For much of modern banking, identity sat at the edge of the customer relationship. It was checked when an account was opened, revisited when information changed, and then largely disappeared behind passwords, security questions and transaction monitoring. That model is becoming harder to sustain. As banking moves further into remote channels, instant payments, embedded finance and automated service, identity is shifting from a compliance checkpoint into a continuously used infrastructure layer.
The change is being driven by a simple operational reality: banks increasingly need to know not only who a customer was at onboarding, but whether the person, device or authorised representative attempting an action now can be trusted. That distinction is turning identity into a system that connects customer due diligence, authentication, fraud prevention, access management and consent.
The direction is visible in updated technical and policy frameworks. The National Institute of Standards and Technology (NIST) Digital Identity Guidelines published in 2025 place identity proofing, authentication and federation within a common assurance framework. The Financial Action Task Force (FATF) guidance on digital identity likewise recognises that digital identity systems can be used in customer identification and verification when institutions assess their reliability on a risk basis. For banks, the practical implication is that identity architecture is becoming a design decision, not merely a documentation process.
From one-time KYC to continuous identity assurance
Traditional know-your-customer processes are built around a moment: the point at which the bank establishes a relationship. The customer supplies documents, the institution checks them against reliable sources, sanctions and watchlist screening is performed, and the account is approved or rejected. That remains essential, but digital banking has created a much longer identity chain.
A customer may open an account on a phone, sign in from a new device, add a beneficiary, reset a credential, approve a high-value payment, grant access to a third-party service, or delegate authority to an employee. Each step creates a different question about identity and authority. A bank that treats all of those events as separate security tasks can end up with fragmented controls. A bank that treats them as one identity lifecycle can apply common evidence, risk signals and assurance levels more consistently.
This is one reason the distinction between identity proofing and authentication matters. NIST separates the process of establishing who someone is from the process of confirming that the person returning to a system is the same enrolled user. Its 2025 guidance also expands attention to fraud and continuous evaluation. The framework is written for US government systems, not commercial banks, but the architecture is relevant: identity becomes a chain of evidence and assurance rather than a single document check.
Onboarding economics are changing
Digital identity can also change the economics of customer acquisition. Manual or document-heavy onboarding introduces cost at precisely the point when a bank does not yet know whether a new relationship will be profitable. Remote verification can reduce friction, shorten processing time and allow institutions to serve customers who are far from branches.
The World Bank digital ID toolkit for regulatory authorities notes that digital ID can improve the reliability, security, privacy and efficiency of identification in the financial sector, while also warning that technical failures and exclusion risks have to be managed. More recent World Bank work on digital public infrastructure has highlighted how electronic KYC can lower onboarding costs when trusted identity and data-exchange layers are available.
For banks, lower onboarding cost is only part of the opportunity. Standardised identity evidence can make it easier to reuse verified attributes across channels, products and regulated entities, subject to consent and applicable law. That can reduce duplicated checks. It can also make onboarding more modular: a bank may be able to request only the attributes required for a particular product rather than collecting a broad set of documents every time.
Authentication is moving beyond passwords
The customer experience implications are equally important. Passwords are convenient to deploy but weak as a standalone trust mechanism. They can be guessed, reused, stolen or socially engineered. Multi-factor authentication improves security, yet the implementation still matters. A text message code, a cryptographic credential and a biometric bound to a trusted device do not provide the same resistance to attack.
The latest NIST authentication guidance defines multiple authenticator assurance levels and emphasises phishing-resistant options at higher levels of assurance. Banks do not have to copy those levels directly to benefit from the underlying principle: the strength of authentication should match the risk of the action. Checking a balance, changing a registered phone number and authorising a large payment may reasonably require different levels of proof.
This creates a path toward adaptive authentication. Instead of forcing every customer through the same sequence, the bank can combine known device status, cryptographic credentials, behavioural signals, transaction context and the sensitivity of the requested action. The objective is not to remove friction everywhere. It is to place friction where it has the greatest security value.
Identity is becoming part of fraud architecture
Fraud is one of the strongest reasons for banks to unify identity controls. Account takeover, impersonation, synthetic identities and social engineering exploit gaps between onboarding, authentication and transaction controls. If one system verifies the person, another assesses the device and a third scores the payment, weak hand-offs can create opportunities for attackers.
A more integrated model allows identity evidence to travel with the risk decision. A newly created account using unfamiliar credentials, for example, can be treated differently from a long-established account accessed with a recognised phishing-resistant authenticator. Similarly, a request to change core identity attributes immediately before a payment can trigger stronger verification.
This does not mean that digital identity eliminates fraud. Deepfakes, stolen documents, compromised devices and manipulated biometric checks can all attack identity systems themselves. Stronger identity infrastructure therefore shifts the problem rather than ending it. Banks need controls around liveness, document verification, recovery, credential issuance, third-party dependencies and the integrity of the underlying data sources.
Federation could reduce repeated verification
Another structural change is the growth of federated identity. In a federated model, one trusted party can authenticate a user and provide assertions or attributes to another relying party. The NIST federation guidance describes how credential service providers and relying parties can exchange authentication and subscriber information within defined trust relationships.
For banking, federation could eventually reduce the need for customers to prove the same facts repeatedly across every institution and service. Verified age, legal name, address or business authority could, in principle, be supplied through trusted credentials without forcing the customer to upload the same document each time. This can support open banking, embedded finance and corporate access models where multiple parties need to recognise the same authority.
However, federation creates concentration and dependency risks. If many institutions rely on the same identity provider or registry, an outage, breach or governance failure can affect a large part of the financial ecosystem. Banks therefore need to treat identity providers much like other critical infrastructure vendors: with due diligence, resilience testing, contractual controls and fallback procedures.
The inclusion case is substantial - but not automatic
Digital identity is often discussed as a route to broader financial inclusion because it can make remote onboarding possible and reduce dependence on paper documentation. The World Bank's 2025 ID4D Global Dataset estimates that around 800 million people still lack official proof of identity and at least 2.8 billion do not have access to a government-recognised digital identity for secure online transactions. Those figures show both the scale of the opportunity and the limits of assuming that digital identity is already universal.
If a bank designs around a single smartphone, biometric or government credential, it may unintentionally exclude customers who lack the required device, connectivity, documentation or accessibility support. Identity systems can also reproduce errors in source data. A person who cannot correct an identity record may find that the same problem follows them across multiple services.
That makes fallback processes part of good identity design. Assisted onboarding, alternative evidence, accessible authentication and clear recovery paths are not merely customer-service features. They are controls against exclusion and operational dead ends.
Privacy becomes an architectural question
As identity data becomes more reusable, privacy risks rise. A centralised store containing documents, biometrics, device information and behavioural signals can become a highly attractive target. Equally, an institution can create unnecessary risk simply by collecting more identity data than it needs.
Modern identity architectures increasingly separate verification from disclosure. A bank may need proof that an attribute is valid without requiring every underlying record. That principle can support data minimisation, but it depends on technical standards, legal frameworks and trust between the parties involved.
The practical governance question is therefore not only whether the bank can verify a customer, but what evidence it retains, for how long, who can access it, how it is refreshed and how the customer can challenge errors. Identity infrastructure sits at the intersection of cybersecurity, privacy, compliance and customer experience. Treating it as a single department's responsibility is increasingly difficult.
What changes inside the bank
Moving identity into the core architecture changes how banks organise technology and controls. First, identity services need to be reusable across channels rather than rebuilt product by product. Second, assurance levels need to be explicit so that product teams understand what evidence is required for different actions. Third, the bank needs clear ownership of identity recovery, because account recovery is often where otherwise strong authentication systems become vulnerable.
Fourth, identity telemetry needs to connect with fraud and security monitoring. A change in credential, device or authority can be relevant to a transaction-risk decision. Finally, banks need to understand external dependencies. National ID systems, document-verification providers, biometric services, mobile networks and cloud identity platforms can all become part of the trust chain.
This is less about buying a single identity product than about defining a coherent trust model. The strongest architecture is likely to be layered: authoritative source data for proofing, robust credentials for authentication, risk-based step-up controls, privacy-preserving data sharing where appropriate, and recovery processes that do not undermine the rest of the system.
A new form of banking infrastructure
Banks have traditionally thought of infrastructure in terms of ledgers, payments, networks and data centres. Digital identity now belongs in that conversation because nearly every remote financial interaction depends on a judgement about who is acting and what they are allowed to do.
The strategic shift is from identity as paperwork to identity as a live control plane. Done well, it can reduce onboarding friction, support stronger authentication, improve fraud controls and widen access. Done poorly, it can centralise risk, create new points of exclusion and expose sensitive data at scale.
That is why the next phase of digital banking is unlikely to be defined only by faster payments or better interfaces. It will also depend on whether banks can build identity systems that are reliable enough for regulators, secure enough for high-risk transactions and simple enough for customers to use every day.
Key questions
Why is digital identity becoming more important to banks?
Because remote banking requires identity to be checked continuously across onboarding, authentication, payments, account recovery and delegated access rather than only at account opening.
Does digital identity replace KYC?
No. It can make identity proofing and verification more efficient, but banks still need customer due diligence, ongoing monitoring and risk-based controls under applicable regulation.
Can digital identity reduce fraud?
It can strengthen proofing and authentication, especially when identity, device and transaction signals are connected. It does not remove fraud risk and can itself become a target for attackers.
What is the main risk of federated identity?
Federation can reduce duplicated verification, but it can also create dependency on shared identity providers or registries, making resilience and governance critical.
How does digital identity affect financial inclusion?
Remote verification can reduce documentation and branch-access barriers, but poorly designed systems can exclude people who lack devices, connectivity or compatible identity credentials.
References
• NIST - SP 800-63-4 Digital Identity Guidelines
• NIST - SP 800-63B-4 Authentication and Authenticator Management
• NIST - SP 800-63C-4 Federation and Assertions
• Financial Action Task Force - Guidance on Digital Identity
• World Bank - Digital ID to Enhance Financial Inclusion: A Toolkit for Regulatory Authorities
• World Bank ID4D - 2025 Global Dataset
• World Bank - Creating Digital Public Infrastructure for Empowerment, Inclusion, and Resilience