From scanned documents to verifiable claims
Opening an account or establishing a business relationship often requires several checks: who the customer is, whether documents are genuine, who controls an organisation and who has authority to act. Digital identity systems aim to make some of that evidence easier to obtain and verify. Their value depends on the strength of the underlying proof, not the sophistication of the interface.
The FATF guidance on digital ID helps regulated entities assess whether a system is appropriate for elements of customer due diligence. It focuses on the risk-based use of digital identity and does not eliminate other obligations. A fast identity check cannot by itself resolve questions about beneficial ownership, source of funds or suspicious activity.
For individuals, the process involves proofing identity and authenticating subsequent access. For companies, it also involves establishing the legal entity and the authority of the person representing it. These are related but distinct questions.
Proof once does not mean trust forever
A credential can be valid at issuance and become stale when a name, address, employment role or corporate mandate changes. Institutions need rules for refresh, revocation and exceptions. A stolen account can pass an identity check that was accurate when the customer first enrolled.
The NIST digital identity guidelines separate identity proofing, authentication and federation. Its identity proofing guidance provides a way to think about the assurance attached to enrolment. These US guidelines are not a universal legal requirement for private financial firms, but the distinctions help prevent an onboarding team from treating every digital credential as equally reliable.
Risk should determine the strength of the check. Low-risk access to general information and authority to move substantial funds warrant different controls. A good journey adapts without making every legitimate customer repeat the most burdensome process.
A legal entity needs a current identity
Business onboarding often involves inconsistent names, local registration formats and complex ownership structures. The Global Legal Entity Identifier Foundation maintains an open index of standardised legal entity reference data. Its verifiable LEI model is designed to support digital verification of an entity and the roles of people acting for it. Adoption and recognition still differ across uses and jurisdictions.
An identifier is a starting point, not a substitute for a complete due diligence assessment. A firm may need to check the current registration status, beneficial owners, licences where relevant and the authority conferred by a particular mandate. The source, update date and verification method should remain visible.
A bank that can reuse reliable, appropriately permissioned information may reduce duplicate requests. The savings disappear if it cannot resolve conflicting records or if a counterparty has no suitable credential. Hybrid paths will remain necessary.
Privacy and inclusion shape adoption
Digital onboarding can fail people with limited documentation, low connectivity, disabilities or difficulty using a particular device. A system designed only for the easiest applicants may improve average processing time while excluding people who most need service. Alternative verification routes and accessible support are part of the design.
The World Bank’s guidance on privacy and security in ID systems emphasises safeguards throughout the identity lifecycle. Collecting less data, restricting reuse and protecting credentials reduce the potential harm of a breach. Centralised convenience should not obscure the consequences of exposing sensitive records.
Financial firms also need clear redress. A customer wrongly rejected by an automated check should have a practical way to correct the record and obtain a review. Audit trails should explain the decision without unnecessarily retaining sensitive information.
The measure of a better journey
A successful system shortens legitimate onboarding while maintaining the quality of checks. Useful measures include time to open an account, manual exception rates, confirmed fraud, false rejections, customer complaints and the effort required to refresh information. A faster approval rate alone could conceal weakened controls.
Interoperability and governance matter as much as any particular credential. Institutions need to know who issued an identity claim, how it was verified, whether it remains current and which other party may rely on it. When those questions have credible answers, digital identity can reduce repeated paperwork and support safer financial access.
The change will be gradual. Legal standards, customer circumstances and business relationships vary. Digital identity is most useful when it improves evidence and accountability within onboarding, while preserving a fair path for people and organisations that cannot use the preferred technology.
What a reusable credential must prove
A reusable identity credential can spare a customer from repeatedly presenting the same information. But the relying institution must know who issued it, what checks were performed, when they occurred and whether the credential remains valid. A simple digital copy of a passport is not equivalent to a trustworthy, current assertion of identity.
For business relationships the chain extends further. The organisation must be identified, the person’s role established and the scope of authority understood. A director may be allowed to sign one kind of document but not authorise a payment above a threshold. Digital verification should preserve these distinctions instead of compressing them into a single “verified” label.
Interoperability can reduce duplicate work when several institutions recognise the same standard. It also creates governance questions about liability if an issuer made a mistake and about how corrections propagate when an attribute changes.
Fraud adapts to the entry point
Stronger digital identity can make document alteration harder, but attackers may target account recovery, device access or the authorised person through social engineering. Firms should evaluate the whole lifecycle: initial proof, authentication, transaction approval, credential renewal and revocation.
Risk signals can justify additional review without treating every exception as fraud. A legitimate customer may change a phone, travel or use an assistive device. A system that blocks such customers without an effective remedy can damage inclusion and trust.
Manual review remains important for cases the automated process cannot resolve. It should be auditable and bounded by clear standards; otherwise exception handling becomes a back door that undermines the stronger primary journey.
The business case needs both sides
Onboarding teams can measure reduced handling time and fewer repeated document requests, but they should also count integration costs, credential fees, exception queues and false rejections. If customers abandon the journey because a credential is unavailable, a faster path for successful applicants may not improve the overall result.
A staged rollout can compare cohorts and examine whether the system works across customer groups, devices and jurisdictions. It can also identify which information should remain subject to direct verification. The goal is a better-controlled relationship, not simply a shorter form.
Digital identity is becoming part of financial infrastructure because trusted claims can be checked and reused. Its credibility rests on clear assurance, current authority, appropriate data protection and an accessible alternative when technology fails.
A customer journey with fewer repeats
A customer may provide identity information to a bank, a payments provider and a brokerage within the same month. Reusable, trusted credentials could reduce repeated collection, but each firm must still decide whether the evidence meets its own obligations and risk appetite. The ability to reuse data is therefore conditional rather than automatic.
A well-designed journey tells the customer what is being checked, which information is shared and how an error can be corrected. It asks for additional evidence only when the risk or missing detail warrants it. That can reduce friction without hiding the reason for a delay.
Institutions need to track failures as well as successful enrolments. A small minority trapped in an exception queue can wait far longer than the headline average and may abandon the service.
The authority problem in business accounts
For an organisation, proving that a legal entity exists is only the beginning. The institution must determine who controls it and who may act for it in the relevant transaction. A credential showing employment at a company does not necessarily confer signing authority or permission to open an account.
Roles can change quickly through resignation, delegation or a new board mandate. The onboarding process needs a method to refresh authority and revoke credentials. The control should be proportionate to the action, with stronger confirmation for high-value transfers or changes to authorised signatories.
This is where standardised entity records and role credentials may help, provided they are current and accepted by the relying party. The firm remains responsible for understanding the relationship it enters.
Trust is maintained after approval
The cost of identity failure can surface months after onboarding, when an account is taken over or a business contact’s authority expires. Monitoring, secure recovery and customer support are therefore part of the identity system. A strong initial check cannot compensate for weak authentication later.
Privacy controls should limit who can inspect the evidence and how long it is retained. The convenience of sharing a credential across services should not permit unrelated parties to assemble a detailed picture of a person’s activity without a lawful basis and appropriate safeguards.
Financial onboarding will improve when institutions can verify the right claims at the right time and correct mistakes promptly. That is a continuing trust process rather than a one-time digital form.
References
NIST digital identity guidelines