Most product teams treating a KYC flow as a conversion problem start by looking at step completion rates. They see a drop at the document upload step, another at liveness, maybe a third at the processing wait screen. They read this as a UX problem and start iterating on the copy, the UI, the loading animation. Some of that helps. Most of it misses the actual cause.
The real cause, in the majority of cases we have seen, is that the verification requirements themselves are not proportionate to the risk level of the user being verified. When you apply maximum friction to everyone, you lose the people who are most likely to be legitimate users: they are the ones with low patience for bureaucratic processes, the ones most likely to have a competitor's product open in another tab.
What Drop-Off Actually Looks Like
Drop-off in identity verification is not one event. It is a cascade with distinct stages, each with different causes and different remedies.
The first stage is pre-submission abandonment: users who start the flow and close before uploading anything. This is often caused by the upfront permission request sequence. On mobile, the combination of camera permission, notification permission, and then a document capture flow appearing immediately is enough to trigger abandonment in a meaningful fraction of users who are not yet committed to the platform. The fix is not a better camera permission dialog. It is shortening the path to the moment of value before asking for identity verification.
The second stage is capture failure. A significant percentage of document capture attempts fail on the first try, either because of image quality issues (blur, glare, partial frame) or because the automated quality check rejects the capture before even submitting to the verification service. Users who fail two consecutive capture attempts are disproportionately likely to abandon. Most mobile SDKs have quality threshold settings. The defaults are frequently calibrated for accuracy, not completion rate. Loosening those thresholds slightly, at the cost of some marginal accuracy on image quality, often recovers a substantial fraction of this group.
The third stage is liveness abandonment. Active liveness checks that require specific head movements or verbal responses have meaningfully higher abandonment rates than passive liveness. Passive liveness, which analyzes the captured frames for presentation attack indicators without asking the user to do anything, achieves comparable detection accuracy for most threat models while losing substantially fewer legitimate users. The question every product team should be asking is not "should we have liveness?" but "do the risk signals for this specific session warrant active liveness?"
The Population Problem in KYC Friction Decisions
Here is the structural issue: when a compliance team sets a KYC policy, they set it for the population of applicants as a whole. A policy that runs document verification plus active liveness for all applicants might be designed with fraud cases in mind. Those fraud cases might represent two percent of applications. The other 98 percent of legitimate users are bearing friction costs designed to catch two percent.
This is not an argument against liveness checks. It is an argument for applying them to the subpopulation where they add signal. A session where the document type is a common domestic government ID, the device is a known registered device, the behavioral signals show normal human interaction patterns, and there is no prior failed session history has a fundamentally different risk profile than a session with a combination of elevated signals. Running both through the same check sequence is correct for fraud prevention and incorrect for user experience. You want to separate those populations and treat them differently.
The KYC vendors who sell you a single check flow have a structural reason not to solve this problem for you. They get paid per check. Reducing the number of checks for low-risk applicants reduces their revenue per session. This is not a conspiracy. It is just a misaligned incentive that manifests in products designed around comprehensive coverage rather than proportionate coverage.
Measuring the Right Things
The metric most companies use for KYC flow performance is verification pass rate: the percentage of submitted sessions that result in a successful verification. This is a useful metric, but it is incomplete in a specific way. It measures what happened to the users who stayed. It does not measure what happened to the users who left before submitting.
A more complete picture requires tracking abandonment rate by flow step, broken down by the risk tier of the session if you have that data. What you will often find is that your lowest-risk sessions have the highest abandonment rates in absolute terms, simply because they are more numerous. You are losing large numbers of people to friction that their risk profile does not warrant.
The secondary metric worth tracking is false positive rate at the verification level: sessions that fail automated checks but would pass on manual review. False positives represent legitimate users who get stuck in review queues or receive rejection notices they should not have received. Each false positive generates a support ticket, often a churn event, and sometimes a regulatory escalation if the user complains to a state banking authority about an unexplained account denial. The cost of false positives is not just operational. It can have compliance implications.
A Worked Scenario
Consider a growing neobank with roughly 4,000 new account applications per week. Their current flow applies document verification plus active liveness to all applicants. They have a documented 22% abandonment rate at the liveness step, and their manual review queue runs about 140 sessions per week on average.
If they segment applicants by risk score before selecting checks, routing the bottom 60% of risk scores through document verification only (skipping active liveness), and applying active liveness only to the top 40%, their abandonment at the liveness step drops sharply for the low-risk population because that population never sees liveness at all. The overall conversion rate improves. The manual review queue may actually grow slightly for the high-risk tier as more marginal sessions are escalated, but the total volume is smaller because the low-risk population is clearing automatically at higher rates.
The net financial effect depends on the unit economics: what an acquired user is worth, what manual review costs per session, and what liveness checks cost per call. In typical fintech unit economics, the conversion improvement on legitimate users at scale significantly outweighs the marginal additional manual review cost on the elevated-risk tier.
What We Are Not Saying
We are not saying that conversion optimization should override compliance requirements. The FinCEN Customer Due Diligence rule requires that covered financial institutions verify the identity of each customer. That requirement does not specify which technical methods to use, how many checks to run, or how to sequence them. Compliance officers have latitude in how they satisfy it. Risk-based verification is not a loophole. It is the framework FinCEN itself uses when describing proportionate CDD programs.
What we are saying is that you can build a verification program that satisfies your CDD obligations and converts at materially better rates than a uniform maximum-friction flow. The two goals are not in conflict. The apparent conflict usually traces back to a KYC vendor that can only sell you one product, not to an actual regulatory requirement.
If you are working on this problem and want to talk through how risk-tiered routing applies to your specific onboarding flow, reach us at [email protected]. We have seen enough implementations to have a sense of where the levers are.