When Stripe and Unit launched Banking-as-a-Service, they made it possible to embed a checking account in a retail app in weeks. What they didn’t solve was the operational question that follows immediately: who handles the compliance?
An embedded finance team building payments infrastructure for a network of marketplaces found out the hard way. Their platform was processing thousands of KYC events per month. The transactions were clean — they’d built good fraud controls at the payment layer. But the regulatory requirement for documented KYC on every new user wasn’t going away, and their compliance workflow was a spreadsheet and two contractors offshore.
The contractors were good. The spreadsheet was not a compliance program.
The problem wasn’t effort. It was architecture.
Manual review workflows don’t fail because people stop caring. They fail because they were never designed to scale. The moment transaction volume outpaces reviewer capacity, one of two things happens: you build a backlog that becomes a regulatory liability, or you hire fast and build a team that spends most of its time approving applications that were never going to fail.
Neither is a strategy.
The team evaluated three vendors. Sardine and Unit21 required custom contracts and multi-week implementations. Persona offered the most configurability but assumed they wanted to own the UX layer — they didn’t. They had an applicant data pipeline. They needed a decisioning engine.
FlowAI fit where the others required a rebuild.
The pitch was simple: hand us structured applicant data, get back a decision in seconds. No workflow builder. No rules engine to configure. No UX forms to embed. Just a POST request.
The results from their first 30 days:
- <strong>p50 latency: 1.4 seconds. p95: under 4.</strong> Their previous workflow averaged 6–10 hours for a clean applicant, accounting for queue depth and offshore handoffs. Applicants now receive an outcome in seconds. Onboarding conversion improved — most users never experienced a compliance hold.
- <strong>Sanctions coverage closed a gap they hadn’t mapped.</strong> The team had assumed their payment processor’s sanctions screening covered their obligations. It didn’t — not completely. FlowAI’s OFAC, EU, and UN checks run on every KYC case independently, at the identity level, not the transaction level. Three flagged cases in the first 30 days came from the KYC layer, not payments. Two were OFAC-adjacent matches that had cleared payment screening.
- <strong>Analyst time reallocated entirely.</strong> Of the cases FlowAI processed, 70% resolved automatically. The remaining 30% — PEP matches, geographic risk flags, document anomalies — escalated with full reasoning. Their single remaining compliance analyst shifted from doing first-pass reviews to owning escalated cases only. Decision quality went up. Burnout went down.
What the audit trail actually means in practice.
The team’s compliance officer had one requirement above all others: if a regulator asks why a decision was made, she needs to be able to show them. FlowAI’s response payload includes a <code>case_id</code>, a risk score (0–100), a decision, and a structured list of risk factors that drove it. Every escalation includes the specific flag — not just “risk threshold exceeded,” but the underlying signal: <code>PEP match — Level 1</code>, <code>FATF grey-list jurisdiction</code>, <code>document expiry anomaly</code>.
That’s a defensible audit trail. That’s what the regulator actually wants.
The team’s takeaway after 90 days:
They don’t think about KYC capacity anymore. Volume doubled in Q2. The compliance queue didn’t grow.
FlowAI's sandbox is live — no card, no sales call.
Run your first triage in 60 seconds.