What Is One-And-Done KYC? Definition & Examples

One-and-done KYC is a model where a user completes verification once and then reuses that verified identity across approved services. The approach aims to reduce repeated onboarding checks, lower friction, and make account opening faster, while still relying on trusted verification, policy controls, and interoperability between platforms.

How One-and-Done KYC Works

One-and-done KYC shifts verification from repeated, service-by-service onboarding to a reusable identity decision. In practice, a trusted provider or ecosystem verifies the user once, then other approved services accept that assurance instead of starting from scratch.

This model is attractive because it reduces friction, shortens account opening, and can improve conversion. It also depends on a clear trust chain: the relying service must know who performed the original verification, what evidence was checked, and under what policy the result can be reused.

Because the model is based on reuse, the design question is not only whether the user was verified, but whether that verification remains valid for the next service, the next jurisdiction, and the next risk tier. A reusable identity that is too permissive can quickly become a weak control rather than a convenience.

Trust, Interoperability, and Policy Boundaries

One-and-done KYC only works when participating services agree on the meaning of “verified.” That usually means shared standards for identity proofing, consistent data attributes, and explicit rules for when a prior verification can be accepted without repeating the full process.

Interoperability is the core enabler. Without common formats and trust frameworks, a prior check may be informative but not transferable. With them, a provider can expose a verified identity signal that another platform can rely on while still applying its own product, geography, or risk-policy filters.

The practical boundary is that reuse should not erase local obligations. A service may accept the same verified identity while still performing its own sanctions screening, transaction monitoring, age checks, or enhanced due diligence when risk conditions change. For AML and customer due diligence expectations, the broader policy model is reflected in FATF Recommendations, the AML and KYC framework.

Where the Model Improves User Experience

The main benefit of one-and-done KYC is removal of duplicate onboarding work. A user who has already proven their identity can move faster into new products, which reduces abandonment and lowers support burden for organisations that otherwise repeat the same checks.

This is especially useful where the same person must open multiple accounts across related services, such as a financial platform ecosystem or a regulated marketplace with several approved partners. It can also help reduce stale data and repeated manual review, provided the original evidence remains trustworthy and traceable.

For organisations designing cross-border or multi-service identity flows, the model aligns with the direction of reusable digital identity frameworks such as eIDAS 2.0, the EU Digital Identity Framework, which formalises interoperable identity assurance and digital wallet-based trust.

Risk and Threat Considerations

Reuse creates concentration risk: if the original verification is weak, outdated, or compromised, every service that trusts it inherits the same flaw. The model can also amplify fraud if an attacker successfully impersonates a user once and then reuses that assurance across multiple platforms.

Failure mechanism: the system treats a prior KYC outcome as durable proof of identity without enough revalidation, provenance tracking, or change detection. That can let stolen, synthetic, or misbound identity evidence propagate through the ecosystem.

Impact: a single compromised or poorly governed verification can unlock repeated account opening, enable fraud at scale, and create compliance exposure when relying services cannot show why a reused identity signal was still valid.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, CIS Controls v8, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.OV-01 — Organizational Context	Reusable KYC depends on governed trust boundaries and approved reliance rules.
	PR.AA-01 — Identities and Credentials Are Issued, Managed, Verified, Revoked, and Audited	One-and-done KYC relies on a managed identity assertion that can be accepted by other services.
	PR.AA-03 — Identity Assertions Are Protected	The model only works if the verified identity signal is protected from tampering and misuse.
Recommendation — Define who may reuse KYC results and under what trust conditions. Manage the original verified identity record with clear issuance, revocation, and auditability. Protect reusable identity assertions against alteration, replay, and unauthorized reuse.
CIS Controls v8	6.1 — Establish an Asset Management Process	Reusable KYC requires knowing which services rely on the shared identity source.
	6.8 — Unapproved Assets	Unapproved reuse paths can bypass the intended KYC trust model.
	8.1 — Use Strong Passwords	KYC reuse still depends on secure account access after onboarding, even though verification is shared.
Recommendation — Maintain an inventory of relying services and the identity evidence each one accepts. Block ad hoc acceptance of KYC assertions outside approved relying services and policies. Require strong authentication for the account that consumes the reused KYC result.
NIST Zero Trust (SP 800-207)	4.1 — Policy Engine	Relying parties need policy decisions about when a prior verification may be trusted.
	4.2 — Policy Administrator	Reusable identity decisions need controlled administration of trust and acceptance rules.
Recommendation — Apply centralized policy decisions for when a KYC assertion can be reused. Administer acceptance rules so reuse follows approved trust policy, not convenience alone.
NIST SP 800-63	3.1.1 — Identity Proofing	One-and-done KYC builds directly on identity proofing and evidence collection.
	3.2.1 — Authentication Assurance	A reused identity must still be bound to a reliable authentication mechanism at login.
Recommendation — Anchor reuse in the identity-proofing assurance level originally achieved. Ensure the verified identity is still protected by appropriate authentication assurance.

Practitioner Guidance

Governance implication: treat one-and-done KYC as a trust framework, not just a UX feature. The key decision is which assurance attributes may be reused, for how long, and under what conditions a service must step back up to fresh verification.

Practitioners should also be clear about ownership of the underlying verification record. If multiple services depend on the same assertion, there must be a defined source of truth, an audit trail for acceptance, and a rule for revocation when the original identity evidence changes or becomes suspect.

Practitioner takeaway: the more reusable the identity decision, the more important it becomes to control provenance, expiry, and policy drift.

One-And-Done KYC