Blockchain-based KYC/AML Compliance for Retail Banks: A Scalable ICT Solution

Thesis Abstract

Blockchain-enabled KYC/AML processes offer a transformative approach to enhancing regulatory compliance, client onboarding efficiency, and risk management in retail banking amid rising operational costs and evolving supervisory expectations. The study addresses the persistent gaps between traditional KYC/AML workflows and the need for scalable, tamper-evident, and privacy-preserving mechanisms that support real-time risk assessment while ensuring data sovereignty. The aim is to evaluate the feasibility, performance, and governance implications of a blockchain-based KYC/AML solution deployed across multiple retail banking subsidiaries, with a focus on scalability, interoperability, and regulatory alignment. Specific objectives include (1) designing a pragmatic architecture that integrates customer data tokenization, permissioned blockchain networks, and standardized data exchange protocols; (2) assessing operational efficiency gains in onboarding time, due diligence turnaround, and ongoing screening against sanctions and PEP lists; (3) examining risk management outcomes, including data integrity, auditability, and resilience against cyber threats; (4) evaluating regulatory compliance, data privacy, and consent management under applicable frameworks (e.g., GDPR, FATF recommendations); and (5) identifying governance, cost, and change-management requirements for broad-based adoption. A mixed-methods research design combines quantitative and qualitative strands. The population comprises five mid-to-large retail banks operating in a mature regulatory environment, with a purposive sample of 12 business units actively involved in KYC/AML processes and 60 frontline staff for workflow data. Data collection instruments include (i) system trace logs and operational dashboards from a pilot blockchain KYC/AML module (n=1,200 onboarding cases, 6 months of activity); (ii) structured surveys measuring onboarding time, rework rates, false positives in alerts, and user satisfaction (response rate ? 68%, N ? 240); (iii) semi-structured interviews with compliance officers, IT architects, and regulatory liaison staff (n ? 18); and (iv) documentary evidence such as policy documents, audit reports, and incident logs. Analytical methods encompass regression analysis to quantify time-to-onboard improvements and cost savings, survival analysis for onboarding cycle duration, and ANOVA to compare performance across units and banks. On the qualitative side, thematic analysis of interview transcripts will identify enablers and barriers to implementation, governance challenges, and perceived regulatory risk. Theoretical grounding draws on the Technology-Organization-Environment (TOE) framework to explain adoption determinants and the Institutional Theory to interpret regulatory alignment and legitimacy. A conceptual model will map blockchain characteristics (immutability, decentralization, permissioning) to KYC/AML outcomes (data integrity, traceability, privacy). Expected findings include statistically significant reductions in average onboarding time (target reduction 25–40%), lower due diligence rework rates (20–35%), and improved accuracy of sanction/PEP screening due to automated, auditable provenance of data. The study anticipates enhanced data integrity and non-repudiation benefits from immutable ledgers, alongside robust access controls and consent management that satisfy privacy requirements. Potential trade-offs involve data availability versus privacy by design and the need for interoperable standards to facilitate cross-institution data sharing while preserving competitive and regulatory obligations. The contribution to knowledge lies in providing empirical evidence on the operational viability, risk governance, and regulatory compatibility of scalable ICT-driven KYC/AML processes in retail banking, including a reference architecture, implementation guidelines, and a governance framework adaptable to diverse regulatory regimes. The conclusion is that a well-governed, permissioned blockchain KYC/AML solution can deliver meaningful efficiency gains and strengthened compliance without compromising customer privacy or data security, given careful alignment with regulatory expectations, robust identity verification processes, and clear data-sharing protocols. Recommendations include (i) adopting a modular, standards-based architecture to enable incremental rollout across regions; (ii) establishing a central governance body with clear data ownership, access rights, and audit procedures; (iii) implementing privacy-preserving techniques such as zero-knowledge proofs and selective disclosure where appropriate; and (iv) developing a continuous monitoring program to assess performance, security incidents, and regulatory changes, ensuring sustained alignment with evolving FATF guidelines and GDPR mandates.