Identity verification
IDVAlso called ID verification, identity proofing
Identity verification is the process of confirming that a customer is a real person and is who they claim to be. Firms check identity details against reliable, independent sources such as passports, driving licences, electronic databases or trusted digital identities. It is a legal requirement of customer due diligence under anti-money laundering rules.
How it works
Remote verification usually combines several checks. The customer photographs an identity document, which is tested for signs of forgery. A selfie or short video is matched to the document photo, with a liveness check to detect spoofing. Details may also be checked against credit reference or government databases. The result, with evidence, is stored in the customer record.
Identity verification sits at the start of the customer relationship and supports later fraud and AML controls. UK, EU and US rules require firms to verify identity using reliable sources, with more checks for higher-risk customers. The FATF has set out how digital identity systems can meet these standards. Weak verification exposes firms to synthetic identities, account takeover and money mule networks.
The rules
Requires firms to identify and verify customers and beneficial owners, and to conduct ongoing monitoring including scrutiny of transactions throughout the relationship.
UK banks, payment firms, accountants, lawyers and other relevant personsRequires customer identification and verification from reliable independent sources, and ongoing monitoring of the business relationship including scrutiny of transactions.
EU credit and financial institutions and other obliged entitiesRequires a written programme to collect name, date of birth, address and identification number, and to verify identity within a reasonable time.
US banks and other covered financial institutionsExplains how reliable, independent digital identity systems can support customer identification and verification under FATF Recommendation 10, using assurance levels.
Regulated entities and supervisors in FATF member jurisdictionsCommon questions
What is the difference between identification and verification?
Identification is collecting who a customer says they are, such as name and date of birth. Verification is checking that information against reliable, independent evidence to confirm it is true and belongs to that person.
Can identity be verified fully online?
Yes. UK, EU and US rules allow remote verification where it uses reliable, independent sources. Firms commonly combine document checks, biometric face matching, liveness detection and database checks to reach the assurance level their risk assessment requires.
What is the EU digital identity wallet?
The revised eIDAS Regulation, (EU) 2024/1183, entered into force on 20 May 2024. It requires member states to offer European Digital Identity Wallets that regulated firms will be able to accept for customer identification.
How long must verification records be kept?
Under the UK MLR 2017 and EU AML rules, firms keep customer due diligence records for five years after the business relationship ends. US CIP records are kept for five years after the account is closed.
