Stage two combines extraction confidence, cross-checks like face match, address validation and sanctions lists, and behavioral signals into one recommendation: accept, review or reject. Rejects are soft, so the user can upload again. Reviews reach a compliance reviewer who sees the full stack of signals and can override with a reason code the model learns from.