which approved channel and when. Ensure the message reflects the actual decision without exposing restricted internal material. Check whether account provisioning, access permissions, payment instructions or monitoring tasks need to change. Closing the case in one screen does not prove those dependent actions occurred.

Use stable references for the decision and its downstream events so repeated messages do not create duplicate actions. Preserve correction history and re-opening reasons. OWASP logging guidance helps structure actor, action and outcome records while avoiding unnecessary sensitive data. Do not claim an immutable audit trail unless the actual system has verified controls supporting that claim.

Example: a completed provider review still needs a retry

In a fictional case, a provider event reports a completed review with a retryable document problem. The operator records the event and requests the permitted replacement evidence; the account remains in the appropriate pending state. After a later review, an authorized decision records the new evidence version. The earlier result remains in the timeline. Closing the document task did not itself close the entire onboarding case.