AI client onboarding document checks.

What the pre-check does

AI client onboarding document checks read a customer due diligence pack before an analyst does and produce a checklist: what is present, what is missing, what is inconsistent and what is out of date. Packs for individuals hold identity documents, certified copies and proof of address. Packs for companies and trusts add registry extracts, trust deeds, lists of beneficial owners and people acting on the customer’s behalf, and often source of funds evidence. Analysts spend much of their time finding the gap that sends a pack back.

The model finds those gaps first. It does not verify identity, assign a risk rating or approve a customer. Those are compliance decisions, and authenticity checks belong to the electronic sources and face-to-face steps the code describes.

Checks the model runs

Most of the checklist comes straight from the Identity Verification Code of Practice 2026.

How the workflow runs

Inputs

Uploaded identity documents and certified copies, proof of address, registry extracts, trust deeds and constitutions, the onboarding form, and the firm’s AML/CFT programme requirements.

Systems

The onboarding portal or CRM, secure document storage, electronic verification services where used (a verified government online identity, the DIA Confirmation Service, an accredited digital identity service), a model API, and a compliance review queue.

Steps

Classify each document; extract fields with page references; run the checklist; compare names and dates across documents; map entity parties to verification status; draft a request to the customer for missing items; queue for the analyst.

Human review

An analyst verifies identity against the code’s pathways and decides whether each requirement is met. The AML/CFT compliance officer decides risk ratings, enhanced due diligence, exceptions under policy, and any suspicious activity matters.

Outputs

A pre-check report per pack, a drafted customer request, and an audit record of what the model flagged and what the analyst decided.

Measures

Packs returned incomplete after analyst review, analyst minutes per pack, days to onboard, and flags overturned by analysts.

Risks

Treating a readable document as genuine, false rejects on name variants, identity images leaking into logs, and over-collection.

What the 2026 code changed

DIA’s fact sheet sets out the update. The code commenced on 1 July 2026 and now applies to high-risk customers as well. Following it is not mandatory, but it provides a safe harbour for the relevant due diligence requirements. A verified identity from the government’s online identity service can now be a single electronic source, as can the DIA Confirmation Service, with a separate linking mechanism. Verification through an accredited Digital Identity Services Trust Framework service is a new pathway. DIA’s guidance page adds that from 1 July 2027 certified copies may be received by email, with procedures for enhanced assurance where a copy may not be genuine. Update the checklist on each date.

If you add automated selfie-to-photo matching, the Biometric Processing Privacy Code 2025 applies, and its rule 1 requires reasonable grounds to believe the processing is proportionate. The Privacy Commissioner’s AI guidance records concerns that systems developed overseas may not work accurately for Māori.

Illustrative example: an Auckland investment platform

Illustrative example, synthetic numbers: a platform onboards 220 clients a month: 170 individuals and 50 trusts or companies. Assumptions: an analyst spends 15 minutes on an individual pack and 45 on an entity pack today, and 6 and 25 minutes with a pre-check report.

• Analyst time: 170 x 9 + 50 x 20 minutes = about 42 hours a month back, and incomplete packs go back to customers the same day.
• Model fees: individuals at 6,000 input and 600 output tokens, entities at 40,000 input and 1,500 output, on Claude Sonnet 5.5 at US$2 and US$10 per million tokens (Anthropic, as listed on 19 October 2026), is about US$8 a month.

What stays with people

Analysts decide whether identity has been verified. The compliance officer decides risk ratings, enhanced due diligence, policy exceptions for customers who cannot meet standard requirements, and whether to decline. Suspicious activity decisions never involve the onboarding model.

Where onboarding checks go wrong

• Readable is not genuine. A clean, well-formed fake passes every field check. Authenticity comes from electronic sources and face-to-face steps.
• Name strictness. Macrons, transliteration and name order trigger false mismatches. Show both versions; let a person judge.
• Image sprawl. Identity images copied into prompts, logs and test sets. Keep them in secure storage and send the minimum; see protecting customer information when using AI.
• Hidden instructions. A document can carry text aimed at the model. Treat uploads as untrusted; our AI security reviews test for this.

This is an AI document processing build. Related workflows are internal policy retrieval and management reporting commentary; see the financial services overview.

Written by the Levy Street team in Wellington. Last updated 19 October 2026.