UW KYC Intelligent System Inspiration

Across many African institutions, organization verification is still handled through slow, fragmented, and mostly manual processes.

Reviewers must inspect registration certificates, tax documents, licenses, identity documents, proof of address, and other legal records one by one. This can delay onboarding, make inconsistencies harder to detect, and limit traceability when a decision must later be explained.

We created UW KYC Intelligent System to make organizational KYC faster, safer, more transparent, and easier to audit.

Our goal is not to replace human reviewers. Instead, the platform uses AI to organize evidence, detect potential inconsistencies, evaluate risk indicators, and help authorized staff make better-informed decisions.

What It Does

UW KYC Intelligent System is a role-based platform for verifying organizations and their official documents.

Organization User

An organization can:

create and manage its profile; create a KYC dossier; provide legal and representative information; upload private documents; check document requirements; submit or resubmit its application; follow the review status; respond to correction requests; consult analysis results and history. Reviewer

A reviewer can:

view submitted dossiers; inspect organization information; securely review uploaded documents; validate or invalidate documents; examine extracted document data; launch an AI-assisted analysis; review risk indicators and inconsistencies; acknowledge, resolve, dismiss, or reopen findings; request additional information or corrections. Administrator

An administrator can:

supervise the complete KYC workflow; review dossiers, documents, extractions, and AI findings; approve, reject, or reopen an application; manage users and organizations; monitor failed analyses and extractions; consult audit logs and system activity. AI-Assisted Analysis

The analysis module evaluates the available KYC evidence and generates:

a completeness score; a risk score; a risk level; missing-document indicators; document-type mismatches; low-confidence extraction warnings; cross-document inconsistencies; reviewer questions; structured findings; an advisory recommendation.

Possible recommendations include:

APPROVAL_RECOMMENDED MANUAL_REVIEW REQUEST_INFORMATION REJECTION_RECOMMENDED

A simplified version of our risk calculation is:

R=min(100, B+12M+15D+7L)

Where:

R is the final risk score; B is the base risk score; M is the number of missing documents; D is the number of detected mismatches; L is the number of low-confidence extraction results.

The AI does not independently approve or reject an organization.

Every analysis includes:

{ "humanDecisionRequired": true }

The final decision remains the responsibility of an authorized human administrator.

Demonstration Mode

For the hackathon demonstration, we implemented a transparent simulation provider that follows the same interface as the real AI provider.

It uses:

actual dossier information; document metadata; completed extraction records; missing-document coverage; extraction confidence scores; configurable risk profiles.

The supported profiles are:

LOW MIXED HIGH

For our demonstration, we use the MIXED profile because it produces realistic findings and moderate risk signals that clearly demonstrate the reviewer workflow.

The interface displays:

Demonstration mode — simulated data

This allows us to present the complete workflow without consuming a paid API, while remaining transparent about the source of the results.

The system can later switch to a real AI provider without changing the frontend workflow, findings system, database structure, or human-decision process.

How We Built It Backend

The backend was built with:

Node.js Express.js MySQL JWT authentication Zod validation Multer role-based authorization database transactions audit logs OpenAPI documentation

We used a modular architecture with separate layers for:

routes; controllers; services; repositories; models; validations; middleware; external integrations.

Sensitive workflows use database transactions. For example, completing an analysis can update the analysis record, create findings, associate document extractions, change the KYC status, and create an audit log as one controlled operation.

Frontend

The frontend was built with:

React Vite Axios protected routes role-based navigation reusable dashboard components automatic JWT refresh responsive layouts loading, error, and empty states

The frontend automatically sends authenticated requests using:

Authorization: Bearer X-Organization-Code:

Public resource codes begin with #. Before inserting them into URLs, the frontend safely encodes them.

For example:

UW-2026-KYC-90A573E4F416

becomes:

%23UW-2026-KYC-90A573E4F416 Security and Traceability

KYC documents may contain identity numbers, tax information, addresses, signatures, and company registration details.

For this reason, documents are not exposed as public static files. Access is controlled through:

authenticated download routes; ownership verification; role-based permissions; MIME-type validation; private storage; document security status; audit logging.

The database keeps separate records for:

users; organizations; KYC dossiers; document requirements; uploaded documents; extraction attempts; AI analyses; findings; review actions; final decisions; audit logs.

Each important resource receives a public identifier instead of exposing its internal numeric database ID.

Challenges We Faced Responsible AI Design

One of our biggest challenges was defining the boundary between automation and human authority.

It would have been easy to automatically approve or reject a dossier based only on an AI-generated score. We deliberately avoided that approach.

The AI can analyze evidence, identify risks, create findings, and recommend an action. However, only an authorized human can make the final decision.

Workflow Consistency

A KYC dossier can move through several states:

DRAFT PENDING ANALYZING UNDER_REVIEW CHANGES_REQUESTED APPROVED REJECTED EXPIRED

We had to prevent invalid transitions, duplicate analyses, simultaneous processing, unauthorized decisions, and partial database updates.

We addressed these challenges with:

explicit transition rules; transactional operations; role-based permissions; conflict detection; immutable analysis attempts; retry controls; audit logs. Frontend and Backend Alignment

The frontend initially used simulated structures and lowercase statuses, while the backend used uppercase business values.

For example:

Frontend: under_review Backend: UNDER_REVIEW

We created centralized adapters for roles, statuses, API errors, sessions, public codes, and analysis results.

Limited Paid API Access

During development, paid AI access was limited.

Instead of removing the AI workflow from the demonstration, we built a simulation provider that uses the same service contract as the real provider. This allowed us to demonstrate realistic analysis, findings, reviewer actions, and final human decisions.

What We Learned

We learned that building an AI-enabled system is not only about calling an AI model.

A reliable platform also requires:

secure document handling; strong validation; access control; explainable results; traceable human actions; failure recovery; consistent API contracts; responsible AI governance.

We also learned that a recommendation is not the same as a decision. An AI risk score can support a reviewer, but it cannot replace legal, institutional, and contextual human judgment.

Accomplishments We Are Proud Of

We are proud that UW KYC Intelligent System is more than a visual prototype.

It includes:

a real MySQL-backed workflow; secure authentication; private document handling; role-based access; document extraction records; AI analysis attempts; structured findings; human finding resolution; final human decisions; complete activity history; standardized API errors; OpenAPI documentation; role-based React dashboards.

We are especially proud of the responsible AI architecture: the platform provides intelligent assistance while keeping accountability in human hands.

What Is Next

Our next steps include:

connecting the platform to a production AI provider; adding OCR and document-understanding services; integrating official company and tax registries; adding fraud and duplicate-document detection; introducing sanctions and watchlist screening; supporting multilingual documents; improving risk explainability; adding real-time notifications; strengthening encryption and secrets management; deploying the platform on secure infrastructure.

Our long-term vision is to make organizational verification faster, safer, more transparent, and more accessible—while demonstrating that advanced and responsible AI solutions can be designed and built in Africa for both local and global challenges.

Built With

• api
• axios
• bcryptjs
• cors
• css3
• express.js
• helmet
• html5
• javascript
• jwt
• morgan
• multer
• mysql
• node-cron
• node.js
• npm
• openai
• openapi
• react
• rest
• supertest
• swagger
• vite
• vitest
• zod