How should organisations combine eKYC with strong authentication in customer onboarding workflows?

Organisations should treat eKYC and strong authentication as complementary controls, not substitutes. eKYC establishes confidence in who is being onboarded, while strong authentication helps protect ongoing access to applications and workflow steps. The practical goal is to reduce identity fraud, limit account takeover risk, and keep digitised onboarding usable without forcing every transaction into a manual review path.

Why eKYC and strong authentication solve different onboarding problems

eKYC and strong authentication address different stages of trust, so organisations need both if they want onboarding to be both friction-aware and defensible. eKYC is about verifying the claimed person before issuance or activation, while strong authentication is about proving the same person, or the same approved account holder, is still present when access is later used. For customer onboarding, that distinction matters because the main failure is not just fake applications, but also account takeover after a legitimate start. FATF’s AML and KYC framework is relevant here because it frames onboarding as a customer-due-diligence problem, not merely an authentication one.

Teams often overcorrect by making onboarding either too manual or too weak. If eKYC is treated as a one-time gate with no robust authentication follow-through, the organisation can still lose the account to session hijacking, credential theft, or delegated access abuse. If strong authentication is added without a reliable identity proofing step, the organisation may simply create a more secure path for the wrong person. In practice, many organisations discover this only after fraud patterns show that the weakest point was the handoff between identity verification and first use, rather than either control in isolation.

How the controls should fit together in the workflow

The cleanest design is sequential but not rigid: eKYC should establish the onboarding decision, and strong authentication should protect the actions that follow from that decision. That usually means the organisation first collects and validates identity evidence, performs risk-based checks, and decides whether the applicant can be accepted, stepped up, or routed to manual review. Once the customer is accepted, the onboarding journey should require authentication that is proportionate to the sensitivity of the account, the channel being used, and the risks of fraud or impersonation.

In practical terms, the workflow should avoid treating verification and authentication as the same event. eKYC may rely on document checks, liveness checks, database validation, or other identity assurance methods. Strong authentication then helps prove continuity of control during account creation, profile changes, payment setup, password reset, and other high-value steps. That separation is especially important when onboarding is asynchronous, when the application is completed on one device and activated on another, or when a human operator approves exceptions later in the process.

Use eKYC to decide whether the customer can be trusted enough to create an account or enter a controlled funnel.
Use strong authentication to protect any later step that changes contact details, recovery methods, limits, or linked payment credentials.
Keep step-up rules tied to the actual risk of the action, not to a generic one-size-fits-all journey.
Retain evidence that shows which checks were passed, which were bypassed, and why an exception was accepted.

Where the workflow breaks down is when organisations let a successful proofing event stand in for ongoing session assurance, or when they demand repeated high-friction checks for low-risk actions and degrade completion rates without reducing fraud.

Where onboarding edge cases create the most friction and risk

Tighter onboarding controls often reduce fraud, but they also increase abandonment, exclusion, and operational review overhead, so organisations must balance assurance against conversion and accessibility. That trade-off becomes visible in edge cases such as minors, thin-file customers, cross-border applicants, reused devices, shared phones, and customers who fail automated checks for benign reasons.

One common variation is the split between initial proofing and later step-up. A customer may pass eKYC yet still need stronger authentication before first transfer, device enrolment, or profile recovery. Another edge case is where regulation or internal policy requires different levels of proofing for different products, channels, or jurisdictions. In those cases, the correct answer is usually not to weaken the controls, but to separate baseline onboarding from higher-risk activation steps and document the policy for each path. eIDAS 2.0 is useful as a reference point for digital identity assurance because it shows how assurance levels and wallet-based identity concepts can change the way onboarding trust is structured in practice.

Teams should also be careful not to overgeneralise “strong authentication” into a single mechanism. A phishing-resistant factor is materially different from a basic one-time code, especially where account recovery or session takeover would be high impact. Organisations that use the same authentication pattern for proofing, login, and recovery often miss the place where attackers actually enter.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-63	IAL — Identity Assurance Level	eKYC is fundamentally identity proofing and assurance selection.
	AAL — Authenticator Assurance Level	Strong authentication determines how securely the customer can prove control later.
Recommendation — Map onboarding proofing strength to the appropriate IAL before issuing account access. Require an AAL that matches the risk of login, recovery, and high-value account actions.
NIST CSF 2.0	PR.AA — Identity Management, Authentication, and Access Control	The question combines proofing with ongoing access control across onboarding.
	RS.MA — Mitigation and Recovery	Fraud and takeover handling must be built into onboarding exceptions and recovery.
Recommendation — Align proofing and authentication controls under one access governance model. Build recovery and exception handling so failed onboarding does not become account takeover.
CIS Controls v8	6 — Access Control Management	Onboarding must enforce who can access and what can be changed after activation.
	5 — Account Management	Customer onboarding creates accounts, recovery paths, and lifecycle dependencies.
Recommendation — Apply Control 6 to separate verified onboarding from ongoing access permissions. Use Control 5 to govern account creation, activation, and recovery steps.

Practitioner Guidance

What to prioritise: Design the workflow around the highest-risk state transition, not around the first successful check. The important question is where a fraudulent applicant or compromised customer could gain durable control after onboarding, because that is where eKYC and authentication must work together.

Decision rule: If a step can create, change, or recover an account, treat it as higher risk than ordinary login and require stronger authentication or a separate approval path. If the step only supports low-risk navigation, keep the friction lower so the onboarding journey remains usable.

What to verify: Confirm that the organisation can still prove who was verified, how they were authenticated later, and whether any exception was accepted by a human. Without that evidence, teams usually cannot distinguish a failed proofing control from a later account takeover.

Common mistake: Using a single “verified” label for both identity proofing and authentication assurance. That shortcut hides whether the customer was merely identified once or whether the account remains protected throughout its lifecycle.

Practitioner takeaway: The strongest onboarding design treats eKYC as the start of trust and strong authentication as the control that preserves it, with different rules for approval, activation, recovery, and high-value account changes.