Onboarding Intelligence
One API call. Every signal. One explainable decision.
The Clari5 Intelligence Onboarding Platform is a vendor-agnostic fraud decisioning layer that sits above your existing onboarding stack. One call fans out every configured signal, correlates it across seven categories, and returns a Composite Risk Score and decision inside the active onboarding session.
Surge in banking fraud value
H1 FY25 vs prior year — RBI
Digital account creations suspect
1 in 12 onboarding attempts
Rise in synthetic document fraud
Q1 2024 to Q1 2025 — Sumsub
Detect fraud after onboarding
not at the point of entry
The structural gap
Every mule account began with a successful onboarding.
Most banks already run KYC, liveness, bureau and document checks. The problem is that they run in silos and produce no unified verdict.
No signal correlation
A borderline national ID mismatch, a freshly activated SIM and a device farm signal each pass in isolation. Nothing connects them. Organised rings are structured to exploit exactly this.
Telco intelligence absent
Carriers see SIM age, device history, call forwarding and number recycling in real time. That layer is missing from almost every onboarding stack — yet it is the most reliable SIM-swap and mule signal.
No composite decisioning
Where checks exist, outputs land in manual review queues rather than a live risk engine. The fraudster is already onboarded before an analyst opens the case.
Fragmented vendor stack
IDV, bureau, liveness and document vendors return different schemas with no normalisation or unified score. Each checkpoint is passed independently.
Dominant typologies
Seven patterns. All start at onboarding.
- Synthetic identity fraud01
- SIM-swap account takeover02
- Deepfake video KYC03
- Document forgery04
- Mule account recruitment05
- Business identity fraud06
- BSA mule patterns07
How it works
One call in. One decision out.
Five stages between the application landing and the decision returning — all inside the active session.
-
01
Application submitted
The source system fires a single API call to the Intelligence Onboarding Platform gateway with applicant context and any existing vendor outputs.
Request received
-
02
Signal fan-out
Parallel orchestration across every active intelligence source, per the policy configured for that client and product.
Signal responses
-
03
Normalisation
Heterogeneous vendor outputs are mapped to a unified 0–100 Clari5 signal schema, tagged by type, category and reliability tier.
Standardised signals
-
04
Risk evaluation
Hard-stop rules fire first, then the weighted Composite Risk Score is calculated and combination rules label the fraud typology.
CRS 0–1000 + typology
-
05
Decision returned
A structured decision plus the full explainability packet — ranked signals, triggered rules, rationale — returns to the source system.
Approve · Monitor · Step-up · Review · Reject
If a source does not respond inside its timeout, the signal is marked unavailable and category weights rebalance across the remaining active categories. No single API outage fails a transaction.
Signal coverage
Seven signal categories. One normalised schema.
Every weight, sub-weight and threshold is configurable per client, product type and customer segment.
Telco network
Carrier-direct · 25% weight
Sourced directly from telecom operators over CAMARA-standard APIs. Network-layer intelligence that cannot be fabricated at the application layer — and cannot be replicated by aggregators.
Typologies detected
SIM-swap ATO · freshly activated SIM identities · mule recruitment · OTP diversion
Biometric / deepfake
20% weight
Deepfake and liveness analysis with face deduplication against prior enrollments and confirmed fraud records — a hard stop when a spoof is confirmed.
Typologies detected
Deepfake video KYC injection · duplicate identity enrollment · AI face bypass
Document forensics
20% weight
Every uploaded document is examined for tampering at the file level, not just read by OCR — font substitution, metadata edits and object structure anomalies.
Typologies detected
Document forgery · income fabrication · statement manipulation · organised doc fraud
Financial analytics
Incl. BSA mule · 15% weight
Mule behaviour is detected on bank statement data at application stage — before the account is inside the book, not months afterwards.
Typologies detected
Mule accounts · employment fabrication · income inflation · laundering at onboarding
Device / behavioural
10% weight
Device and session intelligence from Behavioural Analytics — device farms, scripted sessions and network anonymisation surfaced during the application itself.
Typologies detected
Mass device-farm applications · bot-assisted blitz · coached mule sessions · RAT
Identity / statutory
10% weight
Statutory and enrichment signals that establish whether the identity has any verifiable history at all.
Typologies detected
Synthetic identity · ghost employment · thin-file fraud · unlinked documents
Business & external intelligence
Kscan + external · 5% weight
Business due diligence for MSME onboarding plus national suspect repositories — the checks that expose ghost entities and repeat offenders.
Typologies detected
Ghost entities · director fraud · shell layering · known cybercrime suspects
The correlation advantage
Individually they pass. Together they are fraud.
Point solutions return a binary pass or fail per check. The Intelligence Onboarding Platform weights every signal by reliability and fires combination rules across categories.
Reliability-weighted
Carrier signals carry a 1.00 multiplier, statutory sources 0.90, behavioural 0.80 — weight follows verifiability.
Cross-category rules
Combination rules evaluate clusters across all active categories at once and label the typology with a confidence level.
Hard stops override
Confirmed deepfake, MNRL match, struck-off entity or a 24-hour SIM swap override the score outright.
Decision framework
A score band, a decision, and a downstream workflow.
The Composite Risk Score runs 0–1000. Every band maps to a defined action, so nothing waits on interpretation.
0 – 250
Approve
Low risk
Proceed to onboarding. Zero customer friction, no post-onboarding surveillance.
251 – 500
Approve + monitor
Medium-low
Activated with 90–180 days of behavioural surveillance and re-scoring at 30/60/90 days.
501 – 700
Step-up
Medium-high
Risk-based step-up: enhanced liveness, document re-collection, callback or OTP plus video.
701 – 850
Manual review
High risk
Routed to the analyst queue with CRS, ranked signals, triggered rules and explainability.
851 – 1000
Reject
Critical
Blocked with a generic decline. Fraud incident auto-generated for regulatory reporting.
Business impact
Fraud stopped at entry. Friction removed for everyone else.
Impact comes from correlated detection — catching the patterns point solutions miss — not simply faster processing.
Lower synthetic identity losses
correlated intelligence vs. point solutions
Less SIM-swap ATO at onboarding
carrier-direct hard stops before OTP
Fewer mules entering the book
telco + behavioural + external correlation
P95 decision time
70%+ clean applications auto-approved in session
40–60% smaller review queue
70%+ of clean applications auto-approve in session; step-up handles borderline cases without an analyst.
3× faster case resolution
Analysts receive ranked evidence packets instead of collating signals across vendor dashboards.
Zero procurement disruption
Vendor-agnostic orchestration wraps existing contracts — no re-procurement, no integration rework.
Why Intelligence Onboarding Platform
Six differences a point solution cannot close.
Powered natively by the Perfios Group data and AI ecosystem — Behavioural Analytics, Lead IQ, Nexus, Deepfake Detection, Face Dedup and Kscan.
Signal correlation engine
Combination rules fire on multi-signal patterns across telco, biometric, document, financial and device simultaneously.
Carrier-direct telco intelligence
SIM age, SIM swap and device history at the network layer — unavailable through application-layer checks.
Real-time composite scoring
CRS inside the active session, with hard-stop overrides above the score. No review queue in the critical path.
Vendor-agnostic orchestration
Wraps any IDV, bureau or document vendor. Existing contracts are preserved — the Intelligence Onboarding Platform sits above, not instead of.
Full explainability per decision
Ranked signals, triggered rules, natural-language rationale and an immutable audit trail — regulator-ready.
No-code rule configuration
Fraud teams build, dry-run and deploy rules themselves, version-controlled with rollback. No engineering cycle.
Regulatory alignment
Audit-ready by construction, not by report writing.
Every decision carries ranked signals, triggered rules, a natural-language rationale and an immutable audit trail — with signal-level consent logging and data minimisation through modular signal activation.
- RBI Master Direction — KYC 2016 (amended 2024)
- RBI Digital Lending Guidelines 2022
- PMLA 2002 / AML-CFT Master Direction
- DPDP Act 2023 (India)
- RBI Cyber Security Framework
- UAE CBUAE AML/CFT Framework 2023
- MAS Notice FSM-N06 (Singapore)
- OJK Digital Banking Regulation (Indonesia)
- BSP e-KYC Circular 2020 (Philippines)
Explore the Clari5 platform
The Intelligence Onboarding Platform stops fraud at the door. Pair it with the solutions that protect the customer for the rest of the relationship.
Enterprise Fraud Risk Management
Real-time, cross-channel fraud detection and in-flight decisioning across every customer touchpoint.
Learn MoreAnti-Money Laundering
Explainable AML monitoring, screening, case management and regulator-ready STR filing on one intelligence layer.
Learn MoreIntelligence Onboarding Platform in action