They should do both, but continuous assurance usually provides more value once onboarding controls are already in place. Strong onboarding reduces bad entries, while continuous assurance catches identity drift, mule behaviour and post-opening exploitation that point-in-time verification will miss.
Onboarding checks answer the entry problem, but not the whole identity problem
Strong onboarding is the first gate, and in banking it matters because bad identity proofing at account opening can create fraud, synthetic identities and compliance exposure. It is the point where you decide whether the customer record should exist at all, so weaknesses here are expensive to unwind later. For banks, the question is not either-or, because onboarding and ongoing assurance address different failure modes.
For customer identity proofing and KYC, Identity Proofing and KYC Guide is the most direct internal reference for the onboarding side of the control model, while NIST SP 800-63 Digital Identity Guidelines provides the external assurance lens for identity proofing and authenticator strength.
What matters operationally is that onboarding is mostly about admission control, while continuous assurance is about keeping the identity record trustworthy after opening. Once an account is live, customer behaviour, device signals, contact details, payment patterns and beneficial-owner relationships can change in ways that point-in-time checks will miss. That is why continuous assurance becomes more valuable after a bank has already built a reasonable onboarding baseline.
Why continuous assurance catches the cases onboarding cannot
Continuous assurance is the better control when the risk is identity drift, mule activity, account takeover support or post-opening exploitation. A legitimate-looking customer can become a fraud channel later, especially when credentials are reused, devices change, or the account is quietly repurposed. Onboarding cannot see those later changes, so banks need monitoring and review processes that reassess identity confidence over time.
This is especially important where the bank is managing ongoing customer risk, because FATF Recommendations and EBA AML/CFT Guidance both point banks toward continued customer due diligence rather than one-time verification.
Continuous assurance also reduces the time window in which compromised identities can be abused. If a customer account is opened cleanly but later shows signs of synthetic linkage, proxy use, unusual beneficiary changes or repeated step-up challenges, the bank needs a live control, not a historic onboarding file. That is the practical gap continuous assurance closes.
What good bank practice looks like in a layered identity model
The right operating model is layered. Use stronger onboarding to reduce false starts, then use continuous assurance to keep confidence current for the full customer lifecycle. Banks should think in terms of risk-based triggers, not constant heavy friction for every customer. Higher-risk accounts, higher-value products, cross-border behaviour and unusual change events deserve more frequent or more stringent reassessment.
IAM and IGA Basics is useful internally for the broader governance pattern, because it frames access review, entitlement governance and lifecycle thinking that banks can adapt to customer assurance. Joiner-Mover-Leaver (JML) Guide is also relevant as a lifecycle analogue: the value is not just entering cleanly, but keeping records, roles and access aligned as the relationship changes.
For banks, the most defensible approach is to treat onboarding as a prerequisite and continuous assurance as the control that protects the account after trust has been granted.
Risk and Threat Considerations
Weak onboarding lets bad identities in; weak continuous assurance lets good-looking identities turn bad over time. The highest-risk failures are not always obvious fraud at account opening, but slow drift, mule recruitment, takeover support, and changes in behaviour that bypass a one-time check. That is why the risk increases as soon as the customer relationship becomes active and valuable.
Failure mechanism: Point-in-time verification cannot detect later changes in customer control, device environment, payment behaviour, or identity linkage, so a valid opening event can be followed by abuse that looks legitimate until damage is done.
Impact: Banks can miss mule activity, account takeover support, sanctions or AML exposure, and downstream financial loss, while still appearing compliant at onboarding time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | IA-2 — Identity Proofing and Enrollment | Onboarding checks directly involve proving identity at account opening. |
| IAL2 — Identity Assurance Level 2 | Bank onboarding often needs higher assurance for remote customer identity proofing. | |
| Recommendation — Strengthen enrollment and proofing controls before issuing access or trust. Set identity assurance targets by product and risk level. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Continuous assurance depends on managing credentials and authenticators over time. |
| AU-6 — Audit Review, Analysis, and Reporting | Continuous assurance relies on reviewing identity and behaviour signals for drift or abuse. | |
| Recommendation — Rotate, revoke, and monitor authenticators throughout the customer lifecycle. Correlate identity events and review anomalies for ongoing assurance. | ||
| NIST CSF 2.0 | PR.AA-05 — Authenticator Management | Banks need governed authenticator lifecycle controls to support continuous assurance. |
| GV.OC-03 — Legal, Regulatory, and Contractual Requirements Are Understood and Managed | Bank onboarding and ongoing assurance are shaped by AML/KYC and customer due diligence duties. | |
| Recommendation — Manage authenticators so identity trust remains current after onboarding. Map onboarding and monitoring controls to regulatory obligations. | ||
| OWASP ASVS | V6 — Authentication | Identity proofing and step-up checks are part of robust authentication design. |
| Recommendation — Require stronger authentication for risky or changed account states. | ||
Practitioner Guidance
What to prioritise: Use stronger onboarding to stop obvious bad entrants, but do not treat it as the main defence once an account is live. Continuous assurance should be risk-tiered so the highest-value or highest-risk relationships get the most scrutiny.
What to verify: Confirm that the bank can re-evaluate identity confidence after onboarding using events that matter, such as device changes, contact changes, payee additions, unusual transaction patterns, and ownership or control changes. If those signals are not monitored, the assurance model is incomplete.
Decision rule: If onboarding is already reasonably strong, invest the next dollar in continuous monitoring and review before adding more friction at the front door. If onboarding is weak, fix that first, because continuous assurance cannot compensate for a broken admission process.
Practitioner takeaway: Banks should optimise for lifecycle trust, not just entry trust, because the biggest identity failures in finance often happen after the account has already been opened.
Related resources from NHI Mgmt Group
- When should teams prioritise continuous checks over stronger onboarding controls?
- What is the difference between static onboarding checks and lifecycle identity assurance?
- Why do digital onboarding programmes need stronger identity checks as volume increases?
- How should online gaming operators balance faster onboarding with stronger identity checks and fraud controls?