Vitec Next Connection

The nature of AML and KYC work requires a lot of Personally Identifiable information (PII) monitoring of persons and organizations, keeping track of them over time, self declaration forms and risk assessments.

Because the KYC Flow integration performs a significant amount of back-and-forth with Vitec Next to keep contact persons, roles, PEP and other important data in sync between the two services, we require many API endpoints for the service to work correctly. This might seem like a lot more permissions than other integrations typically ask for, but it’s in the nature of the data needed for the work. This can be described simply as:

• Get data from Vitec to perform lookups in KYC Flow.

• Ensure that the data is synced correctly back to Vitec Next and does not needlessly create duplicate persons in either system when there are minor inconsistencies like middle-name mismatches.

• Ensure we can upload documents to Vitec Next.

The Test version of Vitec Next integration needs slightly more permissions than the production version. For example: we will never need to delete pdf documents in production, but the test environment deletes PDF documents for easier testing.

Requirements

For us to connect to your Vitec Next instance we need to register it. Typically we need:

• Your installation ID: this is usually an ALL CAPS word like MSVPAR or similar.

• Your DepartmentId: this is usually a multi digit number, anywhere from 10 to 99999

• If you have a Single Sign-On solution (SSO) like Azure Entra ID, then we can use this to properly correlate your KYC Flow user with your Vitec Next user so that permissions, access and responsibility is properly delegated and synced.

Once we register you as being able to use the service, a system Administrator in Vitec is asked to approve the Integration (this includes saying yes to allowing us to use the API).

What does the integration currently do?

1. Assignment Transfer

All Vitec Next integrations start by using the “Order Service” or “Bestill Tjeneste” function. This triggers the integration, and transfers data to KYC Flow.

When an assignment is transferred from Vitec Next to KYC Flow, the following will occur:

1.1 . Creation & Participant Transfer

·         A new assignment is created in KYC Flow.

·         All supported participant types from the Vitec order are transferred in the KYC flow mapped to KYC Flow-supported roles:

o    Buyer

o    Seller

o    Client

o    Customer

·         Monitoring is enabled for all transferred participants.

·         Lookups are performed on all transferred participants.

·         Needs to account for more role types.

o    Contact Persons are associated with LegalPersons inside KYC Flow.

1.2 Responsible User

·         The Responsible User in KYC Flow is automatically set to the megler who is responsible for the Vitec Next Assignment.

·         Responsible users can be added or removed later.

1.3 Redirect

• After transfer, the customer is redirected to the assignment page in KYC Flow.

2. Assignment Lifecycle

2.1 Participant Updates

• When new participants are added in Vitec, they are automatically created in KYC Flow and assigned a role.

• This means that KYC Flow is actively paying attention to changes in the Participants list in Vitec Next.

2.2 Document Synchronization

Documents synced from KYC Flow to Vitec Next include:

·         AML reports from lookups

·         PEP/Sanction Accept/Decline reports (based on KYC Flow alerts)

·         ID check documents

·         Risk report (after risk assessment)

·         Signed webform

·         Adverse media - Selskap

2.3 Role Synchronization

·         Contact Person: synced from Vitec next and added to KYC Flow.

·         IMPORTANT: Vitec has a restriction on only allowing new contacts to be created through integrations if they have a Phone Number. This puts a serious restriction on integrations.

·         People with roles that are added to KYC Flow from an organization lookup are synced from KYC Flow to Vitec if a phone number is present from webforms or supplied by the case worker.

o    This restriction already exists in earlier integrated AML products like Kundesjekk v1 and KDK, so this is not a regression.

o    KYC Flow does not get phone numbers from any registries or lookups, and phone number is considered a optional field in KYC-forms.

o    Integration team is working on a solution to this issue but will not be present in the MVP. In the meantime: all AML PDFs are still uploaded to Vitec Next, and a status is sent to the Order Status panel when a person fails synchronization. Updating their phone number in KYC Flow (Or if the person exists already in Vitec Next), this resolves itself.

2.4 Identification Status Sync

We sync Identification status on participants on which ID verification is done in KYC flow.

• Legal entities: if one of the persons with roles in company is ID checked we show Id check status on legal entities as marked done in the checklist.

• Private individuals: Each person must be ID‑verified individually in KYC Flow.

  • This is synced back to Vitec Next in the “Id” panel.

3. Risk Assessment

3.1 Checklist Synchronization

We sync checklist tags (pep , risk level, high risk country).

If there are multiple participants in each group like seller or buyer we try to sync the highest risk level of this group. If there is at least one person who is connected to high risk or pep we sync it as whole group is connected.

We extract these details from risk data for an Assignment. We will be providing with checklist Identifiers that customers need to add to their Vitec Next Checklists so that they can benefit from the integration.

3.2 AML Panel Synchronization

• Risk indicators from the webform are extracted and synced to participants in the AML panel.

• AML webform templates provided by collaboration between KYC Flow team and Eiendom Norge are made to sync AML questions back to the Vitec Next AML Panel such as Financing info.

• External IDs will be added to the questionnaire to ensure correct mapping Once the templates are ready.

• We request these templates not be edited as it may lose these external ids and integrations may not work as expected in terms of showing correct data in the Vitec system.

4. Order Archiving

When an order is deactivated in Vitec, a webhook triggers automatic archiving of the assignment in KYC Flow.
Archived assignments stop monitoring the persons contained within them.

Archived assignments

·         Cannot be reactivated.

·         They stop sending out webforms

·         They stop ongoing id-checks

·         They stop sending out webhooks to the integration.

Integration setup

KYC Flow supports two layers of integrations in Vitec Next. The simple integration works seamlessly by your administrator simply adding the checklist keys to Vitec Next
These values are set automatically from the PEP state in KYC Flow for sellers and buyers separately.
Additionally, PEP status is updated both in the Checklist and the AML panel in Vitec Next.

KYC Flow also offers a deeper integration that triggers based on domain-spesific questions asked in the webform. These questions include things like:

• Funding sources

• Countries associated with the transaction
  The more deeper variant requires you to use spesific webforms in KYC FLow with spesific KEYS that are associated with these more complex AML properties.

Simple variant - Checklist and AML Panel

Detailed description of logic

PEP alwyays assumes the highest PEP state reported by KYC Flow for the given type of particiant. If ANY of the people associated with "Sellers" is PEP in KYC FLow, then the resulting KYC_SELLER_PEP will be set to "true"

• The KYC_FLOW_SELLER_RISK_* is set to the highest value of risk given to any seller in any risk assessment.

• The KYC_SELLER_GEO is set based on if any of the people in the sellers list disclose (or lookups reveal) that they are associated with high risk countries.

Setup requirements

• Setting up Checklists in Vitec Next using the "sjekkliste-merke" tags offered below

Deep integration variant

If you are using a Webform in KYC Flow that supports it, there are cases where customers can be asked if the business Transaction itself is tied to any high-risk countries (such as the funding sources).
This type of information would not be revealed automatically in KYC FLow, and requires domain spesific questions.

Setup requirements

• Use domain-spesific webforms in KYC Flow defined in partnership with the KYC Flow team and Eiendom Norge.

• Setup the same checklists as defined above

Detailed description of logic

The webforms have questions in them that go deeper into the nature of the transaction. The webform sent to the primary contact person will include the deepest questions, while webforms sent to other participants of the transaction will include less.

• If the primary target of the webform is an Organization, then the results of the webform will be published to the AML panel of the Organization.

• If the primary target is a Person not tied to an Organization, then the results will be sent to the AML panel of the person.

• Any additional PEP or GEO risks that is known about the persons or Orgs will be sent to those individual Participants AML panels.
  In cases of conflicting