Mapping the fintech signup funnel from app install to funded account

Someone taps install at 21:40 on a Friday after seeing a card animation on Instagram. By 21:47 they have photographed a driving licence, been told the image is too dark, retried, and landed in a manual review queue that no human opens until Monday. Analytics counts them as an install, a signup start and a KYC submission. They are not a customer, and most of that cohort never becomes one. Between that tap and the first pound in the account sit five stages, and four of them can fail for reasons an e-commerce checkout never meets.

The gate in the middle

Retail funnels run visit, cart, purchase. A fintech funnelfunnelThe customer journey from awareness to purchase, typically Awareness, Interest, Consideration, Decision, Action, with prospects narrowing at each stage.View full definition → has a pass/fail compliance gate wired into it: KYC (Know Your Customer), the identity verification mandated under anti-money-laundering law. In the US that is mainly the Bank Secrecy Act, supervised via FinCEN; in the EU the Anti-Money Laundering Directives, enforced by national regulators such as BaFin; in the UK the Money Laundering Regulations under FCA supervision.

Two things follow. The account cannot legally open until the gate clears, so no amount of copy or UX polish converts a failed check. And the gate is usually operated by third parties (PersonaPersonaA semi-fictional, research-based representation of your ideal customer: their goals, frustrations, behaviours and decision criteria.View full definition →, Jumio and Onfido all sell exactly this verification service), which means a slice of your conversion rateconversion rateThe percentage of visitors or prospects who complete a desired action (purchase, sign-up, contact form), calculated as conversions divided by total opportunities.View full definition → is set by a supplier's model rather than by your product team.

The five stages

1. Install. Download from an ad, a referral link or store search. Cheap to move, weak as a success measure on its own.

2. KYC submission and pass. ID document plus a selfie for liveness matching, then a name, date-of-birth and address match against reference data. Report first-attempt pass separately from eventual pass: the gap between them is retry friction, and the population sitting in the "referred for manual review" bucket is neither passed nor failed. It is waiting.

3. Approval. Sanctions and PEP screening, fraud scoring, and for credit products an underwriting decision. A verified human can still be declined. Teams that fold approval into KYC lose the fact that risk policy, not creative, owns this stage, and that risk can tighten a threshold on Tuesday and move next week's funnel by several points.

4. Card issue and activation. The card is posted to the address on file, arrives in three to seven working days, then has to be activated. Every step is a chance to lose someone: address mismatch with the ID, a household that binned the envelope, a card that lives in a drawer. Products that drop a virtual card into Apple Pay at the moment of approval collapse this gap to zero, which is why the sequencing of card issue against first funding is a deliberate design choice, not an operational detail.

5. First funding. A deposit, a transfer, a salary redirect. This is when a user becomes a customer in any commercial sense.

Where the drop-off concentrates

A rough shape, from public reporting and product analytics vendors (estimates as of 2025, wide variance by product and geography):

• Install to started signup: 70 to 85%
• Started signup to first-attempt KYC pass: 55 to 75%, with document quality and name-matching mismatches doing most of the damage
• Approval after screening: usually high for deposit products, far lower for credit
• Approval to account link: 60 to 80%, where "I'll do it later" behaviour spikes
• Account link to first funding within 30 days: 40 to 65%

Multiply those and a million installs can land well under 150,000 funded accounts. Whether that shape is healthy for your sub-category is a comparison question the benchmarking lesson settles; what matters here is that each stage has a different owner and a different fix. KYC drop-off is product and compliance (camera UX, opaque rejection messages). Approval drop-off is risk appetite. Card drop-off is logistics. Funding drop-off is incentive: no reason to move money today rather than next month.

One failure mode almost every team walks into: paid campaigns run 24 hours a day, and manual review teams work business hours. Friday evening and weekend cohorts sit in the queue for 36 to 60 hours and convert measurably worse than Tuesday morning cohorts on identical creative. If you cannot staff the queue, throttle the spend against it.

The stage that carries the revenue signal

Install-to-signup gets the attention because creative and landing pages move it easily. The stage that tracks revenue is KYC-to-funded conversion, often called activation rate. It strips out curious clickers, bots and fraud attempts, and measures only people who have already cleared a real regulatory hurdle. Whether they then fund tells you if the ad promised something the product delivers.

Worked example. A campaign generates 10,000 installs.

• 7,000 start signup (70%)
• 4,200 pass KYC (60% of starters)
• 3,950 clear screening and are approved (94%)
• 2,765 link a funding source (70%)
• 1,520 fund within 30 days (55%)

Activation rate = 1,520 / 4,200 = 36.2%

Read that as productivity per install: this funnel yields about 152 funded accounts per 1,000 installs. Lifting activation from 36% to 48% produces roughly 500 extra funded accounts from the same 10,000 installs, which is almost always cheaper than buying the 3,300 additional installs that would otherwise be needed. Translating that into a fully loaded cost per funded account is the CACCACCustomer Acquisition Cost (CAC) is the total sales and marketing spend divided by the number of new customers gained in a period. It measures how efficiently you grow.View full definition → lesson's arithmetic; the funnel's job is to show you which stage the money is stuck in.

When a worse pass rate is the right answer

Activation is not a number to maximise blindly. Fraud rings abandon at the same stages genuine users do, so a KYC pass rate that drops after you tighten liveness detection may be the control working, not the UX failing. Split the metric by outcome reason before you celebrate or panic.

The regulator can also cap the funnel outright. BaFin restricted N26 to roughly 50,000 new customers a month from late 2021 over anti-money-laundering shortcomings, a limit only lifted in 2024. For that period no marketing plan mattered above the ceiling: the growth constraint was an onboarding order, and spend had to be rebuilt around quality rather than volume. Monzo went through the same logic from the other end, operating under an FCA requirement not to onboard higher-risk customers, and was fined about £21m in 2025 over historic onboarding controls, including accounts opened against implausible addresses. Weak verification does not just leak revenue later; it removes segmentssegmentsDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.View full definition → from your addressable market by order.

Instrumenting it

funnel_stage_conversion = users_reaching_stage_N / users_reaching_stage_N-1

kyc_pass_rate       = kyc_passed / signup_started      # split first-attempt vs eventual
approval_rate       = approved / kyc_passed
card_activation     = cards_activated / cards_issued
account_link_rate   = accounts_linked / approved
funding_rate        = accounts_funded / accounts_linked
activation_rate     = accounts_funded / kyc_passed     # the revenue-predictive one

Track each rate weekly by acquisition channel and by day of week. Cheap installs with poor KYC-to-funded rates are a false economy, common with incentivised "sign up and get $5" affiliate traffic that buys volume without intent.

For funnel definitions and benchmarking methodology, see the OECD's work on digital financial services metrics or the aggregate benchmarks published by Amplitude and Mixpanel, both of which sell the analytics tooling they benchmark with.

Structural differences worth knowing

In the US, friction concentrates on document verification (state ID formats vary enormously, producing OCR errors) and Social Security Number matching, with account linking running through aggregators that negotiate bank relationships one at a time.

In the EU, PSD2 obliges banks to expose account data to authorised third parties, so the linking step is standardised rather than negotiated, and N26 or Monzo-style flows tend to move through it more smoothly than US equivalents. Treat that as directional; comparative figures are not consistently published.

Korea shows what happens when national identity infrastructure does the work. Toss verifies users through mobile carrier authentication tied to a resident registration number, so the document-photography step that costs Western apps 20 to 40 points of conversion barely exists. The same funnel, the same product, a different verification substrate, and a different shape.

🎬 [VIDEO: "How Neobanks Actually Make Money" - youtube.com/@Fintech - search for recent explainer content from established fintech-focused channels covering neobank unit economics and onboarding funnels]

Key Takeaways

• Five stages: install, KYC pass, approval, card issue and activation, first funding. Approval and card issue are separate failure points, not sub-steps of KYC.
• Activation rate (KYC-to-funded) is the stage metric most predictive of revenue, because it isolates people who already cleared a compliance hurdle.
• Manual review capacity is a marketing variable: weekend cohorts convert worse when the queue is staffed to office hours.
• A falling pass rate can mean fraud controls working. Split by outcome reason before acting.
• Regulators cap funnels directly, as BaFin did with N26's monthly onboarding limit, which puts onboarding quality upstream of any growth plan.
• Verification infrastructure sets the ceiling: Toss's carrier-based identity check removes a step that document-upload markets cannot design away.