Onboarding Risk Signals
Two kinds of identity evidence move a KYC applicant's risk band: how the session connected (network posture) and how the session relates to others (the related-session graph). KYC's network evaluator reads these from the identity riskSummary and nudges the applicant up or down the band — LOW, MEDIUM, HIGH or VERY_HIGH — and can raise an enhanced-due-diligence requirement. The effect is qualitative: the signals set direction, KYC sets the outcome.
These signals are corroborating, not decisive. They shift where an applicant lands in the band and can flag EDD — they never approve or reject on their own. Documents, biometrics and sanctions remain KYC's primary evidence.
Anonymising networks → ANONYMISING_NETWORK
When the snapshot reports the session arrived over a VPN, proxy or Tor exit (vpnDetected, proxyDetected or torDetected), the evaluator raises an ANONYMISING_NETWORK signal. An applicant deliberately hiding where they connect from during identity onboarding is a classic enhanced-scrutiny cue, so this pushes the risk band upward and can trigger enhanced due diligence (eddRequired).
Anonymising-network detection is corroborating context, not proof of fraud — plenty of legitimate applicants use a VPN. It raises the band and can require EDD; it does not by itself reject the applicant. KYC weighs it against the rest of the evidence.
Device familiarity
The snapshot's knownDevice and stableDevice fields describe whether Identity has seen this device before for the merchant and whether its fingerprint is steady across recent sessions:
- A known, stable device is a calming signal — it lowers, or fails to raise, the band.
- An unknown or unstable device contributes upward pressure, because a first-seen device carries less continuity evidence.
An unknown device on a first onboarding is unknown, not bad. Most genuine applicants onboard from a device Identity has never seen. Continuity confidence grows as the device is seen again — see Device & Continuity.
Related-session and trial-actor velocity
Identity links sessions that appear to share an account or an actor into a related-session graph, exposed to KYC as relatedSessionCount. When the number of linked sessions crosses a threshold, the evaluator raises HIGH_RELATED_SESSION_VELOCITY — the fingerprint of one actor spinning up many onboarding attempts (trial-actor / multi-account behaviour). This adds upward pressure on the band and is a strong EDD cue.
Sessions are linked
Identity's continuity engine links sessions that share device, account or actor evidence.
The count surfaces to KYC
The linked-session count arrives in the riskSummary as relatedSessionCount.
Velocity crosses a threshold
Above a configured threshold, the evaluator raises HIGH_RELATED_SESSION_VELOCITY.
The band and EDD adjust
KYC lifts the risk band and may set eddRequired — then applies its own policy to accept, review or reject.
How the band is set
The network evaluator combines these signals into a risk level and an EDD flag:
{
"riskLevel": "HIGH",
"eddRequired": true,
"signals": ["ANONYMISING_NETWORK", "HIGH_RELATED_SESSION_VELOCITY"]
}The riskLevel is one of LOW, MEDIUM, HIGH, VERY_HIGH. Anonymising networks, an unknown/unstable device and high related-session velocity all push it upward; a known, stable device on a residential network holds it down. KYC then maps the band to its own onboarding policy.
This page describes which signals move the band and in which direction — not the weighting behind them. The exact contribution of each signal is an internal scoring detail and is deliberately not documented. Integrate against the direction and the resulting riskLevel / eddRequired, not against any assumed magnitude.
Privacy: hashed identifiers only
The related-session graph is built on keyed hashes, not raw personal data. Account and actor links are carried as accountKeyHash and trialActorKeyHash — one-way keyed digests — so KYC learns that a session is linked to others and how many, without ever receiving the raw PII behind those links. The velocity signal is fully usable while the underlying identifiers stay opaque to the KYC decision.
KYC sees relatedSessionCount and the keyed-hash links, never the email, account id or personal identifiers that produced them. The privacy boundary holds even as the risk signal flows through.
Next steps
- Identity in KYC Onboarding — the snapshot and the fail-open bridge
- Device Attestation Nodes — device-integrity gates in the flow
- Network Intelligence — how network posture is determined
- The Risk Snapshot — the full field reference