# Zyphe: full content map for LLMs This file is the full machine-readable content of zyphe.com, intended for AI crawlers and large language models that ground answers in source content. Zyphe is an AI agents platform for compliance. Its agents prepare KYC, KYB, AML, sanctions and transaction monitoring reviews inside the tools regulated companies already use, with the evidence and a written rationale attached, and the customer's team approves the decisions. Zyphe sells this two ways: operated review desks that work an agreed queue under a service level, and a verification platform and API priced per verification. Customer PII is encrypted and split across storage nodes rather than held in one Zyphe database, and every decision carries a per-decision audit trail. --- ## Hero positioning AI agents that prepare compliance reviews. Zyphe operates KYC, KYB and AML review queues with AI agents. We agree the scope, work in the tools your team authorizes, and return case files with evidence, written reasoning and unresolved questions. Your team sets policy and approves decisions. Built for OCC, FDIC, FCA and Fed regulated institutions, EMIs, and fintech platforms --- ## Capabilities ### Agents act inside your stack Zyphe agents log into your existing case management, KYC/KYB, AML, and ticketing tools. They reason over data, take action, and complete reviews, replicating the workflows of your best analysts. ### Leading risk reasoning models Agents leverage state of the art reasoning models tuned for compliance workloads: KYC verification, UBO mapping, sanctions screening, transaction monitoring, and EDD. ### Privacy-first audit substrate Decentralised PII storage means there is no central honeypot to breach. Every decision carries a documented rationale and audit trail compliance officers can defend to regulators. --- ## Services in detail ### KYC verification Customer identity verification with document, biometric, and NFC chip read on a privacy-first substrate. ### KYB and periodic reviews Entity formation checks, registry lookups, UBO mapping, and periodic refresh on schedule or on trigger events. ### Anti-money laundering investigations Triage L1 alerts and complete L2 cases faster with Zyphe AI agents. ### Sanctions, PEP and adverse media Resolve hits against watchlists and providers you already use, with false-positive disposition and escalation drafting. ### Transaction monitoring Disposition TM alerts, surface typology patterns, draft SAR/STR narratives inside your existing TM platform. ### Enhanced due diligence Complete consumer and business EDD processes that used to take hours in minutes. ### Ongoing monitoring Periodic KYC refresh, dynamic risk reassessment, trigger-event handling. ### Audit preparation Cleaned-up case files, structured sampling, narrative consistency review, regulator-ready evidence packs. ### Document review IDs, proof of address, corporate documents, source of funds documents reviewed against your acceptance matrix. ### Case management Agents work inside your case manager (Unit21, Hummingbird, Sumsub, Sift, Alloy, Persona, or in-house). ### Custom agents Forward Deployed Engineering helps build novel agents for your unique business model on top of our privacy-first substrate. --- ## Operated review desks (compliance as a service) Zyphe also runs compliance operations work as operated desks rather than as software the customer runs. Agents work an agreed queue against the customer’s own policy and produce a decision-ready file with a written rationale; the customer approves. The following decisions are never taken by Zyphe, because Article 18(3) of Regulation (EU) 2024/1624 provides that they shall not be outsourced under any circumstances: - The proposal and approval of your business-wide risk assessment - The approval of your internal policies, procedures and controls - The decision on the risk profile attributed to a customer - The decision to enter into a business relationship or carry out an occasional transaction - Reporting suspicious activity, or threshold-based reports, to your FIU - The approval of the criteria used to detect suspicious or unusual transactions Two qualifications belong with that list. Article 18(3)(e) permits FIU reporting to be outsourced to another obliged entity in the same group and established in the same Member State. Article 18(7) lets a collective investment undertaking without legal personality outsource points (c), (d) and (e) to one of its service providers, once it has notified its supervisor and the supervisor has approved. Neither reaches a typical bank, payment institution, electronic money institution or crypto-asset service provider. Approving an individual alert disposition is not itself an Article 18(3) requirement. The Regulation governs the decisions listed above; how much of the rest your team reviews is set by your own policy. By default Zyphe returns every case for approval, because that is the service boundary we sell, not because a regulation compels it case by case. Auto-pilot runs only on categories your organisation has validated and switched on, an agent's action goes through only if a rule-based check also passes, and your MLRO keeps final sign-off. Article 18(1) of the same Regulation permits outsourcing of other tasks provided the supervisor is notified before the service provider starts. Article 18(2) treats the provider as part of the obliged entity, leaves the obliged entity fully liable, and requires it to be able to demonstrate to its supervisor that it understands the rationale behind the provider’s activities. The Regulation applies from 10 July 2027. ### Sanctions and PEP alert review Sanctions and PEP alert review is the work of deciding whether each screening hit is a true match to a designated person or entity, or a false positive to be discounted. Zyphe runs it as an operated desk: agents pull the customer record and the list entry, compare names, dates and identifiers against your matching policy, and produce a written disposition for every alert. Your analysts approve. The decisions EU law reserves for the obliged entity, including the customer risk profile and whether to enter a business relationship, stay with your team. **URL**: https://www.zyphe.com/agents/sanctions-pep-alert-review **How the desk works** - Pull the whole picture: The agent retrieves the customer record you hold, the list entry that triggered the alert, and every previous disposition on the same customer, so a hit discounted last quarter is not investigated from a blank page. - Compare against your policy: Names, dates and places of birth, nationality and any document identifiers are compared using your matching rules and thresholds, not a generic default the vendor prefers. - Write the disposition: Each alert gets a plain-language rationale: which fields matched, which did not, which sources were checked, and why the conclusion follows from them. - Escalate what is not clear: Genuine identity overlap, a weak but plausible match, or a designation that has changed in substance goes to your analyst with the evidence already assembled and the open question stated. - Hand over a file, not a verdict: Every alert leaves the desk with its evidence and reasoning attached, in a form your case management system and your audit trail can both accept. **What this desk will not do** - Set or tune your matching thresholds - Decide a customer's risk rating - Approve or reject an onboarding - File a suspicious activity report on your behalf - Change your screening policy ### Adverse media review Adverse media review, also called negative news screening, is the work of checking whether press coverage and public records about a customer indicate financial crime risk. Most of what a screening tool surfaces is noise: a namesake, a story where your customer is the victim rather than the subject, or an article too old to bear on today's risk. Zyphe runs the review as an operated desk. Agents read the underlying sources, resolve whether the coverage is genuinely about your customer, classify it against your risk taxonomy, and produce a cited summary. Your analysts decide what it means for the relationship. **URL**: https://www.zyphe.com/agents/adverse-media-review **How the desk works** - Read the source, not the headline: Aggregated snippets routinely drop the qualifier that changes the meaning: charges dropped, a person named as a witness, an allegation attributed to a party rather than established. The agent opens the underlying item and works from its text. - Resolve the entity: The agent establishes whether the person or company in the coverage is actually your customer, using date of birth, location, employer, corporate identifiers and the surrounding detail, and records what the resolution rests on. - Classify against your taxonomy: Each relevant item is placed against your own categories: predicate offence type, the customer's role in the story, the date, and the credibility of the outlet. Your taxonomy, not a generic risk label. - Summarise with citations: The customer gets one summary that a reviewer can act on, with every assertion linked to the item it came from, so nothing rests on the agent's paraphrase alone. - Escalate the material findings: Anything that plausibly changes the risk picture goes to your analyst with the reading already done and the open question stated plainly. **What this desk will not do** - Define your adverse media taxonomy or lookback period - Decide what is material to your risk appetite - Exit or restrict a customer relationship - File a suspicious activity report on your behalf - Treat an unverified allegation as an established fact ### UBO and EDD review Enhanced due diligence is the deeper investigation a regulated firm runs on higher-risk customers, and beneficial ownership resolution is the part of it that traces who ultimately owns or controls a company. Zyphe runs both as an operated desk: agents map the corporate structure, walk each layer through the registries until they reach natural persons, screen those people against sanctions, PEP and adverse media sources, and assemble the file with the gaps stated rather than glossed. Your team sets the customer's risk profile and decides on the relationship, both of which AMLR Article 18(3) reserves to your firm. **URL**: https://www.zyphe.com/agents/ubo-edd-review **How the desk works** - Map the structure: The agent establishes the immediate corporate picture from the registry of incorporation: entity status, directors, filed shareholders, and the identifiers that let the next layer be traced. - Walk the chain to natural persons: Each corporate shareholder is followed through its own registry, layer by layer, until the chain reaches natural persons or reaches something that cannot be resolved. Zyphe runs registry checks against 240+ corporate registries worldwide. - Apply your ownership threshold: Zyphe defaults to a 25% beneficial ownership threshold, configurable per risk tier, and records control exercised by other means where the shareholding alone does not capture it. - Screen everyone the chain produces: Every natural person identified is screened against sanctions, PEP and adverse media sources, and the results are attached to the position they hold in the structure rather than to a flat list of names. - Document what did not resolve: Opaque layers, nominee arrangements, registries with no public filing and contradictions between sources are written into the file as open items. A gap recorded is defensible at audit. A gap smoothed over is not. **What this desk will not do** - Set your beneficial ownership threshold or EDD triggers - Decide the corporate customer's risk rating - Approve or reject an onboarding - Declare an unresolved chain resolved - File a suspicious activity report on your behalf ### Transaction monitoring alert triage Transaction monitoring alert triage is the work of deciding which rule-triggered alerts reflect genuine suspicion and which are ordinary account behaviour. Zyphe runs it as an operated desk: agents reconstruct the transaction history behind each alert, test it against that customer's own established pattern and against your typology library, and produce a written disposition, with a draft narrative where escalation is warranted. Your investigators approve. The decision to report to the FIU never leaves your firm, because AMLR Article 18(3)(e) does not allow it to. **URL**: https://www.zyphe.com/agents/transaction-monitoring-alert-triage **How the desk works** - Reconstruct the account picture: The agent pulls the transaction history around the alert, every prior alert on the same customer, how each was dispositioned, and what the customer declared about expected activity at onboarding. - Test against that customer's baseline: An alert only means something relative to what is normal for this customer. Seasonal trade, a funding round, a payroll cycle and a genuine structuring pattern all breach the same threshold and read completely differently against the customer's own history. - Apply your typologies: Your rules, your thresholds, your typology library. The desk applies the detection criteria you approved rather than importing a generic pattern set and calling it best practice. - Draft the disposition or the narrative: Alerts that resolve get a reasoned close. Alerts that do not get a narrative drafted in your house format, with the supporting facts assembled, for your investigator to amend, approve and file. - Write it back where you work: The disposition and its evidence return to your monitoring or case management platform, in the structure your audit trail already expects. **What this desk will not do** - Write or tune your detection rules and thresholds - Close an alert without your approval - Decide a customer's risk rating - File a suspicious activity report on your behalf - Decide whether to exit a relationship ### KYC periodic review and refresh KYC periodic review, also called ongoing due diligence or KYC refresh, is the work of re-verifying existing customers on a schedule or when something changes. Zyphe runs it as an operated desk: agents pull the file you already hold, re-run the checks your policy requires for that risk tier, and compare the result against what was decided last time. The output is a diff, not a fresh dossier, so your reviewer reads what actually changed. Your team approves the refreshed risk profile, which AMLR Article 18(3)(c) reserves to your firm. **URL**: https://www.zyphe.com/agents/kyc-periodic-review-refresh **How the desk works** - Pull the file you already hold: The agent starts from what was decided at onboarding or at the last review, and on what evidence, so the review measures change rather than starting from a blank page. - Re-run what your policy requires: Identity, address, corporate registry, ownership and screening checks are re-run to the depth your policy sets for that risk tier, not to a single depth applied to everybody. - Diff against the file: The output is the delta. Unchanged items are marked unchanged and take none of your reviewer's attention. This is the step that turns a periodic review from a re-read into a decision. - Flag what actually matters: A new beneficial owner, a designation on a related party, an expired identity document, a registry filing that contradicts what you hold, or activity outside the declared profile. - Prepare the refreshed file: Findings, evidence and dates are assembled into a file your reviewer can approve, with any exception listed explicitly rather than left as a silent gap. **What this desk will not do** - Set your review cycles or trigger definitions - Decide the refreshed risk rating - Waive a missing document or an unmet standard - Offboard a customer - Mark a file complete when evidence is missing --- ## Industries ### KYC for Fintech **Summary**: Reusable identity for neobanks, BaaS providers, payment companies, and lenders. Stop re-verifying the same customer across products and partners. **URL**: https://www.zyphe.com/industry/kyc-for-fintech ### KYC for Casino **Summary**: Age verification, source of funds, GAMSTOP, and EDD across MGA, UKGC, AGCO, and ADM. Players bring a portable credential; operators stop losing the deposit at document upload. **URL**: https://www.zyphe.com/industry/kyc-for-casino ### KYC for iGaming **Summary**: KYC for iGaming across sportsbook, DFS, casino, and lottery on one player base. Multi-state US ready, GeoComply-compatible, perpetual monitoring built in. **URL**: https://www.zyphe.com/industry/kyc-for-igaming ### KYC for Crypto **Summary**: MiCA-aligned KYC for crypto exchanges, wallets, on-ramps, and DeFi platforms. Verify users from 190+ countries, reuse credentials across products, with no central store of customer PII. **URL**: https://www.zyphe.com/industry/kyc-for-crypto ### KYC for DAOs **Summary**: Credential-gated identity for token-voting governance, multisig signer screening, treasury KYB, and grant disbursement under FATF VASP and Ooki DAO precedent. **URL**: https://www.zyphe.com/industry/kyc-for-dao ### KYC for Government **Summary**: Citizen identity for benefits, permits, and voting under eIDAS 2.0 EU Digital Identity Wallet, Login.gov, FedRAMP/StateRAMP, with sovereign data residency. **URL**: https://www.zyphe.com/industry/kyc-for-government ### KYC for Healthcare **Summary**: Prescriber identity (NPI/DEA), EPCS two-factor, patient identity matching across HIE, age verification for restricted services, HIPAA-aligned audit, no PHI honeypot. **URL**: https://www.zyphe.com/industry/kyc-for-healthcare ### KYC for Neobanks **Summary**: Reusable identity for retail neobanks running multiple products on a single customer base. Multi-jurisdictional KYC, perpetual CDD, EMI/banking licence audit-ready. **URL**: https://www.zyphe.com/industry/kyc-for-neobanks ### KYC for Banking **Summary**: Retail and commercial banking onboarding, UBO verification, correspondent-banking due diligence, perpetual CDD under FFIEC, OCC, FCA SYSC, AMLD6. **URL**: https://www.zyphe.com/industry/kyc-for-banking ### KYC for Transport **Summary**: Driver onboarding (TLC, PHV, CDL, Driver CPC), continuous background-check monitoring, Platform Workers Directive disclosures, age verification for car-sharing. **URL**: https://www.zyphe.com/industry/kyc-for-transport ### KYC for Ecommerce **Summary**: Age-gated SKUs, high-value purchase fraud, returning-customer one-tap reuse. UK Online Safety Act, US INFORM Consumers Act, GDPR Article 6 lawful basis. **URL**: https://www.zyphe.com/industry/kyc-for-ecommerce ### KYC for Marketplaces **Summary**: Two-sided platform identity under DSA Article 30 and INFORM Consumers Act, payments-aggregator KYB pass-through, P2P fraud controls without bank-grade PII retention. **URL**: https://www.zyphe.com/industry/kyc-for-marketplace ### KYC for Adult Platforms **Summary**: Age-assurance under UK Online Safety Act, Texas HB 1181, EU DSA, France ARCOM. 2257 record-keeping for performers via threshold-encrypted vaults, no PII honeypot. **URL**: https://www.zyphe.com/industry/kyc-for-adult ### KYC for Enterprise **Summary**: Unified identity across employee, customer, and supplier with SSO/IdP federation, B2B counterparty KYB, supplier due diligence, SOC 2 / ISO 27001 audit alignment. **URL**: https://www.zyphe.com/industry/kyc-for-enterprise --- ## Security and assurance - Decentralised PII storage (no central honeypot) - NFC chip read + two-step liveness - Designed around GDPR and Regulation (EU) 2024/1624, the EU AML Regulation that applies from 10 July 2027 - SOC 2 and ISO/IEC 27001 audits are in progress, with completion targeted Q4 2026. Neither is certified today. - Virtual private clouds - Independent model validation - Per-decision audit trail --- ## Frequently asked questions ### What is Zyphe? Zyphe is an AI agents platform for compliance. Its agents prepare KYC, KYB, AML, sanctions and transaction monitoring reviews inside the tools regulated companies already use, with the evidence and a written rationale attached, and the customer's team approves the decisions. Zyphe sells this two ways: operated review desks that work an agreed queue under a service level, and a verification platform and API priced per verification. Customer PII is encrypted and split across storage nodes rather than held in one Zyphe database, and every decision carries a per-decision audit trail. ### Do you replace our compliance team? No. Zyphe extends your team. Your MLRO, Head of Compliance, and internal analysts remain accountable. Agents handle the heavy data work; your team makes the final risk decisions. ### How do agents work inside our existing tools? Agents log into internal and external sources, analyse data, and take action within your existing case management, KYC/KYB, AML, CRM, and ticketing tools. ### What does "privacy-first substrate" mean? Zyphe verifies customer identity using NFC chip reads, two-step liveness, and decentralised PII storage. Personal data is encrypted and split across storage nodes, unlockable only with a key the end user holds, so it never sits whole in one Zyphe-owned database. ### Is the platform audit-ready? Yes. Every action carries a documented rationale and audit trail. Decisions are auditable per-customer, per-case, per-regulator. ### How do you ensure model and decision quality? Independent model validation, layered QA, documented review playbooks, escalation rules, and full audit trails on every case. ### Is our data secure? Decentralised PII storage, virtual private cloud deployment, designed around GDPR and Regulation (EU) 2024/1624, the EU AML Regulation that applies from 10 July 2027. SOC 2 and ISO/IEC 27001 audits are in progress, with completion targeted Q4 2026. Neither is certified today. ### Do you support multilingual review? Yes. Agents cover English, Spanish, Portuguese, French, German, Italian, Dutch, Polish, and additional languages on request. ### How fast can we start? Most teams can begin scoping immediately, with deployment depending on tools, access, training, and risk requirements. ### Do you provide legal advice? No. Zyphe provides compliance operations automation, not legal advice. --- ## Recent blog posts - [Money20/20 Las Vegas 2026: Side Events, Parties and the Compliance Track](https://www.zyphe.com/resources/blog/money2020-las-vegas-guide): Money20/20 Las Vegas 2026 runs 18 to 21 October at The Venetian. Day-by-day schedule, official parties, verified side events and the sessions for compliance. - [Biometric Data in Passports: NFC Chips Explained (2026)](https://www.zyphe.com/resources/blog/biometric-nfc-passport): What biometric data does your passport chip store? Check if your passport is biometric, see how NFC verification works, and keep your data private. - [Monzo AML Fine: What the FCA Found and the Lessons for Fintechs](https://www.zyphe.com/resources/blog/monzo-aml-fine-lessons): The Monzo AML fine was £21.1m. What the FCA Final Notice found, how 26,325 high-risk accounts broke a restriction, and the lessons every fintech should apply. - [AML Enforcement by the Numbers: 2026 Year to Date (September 2026 Edition)](https://www.zyphe.com/resources/blog/aml-enforcement-by-the-numbers-september-2026): AML enforcement in 2026 so far, from Zyphe's open dataset: 23 actions, about $324 million in penalties, three fines carrying 79 percent, and what repeats. - [AML/CTF for Digital Currency Exchanges in Australia: AUSTRAC Obligations After the Virtual Asset Reforms](https://www.zyphe.com/resources/blog/aml-ctf-digital-currency-exchanges-australia): What an Australian crypto exchange must do under the AML/CTF Act after the virtual asset reforms: registration, designated services, CDD and the travel rule. - [KYB for Property Developers Selling Through SPVs and Staged Releases: Australia's AML/CTF Rules Applied](https://www.zyphe.com/resources/blog/kyb-property-developers-spv-staged-releases-australia): How Australia's AML/CTF Act applies to a developer selling through an SPV in staged releases: the reporting entity, the SPV's owners, bulk purchaser CDD. - [AML/CTF for Trust and Company Service Providers in Australia: Tranche 2 Obligations Explained](https://www.zyphe.com/resources/blog/aml-ctf-trust-company-service-providers-australia): What a trust and company service provider must do under Australia's AML/CTF Act from 1 July 2026: designated services, enrolment, CDD, ECDD and reporting. - [AUSTRAC Tranche 2: Enrolment, Obligations and Deadlines (2026)](https://www.zyphe.com/resources/blog/austrac-tranche-2-enrolment-guide): AUSTRAC tranche 2 explained: who is caught, the enrolment deadline, the AML/CTF programme and CDD duties, and what the Act changed from 31 March 2026. - [Beneficial Ownership Verification for Multi-Layer Trusts With Offshore Owners: An Australian Guide](https://www.zyphe.com/resources/blog/beneficial-ownership-multi-layer-trusts-offshore-owners-australia): How to verify every beneficial owner behind a layered trust with offshore owners under Australia's AML/CTF Act: who counts, evidence, ECDD triggers, example. - [Document Fraud Detection: How It Works](https://www.zyphe.com/resources/blog/document-fraud-detection): Document detection is the automated analysis of an identity document to confirm it is genuine and unaltered. It checks the document against known templates, validates security features such as holograms and microprint, reads and cross-checks the machine-readable zone, detects digital tampering in the image, and confirms the data matches the customer’s other records. - [Is Cryptoasset Trading Regulated in the UK? (2026 Guide)](https://www.zyphe.com/resources/blog/uk-crypto-regulation): Is cryptoasset trading regulated in the UK? Yes, and full FCA authorization lands in 2027. Get the timeline, rules, and KYC/AML duties for crypto firms. - [Identity Verification Statistics 2026: KYC & Fraud Data](https://www.zyphe.com/resources/blog/identity-verification-statistics): 30+ sourced identity verification statistics for 2026: identity fraud losses, deepfake attacks, KYC costs, onboarding drop-off, and AML fines. - [How to Check If a Business Is a Registered MSB (FinCEN Lookup)](https://www.zyphe.com/resources/blog/how-to-check-msb-registration): Search FinCEN's MSB Registrant Search to confirm a business registered as an MSB, read the result correctly, and learn what registration does not prove. - [Best Age Verification Services & Software 2026 Compared](https://www.zyphe.com/resources/blog/best-age-verification-software): Compare 11 age verification services for 2026, listed alphabetically: methods, certifications, UK OSA and US state-law coverage, and shortlists by use case. - [ECCTA: Companies House ID Verification Rules 2026](https://www.zyphe.com/resources/blog/eccta-companies-house-verification): ECCTA makes Companies House identity verification mandatory for UK directors and PSCs by 18 November 2026. See deadlines, penalties, and how ACSPs work. - [Best KYB Software in 2026: 13 KYB Providers Compared, Not Ranked](https://www.zyphe.com/resources/blog/kyb-providers): 13 KYB software providers compared alphabetically, not ranked: registry coverage, UBO discovery, screening and public pricing, from each vendor's own pages. - [How to Reduce KYC Drop-off: A Conversion Playbook](https://www.zyphe.com/resources/blog/how-to-reduce-kyc-drop-off-conversion-playbook): KYC drop-off quietly kills onboarding conversion. Here's a practical, step-by-step playbook to reduce KYC drop-off without ever weakening your compliance. - [KYC for Neobanks: Perpetual Customer Due Diligence on a Single Customer Base](https://www.zyphe.com/resources/blog/kyc-for-neobanks-perpetual-cdd): One customer, several products, one audit trail. See how neobanks run perpetual CDD under FFIEC and EU AML rules, and who owns liability in a BaaS stack. - [KYC for Healthcare: NPI, DEA, EPCS Two-Factor and HIPAA-Aligned Identity in 2026](https://www.zyphe.com/resources/blog/kyc-for-healthcare-2026): Healthcare identity spans prescriber, patient and age-gated users. See how NPI/DEA checks, EPCS two-factor, and HIPAA-aligned handling fit a 2026 playbook. - [Decentralized PII Storage: How Sharded Identity Architecture Removes the Honeypot](https://www.zyphe.com/resources/blog/decentralized-pii-storage): Centralized identity databases are breach honeypots. See how decentralized PII storage shards encrypted data so no single node ever holds a full record. - [KYC for DAOs After Ooki: Staying Compliant Under FATF VASP Rules in 2026](https://www.zyphe.com/resources/blog/kyc-for-daos-after-ooki): Ooki DAO set the precedent that token holders can be personally liable. Here's what FATF, the CFTC and MiCA require from DAO governance, treasury and grants. - [KYC for Online Casinos in 2026: MGA, UKGC, AGCO and ADM Requirements Compared](https://www.zyphe.com/resources/blog/kyc-for-online-casinos-2026): Online casino KYC across MGA, UKGC, AGCO and ADM sets four different bars. See what each regulator requires and where operators lose deposits at onboarding. - [KYC Without Storing Passports: Is It Possible?](https://www.zyphe.com/resources/blog/kyc-without-storing-passports): Can you run KYC without storing passports? Yes. Here's the difference between keeping a passport scan and keeping verification evidence, and how to do it. - [Sanctions Screening False Positives: The 60% Budget Drain You Can Actually Fix](https://www.zyphe.com/resources/blog/sanctions-screening-false-positives): Most of a sanctions screening budget clears noise. See where false positives originate, why name-match tuning is the wrong fix, and what OFAC expects. - [UBO Mapping With AI: Resolving Four-Tier Beneficial Ownership Chains in Under 60 Seconds](https://www.zyphe.com/resources/blog/ubo-mapping-with-ai): Beneficial ownership chains took days. See how AI UBO mapping resolves four-tier graphs across registries, scores confidence per edge, and meets FATF Rec 24. - [The TD Bank $3 Billion Lesson: What 92% Unmonitored Volume Actually Means](https://www.zyphe.com/resources/blog/td-bank-3-billion-aml-lesson): TD Bank paid about $3 billion in 2024 for AML failures, with most volume unmonitored. Here's the scope gap, and what every bank should audit this quarter. - [Building an Audit-Ready Compliance Stack: From Onboarding to SAR Filing](https://www.zyphe.com/resources/blog/audit-ready-compliance-stack): Most compliance stacks are six vendors and a diagram. Here's how to build an audit-ready compliance stack from onboarding through to SAR filing, end to end. - [KYC for iGaming in 2026: Multi-State US Compliance from Day One](https://www.zyphe.com/resources/blog/kyc-for-igaming-multi-state-us-2026): Launching across US states? iGaming KYC diverges by regulator. Here's the playbook for one customer base, 21-plus age, geolocation and multi-state onboarding. - [The Binance $4.3B Settlement: Five Compliance Architecture Lessons for VASPs](https://www.zyphe.com/resources/blog/binance-4-3-billion-settlement-lessons): Binance paid over $4.3B in 2023 and its CEO pleaded guilty. Here are five compliance architecture lessons every crypto exchange and VASP should act on now. - [AMLD6 and the AMLA Regulation: What Actually Changed for Your Compliance](https://www.zyphe.com/resources/blog/amld6-amla-2026): The EU's 2024 AML package reshapes compliance with a single rulebook and a new authority. Here's what AMLD6, the AML Regulation and AMLA require, and when. ## News - [The Florida DMV data breach: one police login put driver license document images at risk](https://www.zyphe.com/resources/news/florida-dmv-data-breach-document-images-october-2026): Florida's DMV says driver license data and document images may have been accessed through one police user's login. What it means for CIP and Red Flags plans. - [FinCEN charity alert: four red flags for Iranian abuse of khums networks](https://www.zyphe.com/resources/news/fincen-iran-charity-alert-khums-october-2026): FinCEN's 15 October 2026 charity alert asks banks to report Iranian abuse of religious charity and khums networks. What changes for CDD, SARs and sanctions. - [The SEB AML penalty: NYDFS takes $33 million over Baltic KYC and monitoring gaps](https://www.zyphe.com/resources/news/seb-aml-penalty-nydfs-baltic-october-2026): New York's DFS fined SEB $33 million on 15 October 2026 over Baltic due diligence, correspondent banking and transaction monitoring failures. What it means. - [The Korea financial data breach: 16 firms, 100,000 records and a security overhaul](https://www.zyphe.com/resources/news/korea-financial-data-breach-16-firms-october-2026): Korea's financial data breach hit 16 firms, from Shinhan Bank to two crypto firms, leaking resident registration numbers. What changes for KYC teams now. - [The Bank of America AML penalty: $1.2 billion for a monitoring system that waited for subpoenas](https://www.zyphe.com/resources/news/bank-of-america-aml-penalty-fincen-october-2026): FinCEN fined Bank of America $1.2 billion on 13 October 2026 after its monitoring missed over $5 billion of suspicious activity. What the orders now require. - [The Grosvenor Casinos settlement: £5 million for source of funds, cash and EDD failures](https://www.zyphe.com/resources/news/grosvenor-casinos-settlement-aml-gambling-commission-october-2026): Rank's Grosvenor Casinos will pay £5,012,261 after the Gambling Commission found AML failures on crypto source of funds, cash play and EDD. What it changes. - [The Coinme settlement: 34 state regulators close a crypto kiosk business over KYC, SAR and EDD gaps](https://www.zyphe.com/resources/news/coinme-settlement-crypto-kiosk-state-regulators-october-2026): 34 state regulators fined Coinme 2.5 million dollars and ordered its crypto kiosks closed by January 2027. What the consent order found and what it changes. - [The Modulr fine: DNB penalises an e-money institution for leaving ongoing monitoring to its crypto platform partners](https://www.zyphe.com/resources/news/dnb-modulr-fine-ongoing-monitoring-crypto-partners-october-2026): DNB fined Modulr Finance B.V. 722,160 euros for ongoing monitoring it had left to crypto platform partners. What the decision says and what it changes for EMIs. - [Japan's FSA wants IC chip verification now, not in April 2027](https://www.zyphe.com/resources/news/japan-fsa-ic-chip-verification-october-2026): On 9 October 2026 Japan's FSA asked firms to stop image-based ID checks before the April 2027 deadline and move to IC chip verification. What changes for KYC. - [The American Express AML penalty: $350 million for a card bank that assessed its deposits](https://www.zyphe.com/resources/news/american-express-aml-penalty-occ-october-2026): The OCC fined American Express National Bank $350 million on 8 October 2026 over $13 billion of suspected trade-based laundering. What the orders now require. - [AMLA's final CDD RTS: remote ID checks become a fallback you must justify](https://www.zyphe.com/resources/news/amla-cdd-rts-remote-onboarding-october-2026): AMLA sent its final draft CDD RTS to the Commission on 1 October 2026. ID documents and eID stay the default; remote tools need a reason, and PEP rules tighten. - [FinCEN withdraws the unhosted wallet rule and its crypto mixing proposal](https://www.zyphe.com/resources/news/fincen-unhosted-wallet-rule-withdrawn-october-2026): FinCEN is withdrawing its 2020 unhosted wallet rule and 2023 mixing proposal, effective 6 October 2026. What still applies to MSBs and banks, and the EU view. - [The CPR data breach: 8.8 million Danish records taken through one company's lawful access](https://www.zyphe.com/resources/news/denmark-cpr-data-breach-8-8-million-october-2026): Denmark's CPR data breach exposed names, addresses and CPR numbers of 8.8 million people through a company's lawful lookup access. What it means for KYC teams. - [The Times Car data breach: 1.6 million ID document images and the case for chip reads](https://www.zyphe.com/resources/news/times-car-data-breach-id-document-images-october-2026): The Times Car data breach exposed about 6.6 million accounts and ID document images for 1.6 million. What it means for KYC teams that still store ID photos. - [A7 Network sanctions: FinCEN proposes a ban on payments to its Sub-Agents](https://www.zyphe.com/resources/news/a7-network-sanctions-fincen-sub-agents-october-2026): On 1 October 2026 OFAC designated the A7 Network and FinCEN proposed a ban on transfers involving its Sub-Agents. What it means for screening, KYB and SARs. ## Guides - [The Payment Scam Liability: The $8 Million Cost Hidden In Your Onboarding Process](https://www.zyphe.com/guide/the-payment-scam-liability): UK PSR's 50/50 liability split makes mule accounts a direct P&L cost. What the $8M onboarding risk means for your compliance strategy in 2025 ## Glossary - [AML vs CFT](https://www.zyphe.com/resources/glossary/aml-vs-cft): CFT stands for Combating the Financing of Terrorism. What it means, how it differs from AML, why the two are regulated as one AML/CFT program, and what that changes operationally. - [AMLID](https://www.zyphe.com/resources/glossary/amlid): AMLID stands for the Anti-Money Laundering International Database, a secure information platform developed by the United Nations. - [Account Takeover (ATO) fraud](https://www.zyphe.com/resources/glossary/account-takeover-ato): Account Takeover (ATO) is fraud where attackers gain unauthorized access to legitimate users' online accounts, compromising personal data. - [Agentic compliance](https://www.zyphe.com/resources/glossary/agentic-compliance): Agentic compliance is the use of AI agents that work a compliance case end to end, gathering evidence, resolving entities, drafting the rationale and proposing or executing a decision, inside limits a human sets and the law reserves. It differs from rules-based automation, which flags activity and leaves the whole investigation to an analyst. - [Anti-Money Laundering (AML)](https://www.zyphe.com/resources/glossary/what-is-anti-money-laundering): Anti-money laundering is the framework of laws and controls that stops criminals disguising illicit funds. See what AML covers, the key rules, and how it works. - [Bank Account Verification & Validation Service](https://www.zyphe.com/resources/glossary/bank-account-validation-service): A bank account verification and validation service confirms an account exists, is open, and belongs to the claimed owner before money moves, cutting failed payments and fraud. - [Bank Secrecy Act (BSA)](https://www.zyphe.com/resources/glossary/bank-secrecy-act-bsa): The Bank Secrecy Act (BSA) requires financial institutions to report and track transactions to detect and prevent money laundering and terrorist financing. - [Bot protection](https://www.zyphe.com/resources/glossary/bot-protection): Understand Bot Protection, its meaning, benefits, and how it helps safeguard your website and apps from harmful automated bot traffic and attacks. - [Business lien](https://www.zyphe.com/resources/glossary/business-lien): Understand what a business lien is—a legal claim by creditors on company assets like property, receivables, or equipment used to secure debts owed. - [CIP (Customer Identification Program)](https://www.zyphe.com/resources/glossary/customer-identification-program-cip): A Customer Identification Program (CIP) is a US anti-money-laundering rule requiring financial institutions to verify the identity of every customer who opens an account. Mandated by Section 326 of the USA PATRIOT Act, a CIP must collect four data points, name, date of birth, address and an identification number, and verify them within a reasonable time after the account is opened. - [CLARITY Act](https://www.zyphe.com/resources/glossary/clarity-act): The CLARITY Act (Digital Asset Market Clarity Act, H.R. 3633) is the US bill that would split crypto oversight between the CFTC and the SEC and give registered exchanges explicit KYC and AML duties. It passed the House in July 2025 and failed a Senate cloture vote 49-50 on 15 September 2026. - [California Consumer Privacy Act (CCPA)](https://www.zyphe.com/resources/glossary/california-consumer-privacy-act-ccpa): Explore the California Consumer Privacy Act (CCPA), a law granting California residents enhanced rights over personal data collection, privacy, and use. - [Children’s Online Privacy Protection Act (COPPA)](https://www.zyphe.com/resources/glossary/childrens-online-privacy-protection-act-coppa): Understand the Children's Online Privacy Protection Act (COPPA), a U.S. law protecting data privacy for children under 13 on websites, apps, and services. - [Compliance as a Service (CaaS)](https://www.zyphe.com/resources/glossary/compliance-as-a-service-caas): Compliance as a Service (CaaS), a cloud-based solution helping businesses meet regulatory requirements efficiently, reduce costs, and manage risks. - [Customer Due Diligence (CDD)](https://www.zyphe.com/resources/glossary/customer-due-diligence-cdd): Customer due diligence (CDD) is the set of checks a regulated firm runs to identify and verify a customer, identify the beneficial owners behind a legal entity, understand the purpose of the relationship and monitor it on a risk basis. In the United States it is the fifth pillar of a Bank Secrecy Act compliance programme. - [Data Subject Access Request (DSAR)](https://www.zyphe.com/resources/glossary/dsar-subject-access-request): A subject access request (DSAR) lets a person obtain the personal data an organisation holds on them. Here's what it covers, the timeline, and how to respond. - [Data breach](https://www.zyphe.com/resources/glossary/data-breach): Discover what a data breach is, how unauthorized access to sensitive data occurs, its potential impact, and best practices for prevention and response. - [Deepfake](https://www.zyphe.com/resources/glossary/deepfake): Learn about deepfakes: AI-generated synthetic media that convincingly mimics real people, explores risks, ethics & detection methods. - [Dirty money](https://www.zyphe.com/resources/glossary/dirty-money): Dirty money is money obtained through crime, such as fraud, drug trafficking, corruption, tax evasion or theft, that cannot be spent or invested openly without revealing its origin. Money laundering is the process of turning dirty money into clean money: funds that appear to come from a legitimate source and can be used without attracting attention. - [Document check](https://www.zyphe.com/resources/glossary/document-check): Explore Document Check in KYC: verifying customer identity documents for authenticity and compliance to prevent fraud and financial crime. - [Domestic PEPs](https://www.zyphe.com/resources/glossary/domestic-peps): Domestic PEPs hold prominent public roles in their own country. See how domestic PEPs differ from foreign PEPs, their risk, and the due diligence that applies. - [Enhanced due diligence (EDD)](https://www.zyphe.com/resources/glossary/enhanced-due-diligence-edd): Enhanced due diligence (EDD) is the higher tier of customer due diligence applied when a customer, product or jurisdiction presents elevated money-laundering risk. It adds source of funds and source of wealth evidence, adverse media screening, senior management approval and closer ongoing monitoring on top of standard CDD. - [False negative](https://www.zyphe.com/resources/glossary/false-negative): Learn what a false negative is: when a detection system fails to flag real threats, risks in compliance, and strategies to reduce missed cases. - [False positive](https://www.zyphe.com/resources/glossary/false-positive): Learn what a false positive is: when a detection system wrongly flags legitimate activity as a threat, its impacts, and methods to reduce such errors. - [FedNow Service](https://www.zyphe.com/resources/glossary/fednow-service): FedNow Service: Real-time payment platform for U.S. banks. Glossary definition for instant payments and financial infrastructure. - [Federal Trade Commission (FTC)](https://www.zyphe.com/resources/glossary/federal-trade-commission-ftc): The Federal Trade Commission (FTC) protects consumers and promotes competition by enforcing antitrust, privacy, and consumer protection laws. - [Federated identity management (FIM)](https://www.zyphe.com/resources/glossary/federated-identity-management-fim): Federated identity management (FIM): Secure, unified access across organizations. Key term for enterprise security and compliance glossary pages. - [Financial Crimes Enforcement Network (FinCEN)](https://www.zyphe.com/resources/glossary/financial-crimes-enforcement-network-fincen): Financial Crimes Enforcement Network (FinCEN): U.S. bureau for AML and financial crime prevention. Glossary entry for compliance terms. - [Financial Industry Regulatory Authority (FINRA)](https://www.zyphe.com/resources/glossary/financial-industry-regulatory-authority-finra): Financial Industry Regulatory Authority (FINRA): U.S. self-regulatory body for broker-dealers. Glossary term for financial compliance. - [First-party fraud](https://www.zyphe.com/resources/glossary/first-party-fraud): First-party fraud is fraud committed by a customer in their own name: applying for credit or an account with no intention of paying, misrepresenting income or circumstances, disputing legitimate charges, or abusing refunds and promotions. Unlike third-party fraud, no identity is stolen, so identity verification alone does not catch it. - [Form W-9](https://www.zyphe.com/resources/glossary/form-w-9): Form W-9: IRS form for collecting taxpayer identification. Glossary entry for U.S. business tax and compliance terms. - [Fraud investigations](https://www.zyphe.com/resources/glossary/fraud-investigations): Fraud investigations: Process of uncovering and analyzing fraud. Essential glossary term for enterprise risk management. - [Fullz](https://www.zyphe.com/resources/glossary/fullz): Fullz: Complete stolen personal data set for ID fraud. Glossary entry for cybersecurity and financial risk terms. - [General Data Protection Regulation (GDPR)](https://www.zyphe.com/resources/glossary/general-data-protection-regulation-gdpr): General Data Protection Regulation (GDPR): EU law on personal data protection. Key glossary entry for privacy and compliance. - [Generative AI fraud](https://www.zyphe.com/resources/glossary/generative-ai-fraud): Generative AI fraud: Use of AI to create deceptive content for fraud. Glossary entry for cybersecurity and risk management terms. - [Genius Act](https://www.zyphe.com/resources/glossary/genius-act): The Genius Act (2025) sets federal rules for stablecoins: full reserves, public audits, and legal protection for users if issuers fail. - [Governance, risk, and compliance (GRC)](https://www.zyphe.com/resources/glossary/governance-risk-and-compliance-grc): Governance, risk, and compliance (GRC): Framework aligning business goals with regulations. Key glossary term for enterprise compliance. - [Gramm-Leach-Bliley Act (GLBA)](https://www.zyphe.com/resources/glossary/gramm-leach-bliley-act-glba): Gramm-Leach-Bliley Act (GLBA): U.S. law for financial data privacy and security. Glossary entry for banking and compliance. - [Graph database](https://www.zyphe.com/resources/glossary/graph-database): Graph database: Database optimized for managing relationships. Glossary term for data analysis and fraud detection. - [Health Insurance Portability & Accountability Act (HIPAA)](https://www.zyphe.com/resources/glossary/health-insurance-portability-accountability-act-hipaa): Health Insurance Portability & Accountability Act (HIPAA): U.S. law for health data privacy. Glossary entry for compliance and healthcare. - [INFORM Consumers Act](https://www.zyphe.com/resources/glossary/inform-consumers-act): INFORM Consumers Act: U.S. law increasing transparency for online sellers. Glossary entry for marketplace compliance and risk. - [Identity Assurance Levels (IAL)](https://www.zyphe.com/resources/glossary/identity-assurance-levels-ial): Identity Assurance Levels (IAL): NIST-defined levels of identity proofing rigor. Glossary entry for digital identity and compliance. - [Identity and access management (IAM)](https://www.zyphe.com/resources/glossary/identity-and-access-management-iam): Identity and access management (IAM): Controls user access to systems and data. Key glossary term for enterprise security. - [Identity authentication](https://www.zyphe.com/resources/glossary/identity-authentication): Identity authentication: Verifying a user’s claimed identity. Glossary term for cybersecurity and access control. - [Identity graph](https://www.zyphe.com/resources/glossary/identity-graph): Identity graph: Database linking identifiers to a single user. Glossary entry for digital identity and fraud prevention. - [Identity proofing](https://www.zyphe.com/resources/glossary/identity-proofing): Identity proofing: Verifying a person’s real-world identity. Key glossary term for onboarding and compliance checks. - [Identity verification (IDV)](https://www.zyphe.com/resources/glossary/identity-verification-idv): Identity verification (IDV): Confirms a user’s identity at onboarding or transaction. Glossary term for fraud prevention and compliance. - [Inherent risk](https://www.zyphe.com/resources/glossary/inherent-risk): Inherent risk: Risk level before controls are applied. Glossary term for enterprise risk management and assessment. - [KBA (knowledge-based authentication)](https://www.zyphe.com/resources/glossary/knowledge-based-authentication-kba): KBA stands for knowledge-based authentication: verifying identity with questions only the genuine person should be able to answer. Once standard in US banking, it is now considered weak because breached data makes the answers easy to buy. - [KYB (Know Your Business)](https://www.zyphe.com/resources/glossary/what-is-kyb): Know Your Business (KYB) is the process of verifying that a business customer is legitimate: confirming its legal registration and status, mapping its ownership structure, and identifying and screening its ultimate beneficial owners. KYB is the corporate equivalent of KYC and is required of regulated firms that onboard company customers. ## Webinars - [Your ID Documents Are About to Be Everywhere. That Should Terrify You.](https://www.zyphe.com/resources/webinar/why-decentralized-kyc-is-important-interview): ID laws mean your personal documents may be at risk. See how Zyphe lets you control your data and protect your identity online. - [Turning Compliance Into User Empowerment: Charlene Wang on The Crypto Megan Podcast](https://www.zyphe.com/resources/webinar/turning-compliance-into-user-empowerment-crypto-megan-podcast): Decentralized KYC and KYB that boost compliance and user trust — Charlene Wang on the Crypto Megan podcast. Listen now. - [Deepfakes, AI, & Data Breaches - The Latest Onboarding Trends](https://www.zyphe.com/resources/webinar/deepfakes-ai-data-breaches): Stop deepfake and AI-driven KYC fraud. Privacy-first identity verification with NachoNacho × Zyphe — free webinar, watch now. --- ## Contact - **Book a demo**: https://www.zyphe.com/contact - **Email**: hello@zyphe.com - **Coverage**: United States, United Kingdom, European Union - **Locations**: New York, London, Milan --- ## Legal scope Zyphe provides compliance operations automation, not legal advice. We do not replace your regulated compliance obligations, your MLRO, or your legal counsel. --- This file follows the llms-full.txt convention. For a condensed index see https://www.zyphe.com/llms.txt.