How should organisations handle customer identification and due diligence for non-face-to-face onboarding in Cyprus?

Organisations should align customer identification, verification, and due diligence controls to the risk profile of the relationship and the jurisdictional requirements that apply. For non-face-to-face onboarding, that usually means using stronger identity checks, evidence collection, and record keeping than a low-risk in-person flow. Teams should also map controls to the relevant legal basis and update them when laws or guidance change.

Why This Matters for Security Teams

Non-face-to-face onboarding compresses a high-trust decision into a low-assurance interaction, so the main risk is not just fraud at sign-up but weak evidence quality that later undermines AML, sanctions, and account abuse controls. In Cyprus, organisations need to treat customer identification and due diligence as a governed control set, not a one-time form-filling exercise. Current guidance suggests that the risk rating should drive how much evidence is collected, how identity evidence is validated, and when enhanced due diligence is triggered. The FATF Recommendations – AML and KYC Framework remain the baseline reference for risk-based onboarding and customer due diligence, but local legal obligations and sector rules still determine the operational threshold.

Security teams often get this wrong by equating digital convenience with acceptable assurance. A smooth remote journey can still leave gaps in liveness, document authenticity, beneficial ownership evidence, or auditability of the decision path. For identity and fraud teams, the real issue is whether the onboarding workflow creates defensible confidence in who the customer is, why the relationship is being established, and whether the institution can prove that its checks were proportionate. In practice, many security teams encounter onboarding weaknesses only after suspicious activity, compliance review, or account takeover has already occurred, rather than through intentional control testing.

How It Works in Practice

Non-face-to-face onboarding usually combines documentary, electronic, and risk-based checks so that no single weak signal determines the outcome. Organisations typically start with identity document capture, device and session risk checks, knowledge or possession-based verification, and sanctions and PEP screening. For higher-risk relationships, they add enhanced due diligence, source-of-funds evidence, beneficial ownership review, and manual approval. Where policy allows, stronger controls may also include biometric comparison, liveness checks, or trusted digital identity sources, but best practice is evolving and there is no universal standard for every jurisdictional setup.

Operationally, the key is traceability. Every decision should be reproducible from logs and retained evidence, including what was checked, which rules fired, who approved the case, and what exceptions were accepted. That matters because remote onboarding failures are often not obvious technical defects. They are control design failures. Aligning the workflow to NIST SP 800-53 Rev 5 Security and Privacy Controls helps teams think in terms of identity proofing, access governance, auditability, and retention, even when the legal implementation is different. If customer data is processed across multiple systems, the evidence chain should also show how data minimisation, approvals, and exception handling are enforced.

• Use a documented risk assessment to decide which onboarding checks are mandatory for each customer segment.
• Require step-up verification when document quality, device trust, or behavioural signals are weak.
• Screen against sanctions, PEP, and adverse media before account activation where the law or policy requires it.
• Retain evidence, decision logs, and exception approvals for regulatory review and internal audit.
• Review rules regularly so that fraud patterns, regulatory updates, and local expectations are reflected in the workflow.

These controls tend to break down when onboarding is outsourced across fragmented vendors because evidence, decision authority, and retention obligations become inconsistent.

Common Variations and Edge Cases

Tighter onboarding controls often increase customer friction, manual review volume, and false rejects, requiring organisations to balance conversion against regulatory confidence. That tradeoff becomes especially visible for cross-border customers, thin-file applicants, corporate accounts, and users who lack stable documentary evidence. In those cases, organisations should not assume that one remote process fits all. The right answer may be a segmented workflow with different evidence standards rather than a single universal journey.

There is also a practical distinction between identity verification and ongoing due diligence. A customer may pass initial checks but still require periodic review if their risk profile changes, their transactional behaviour deviates, or the relationship enters a regulated use case. For corporate customers, beneficial ownership and control structure checks can be more important than the signatory’s identity alone. For higher-risk scenarios, a stronger control set may include live-agent review, additional corroborating evidence, or deferred activation until checks are complete. Teams operating in regulated financial services should preserve the rationale for each exception, because regulators usually care less about perfection than about whether the process was consistent, documented, and proportionate to risk.

Related resources from NHI Mgmt Group

• How should organisations decide when a customer needs enhanced due diligence?
• What do organisations get wrong about customer due diligence?
• How should security teams implement customer due diligence without creating too much onboarding friction?
• How should organisations govern API partner onboarding as a non-human identity process?