Full document copies create a concentrated store of high-value identity data that attackers can exploit for fraud and account takeover. They usually add no compliance value when regulations only require extracted data points and verification outcomes. That makes them both a privacy exposure and a security liability, especially when stored across multiple business systems for long periods.
Why This Matters for Security Teams
In AML and KYC workflows, the question is not whether identity evidence is useful, but whether storing the entire passport or driver’s licence copy improves the control outcome. Current guidance from the FATF Recommendations — AML and KYC Framework focuses on risk-based due diligence, not indefinite retention of raw identity images. Full copies often expand the attack surface, increase privacy exposure, and create duplication across onboarding, case management, and archive systems.
The operational problem is simple: once a document image exists, it can be copied, indexed, forwarded, and retained far beyond the original verification need. That makes remediation harder after a breach and increases the number of systems that must be secured to a high standard. Controls aligned to the NIST Cybersecurity Framework 2.0 and privacy-by-design principles support minimisation, retention discipline, and access restriction, which are more defensible than blanket collection.
In practice, many security teams encounter the real risk only after a document repository has already been reused for fraud, insider misuse, or account takeover rather than through intentional data minimisation.
How It Works in Practice
Most AML programmes need to prove that identity was verified, not to preserve every pixel of the source document. A better pattern is to collect only the data elements required for the control objective, store the verification result, and keep a reference to the original evidence only where law, policy, or dispute handling genuinely requires it. This aligns with the security and privacy control intent in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially around data minimisation, access control, retention, and auditability.
Practically, teams should design the workflow so that full document images are either not ingested at all or are isolated into a tightly governed evidence vault with clear retention limits. Useful implementation patterns include:
- Capturing extracted fields such as name, document type, document number, issuing authority, and expiry date.
- Recording verification outcomes, risk scores, and analyst decisions instead of retaining the source image in multiple tools.
- Separating onboarding evidence from downstream case notes, analytics stores, and customer service systems.
- Applying role-based access, strong audit logging, and short retention periods for any retained image.
- Reviewing whether regulators, internal audit, or legal hold truly require the original copy, or whether a certified extract is sufficient.
This approach also supports governance frameworks such as ISO/IEC 27001:2022 Information Security Management and ISO/IEC 27002:2022 Information Security Controls, which both favour scoped access, retention control, and traceable handling of sensitive records. Where organisations also use automated onboarding or IDV tooling, the evidence store should be treated as a high-value identity repository, not a convenience archive. These controls tend to break down when AML, fraud, and operations teams each create their own copies because no single retention owner is accountable.
Common Variations and Edge Cases
Tighter evidence controls often increase workflow friction, requiring organisations to balance compliance assurance against operational speed and analyst convenience. Best practice is evolving, and there is no universal standard for every jurisdiction or institution type. Some regimes, high-risk customer segments, or dispute scenarios may justify retaining a full document copy, but that should be the exception rather than the default.
The key tradeoff is between proof and exposure. If a firm must retain source images, current guidance suggests limiting them to the smallest feasible system set, applying stronger access approval, and enforcing a documented retention schedule. If the business operates across multiple legal entities or jurisdictions, the same passport copy may be subject to different retention and transfer rules, which increases governance complexity. In those environments, security teams should confirm whether document images are duplicated in data lakes, e-discovery repositories, or case management exports, because the control failure is often replication rather than collection. That is where identity data turns from evidence into long-lived liability.
For regulated firms, the safest pattern is to treat raw identity documents as exception-managed records, while making extracted attributes and verification status the normal operating model. This is the most defensible balance between AML traceability and security reduction.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5, ISO/IEC 27001:2022 and FATF Recommendations set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 | Restricting access to identity images supports least-privilege handling of sensitive records. |
| NIST SP 800-53 Rev 5 | AC-6 | Least privilege is central when full identity copies are retained in shared systems. |
| ISO/IEC 27001:2022 | A.5.12 | Information classification helps treat passport copies as high-sensitivity records. |
| FATF Recommendations | AML/KYC rules require risk-based due diligence, not unnecessary retention of raw images. |
Grant only the minimum access needed to verify, investigate, or retain the record.
