Customer Experience and the Right Level of Friction

Overview
This guide covers the CAMS topic Customer Experience and the Right Level of Friction, which sits within the broader area of Data Onboarding and Screening Technology. It explains why the topic matters, what the core concepts are, how friction is calibrated in practice, and how to approach exam questions on this subject.

Why This Topic Is Important
Anti-money laundering (AML) and know your customer (KYC) controls exist to protect the financial system, but they are experienced by customers as questions, document requests, delays, and occasional account holds. Every control introduces some degree of friction: effort, time, or inconvenience imposed on the customer. The CAMS syllabus emphasises this topic for several reasons:

1. Commercial reality. Excessive friction at onboarding leads to abandonment. Industry studies consistently show that a large share of applicants drop out of digital account opening when the process is slow or confusing. A compliance programme that drives away legitimate customers is not sustainable and will lose internal support.

2. Risk-based approach (RBA). The FATF Recommendations and virtually all national regimes require institutions to apply measures proportionate to risk. Applying maximum friction to every customer is not only commercially damaging; it is contrary to the RBA because it wastes resources on low-risk relationships and dilutes attention from high-risk ones.

3. Financial inclusion. Regulators, including FATF, have warned that overly conservative controls can exclude vulnerable or underserved populations (for example, those without standard identity documents). Exclusion pushes people into unregulated channels, which ultimately undermines AML objectives.

4. Effectiveness, not just compliance. Modern supervisory expectations focus on outcomes. Friction that generates poor-quality data (customers entering fake answers to get past a screen) or that causes staff to rush reviews produces worse risk outcomes than well-designed, targeted friction.

5. Technology enables better calibration. Digital identity verification, biometrics, data aggregation, and machine learning make it possible to shift friction away from the customer and onto back-end systems, meaning the compliance professional must understand how to use these tools responsibly.

What "Friction" Means in AML/KYC
Friction is any step that slows or complicates the customer's journey. Common sources include:
- Identity document capture and verification
- Proof of address requests
- Source of funds and source of wealth questionnaires
- Beneficial ownership declarations for legal entities
- Sanctions, PEP, and adverse media screening alerts that require resolution before account activation
- Enhanced due diligence (EDD) interviews
- Ongoing periodic reviews and refresh requests
- Transaction holds pending investigation

Friction is not inherently bad. Some friction is a feature: it deters bad actors, provides evidential records, and signals to customers that the institution takes integrity seriously. The goal is the right level of friction, meaning friction that is proportionate to risk, applied at the right point in the journey, and minimised where it adds no risk-mitigation value.

Key Concepts You Must Know

1. Proportionality and the risk-based approach. Low-risk customers (for example, a domestic salaried individual opening a basic account) should face streamlined simplified due diligence (SDD) where permitted. High-risk customers (PEPs, complex cross-border structures, high-risk jurisdictions, cash-intensive businesses) warrant EDD and therefore more friction. The level of friction should map to the customer risk rating.

**Note on terminology:** The exam expects you to connect friction decisions to customer risk assessment, CDD, SDD, and EDD.

2. Progressive or tiered onboarding. Also called staged or layered KYC. The customer is granted limited functionality (low limits, restricted products) after minimal verification, with additional verification required as they request higher limits or riskier products. This spreads friction over time and aligns it with risk exposure. Many regulators permit this within defined thresholds.

3. Front-loading versus back-loading friction. Some institutions collect everything upfront (front-loading), which increases abandonment but gives a complete risk picture from day one. Others collect the minimum upfront and request more as risk indicators emerge (back-loading). The exam may test your understanding that back-loading must still satisfy regulatory requirements to verify identity before or shortly after establishing the relationship, and that the institution must be able to restrict activity until verification is complete.

4. Invisible or passive controls. Technology allows many checks to run without customer involvement: device fingerprinting, geolocation, behavioural biometrics, data-source cross-referencing, and automated sanctions screening. These reduce visible friction while maintaining or improving control strength. The key limitation is data quality and the need to handle false positives.

5. False positives as a friction source. Screening systems that produce high false-positive rates delay onboarding while analysts clear alerts. Tuning match thresholds, using secondary identifiers (date of birth, nationality), and applying good data hygiene reduce unnecessary friction. However, tuning must be documented and tested so that true matches are not missed.

6. Explainability and customer communication. Friction is better tolerated when the customer understands why information is needed, how long the process will take, and what happens next. Clear communication, status updates, and the ability to save and resume an application all reduce perceived friction without reducing control.

7. Governance and documentation. Any decision to reduce friction (for example, raising a screening threshold or accepting a new digital ID method) must be risk-assessed, approved through governance, documented, and periodically reviewed. Regulators will ask for the rationale.

8. Tipping off and confidentiality. Reducing friction by explaining exactly why an account is held can constitute tipping off if the hold relates to a suspicious activity investigation. Customer-experience improvements must never compromise legal confidentiality obligations.

How It Works in Practice

Step 1: Define the risk appetite. Senior management sets the institution's tolerance for customer risk and, implicitly, for friction. This is documented in the AML policy and risk appetite statement.

Step 2: Segment customers. Using the customer risk assessment methodology, the institution identifies customer types, products, channels, and geographies, and assigns inherent risk levels.

Step 3: Design differentiated journeys. For each segment, the institution specifies the data to be collected, the verification methods (document-based, electronic, biometric), the screening scope, and any manual review triggers. Low-risk segments receive the lightest compliant journey; high-risk segments receive EDD.

Step 4: Deploy technology to absorb friction. Electronic identity verification (eIDV), optical character recognition (OCR) of documents, liveness detection, and automated data enrichment replace manual steps. Screening engines run in real time with tuned thresholds. Alerts are routed to analysts with contextual data to speed resolution.

Step 5: Monitor outcomes. Key metrics include onboarding completion rate, time to decision, abandonment points, false-positive rate, true-positive rate, manual review volumes, and downstream suspicious activity report (SAR/STR) rates by segment. If a low-friction segment later shows elevated suspicious activity, the friction calibration was wrong and must be revisited.

Step 6: Review and adjust. Periodic model validation, independent testing, and regulatory feedback inform adjustments. Changes are documented through change management.

Common Trade-offs and How to Resolve Them
- Speed versus completeness: Resolve through tiered onboarding and back-end data enrichment.
- Automation versus judgement: Automate routine, low-risk decisions; reserve human review for complex or high-risk cases.
- Lower thresholds versus analyst capacity: Tune screening with documented testing; do not simply raise thresholds to cut alert volume.
- Convenience versus confidentiality: Provide generic status communications; never disclose investigation details.
- Inclusion versus assurance: Accept alternative identity evidence where regulators permit, with compensating controls such as lower limits or closer monitoring.

Red Flags That Friction Is Miscalibrated
- Very high onboarding abandonment at a specific step
- Customers providing obviously placeholder answers to mandatory fields
- Screening alert backlogs delaying activation for days
- Identical light-touch treatment applied to high-risk and low-risk segments
- Front-line staff bypassing steps to meet sales targets
- No metrics linking friction decisions to risk outcomes

Exam Tips: Answering Questions on Customer Experience and the Right Level of Friction

Tip 1: Anchor every answer in the risk-based approach. The CAMS exam rewards answers that tie friction to customer risk rating. If an option says "apply the same enhanced checks to all customers" or "remove verification steps to improve conversion," it is almost always wrong. The correct answer will calibrate controls to risk.

Tip 2: Reject answers that sacrifice compliance for convenience. If an option reduces friction by skipping a legally required step (such as verifying identity before granting full account access, or screening against sanctions lists), eliminate it. Customer experience never overrides a mandatory control.

Tip 3: Favour technology that moves friction to the back end. Options describing electronic verification, automated screening with tuned thresholds, or data enrichment are typically correct when the question asks how to improve experience while maintaining controls. Be wary of options that describe technology replacing human judgement entirely for high-risk cases.

Tip 4: Look for tiered or progressive approaches. When a scenario involves a digital-only or fintech product, the best answer often involves limited initial functionality with step-up verification as risk or activity increases.

Tip 5: Remember governance and documentation. If a question asks what should accompany a decision to reduce controls or raise a screening threshold, the correct answer will include risk assessment, senior management or committee approval, documentation, and testing. An answer that describes a unilateral change by the business line is wrong.

Tip 6: Watch for tipping-off traps. A scenario where a frustrated customer demands to know why their account is frozen tests whether you will disclose that a SAR/STR has been filed. The correct response is to provide a neutral, non-specific explanation and escalate internally. Improving customer experience does not justify tipping off.

Tip 7: Consider financial inclusion. If a question involves customers lacking standard documentation, the best answer usually involves alternative, regulator-permitted verification methods with compensating controls, rather than outright refusal or waiving verification altogether.

Tip 8: Use metrics-based reasoning. Questions asking how to evaluate whether friction is appropriate expect you to cite measurable indicators such as abandonment rates, false-positive rates, time to onboard, and downstream suspicious activity by segment. Vague answers like "ask customers if they are happy" are weaker than answers combining customer metrics with risk outcome metrics.

Tip 9: Identify the stakeholder perspective in the question. Questions may be framed from the viewpoint of the compliance officer, the business, or the regulator. The compliance officer's role is to enable the business within the risk appetite, not to block it and not to rubber-stamp it. The best answer usually reflects a collaborative, risk-informed position.

Tip 10: Eliminate absolutes. Options containing words like "always," "never," "all customers," or "eliminate all friction" are rarely correct in a risk-based framework. Look for options using "proportionate," "risk-based," "documented," and "tested."

Sample Question Walkthrough
A bank launching a mobile account-opening product notices 60% of applicants abandon at the proof-of-address upload step. The head of digital proposes removing the step. What should the compliance officer recommend?

Analysis: Removing a required verification step is not acceptable. The best recommendation is to assess whether address can be verified through electronic data sources for low-risk applicants, apply tiered limits until full verification is complete, retain document upload where electronic verification fails or risk is elevated, and document the change through governance. This answer preserves the control objective, reduces friction for the majority, and aligns with the risk-based approach.

Summary
The right level of friction is not the minimum possible; it is the amount proportionate to risk, applied intelligently, supported by technology, communicated clearly, and governed rigorously. On the exam, choose answers that balance customer experience with regulatory obligations through risk-based calibration, never answers that trade compliance for convenience or impose uniform burdens regardless of risk.