Because digital checks usually validate documents or eligibility, while the employer’s own identity control confirms the person presenting is the same person the organisation is hiring. In regulated onboarding, those are not interchangeable. The in-person step preserves accountability for the final identity decision and reduces substitution risk.
Why the in-person step still matters when digital checks are available
Digital checks are valuable, but they do not always answer the same question as a live identity check. A document or remote verification flow can confirm that evidence looks valid, yet the employer still needs to decide whether the person standing in front of them is the same person being hired. In regulated onboarding, that final identity decision is part of the control, not a formality.
The in-person step also gives the organisation a clearer accountability point. If a check is delegated entirely to an external workflow, the employer can lose direct assurance over who actually completed the presentation, whether the applicant matched the evidence, and whether any substitution occurred during the process. That is why regulated employers treat the physical check as complementary, not redundant.
For the broader identity proofing context, Identity Proofing and KYC Guide explains why document checks, liveness checks and identity assurance all serve different purposes, and why those controls are often layered rather than interchangeable.
What the employer is actually confirming in a regulated hire
The core issue is substitution risk. A digital process can help establish that a document is authentic or that a remote claim is plausible, but it does not always establish that the applicant and the presented identity are bound together with enough confidence for the organisation’s own risk threshold. The in-person check closes that gap by adding a human-controlled comparison between the person, the evidence and the employment decision.
This distinction matters most where regulation or internal policy requires the employer to demonstrate that it exercised direct judgement, not merely accepted a third-party signal. The employer may need to record that the person was seen, matched to the identity evidence and accepted under a defined standard. In that sense, the in-person step is part of the audit trail for the hiring decision.
That is also why a broader lifecycle view helps. NHI Lifecycle Management Guide covers provisioning, ownership and offboarding discipline, which is useful here because identity controls are strongest when the organisation can show a complete, accountable lifecycle rather than a single verification event.
Why digital checks and live checks work best together
Digital checks are often better at speed, scale and repeatability. In-person checks are better at judgment, exception handling and reducing edge-case ambiguity. When both are used well, the digital step filters obvious problems while the live step resolves the final identity question and discourages impersonation, proxy applicants and document-sharing scenarios.
That layered model is especially important when the consequence of a bad hire is regulatory breach, fraud, or access to sensitive systems. If a process only tests documents, it may miss the fact that the applicant is not the actual subject of those documents. If a process only relies on face-to-face review, it may miss fraud patterns that a document or biometric workflow would have flagged earlier.
For practitioners comparing proofing strength and fraud controls, NIST SP 800-63A-4 Identity Proofing Guide is a useful reference point because it separates evidence, verification pathways and fraud controls instead of treating all checks as one control.
Risk and Threat Considerations
Where regulated hiring is involved, the main risk is identity substitution: the organisation believes it has verified one person, but it has actually onboarded another. That creates downstream exposure in access provisioning, right-to-work or eligibility decisions, and later investigations if the hire cannot be tied back to a defensible identity decision.
Failure mechanism: Digital checks can be satisfied by authentic-looking evidence, remote impersonation, or a mismatch between the presented evidence and the actual applicant. If the organisation has no live identity confirmation, it may never detect that the final hire decision was based on substituted identity evidence.
Impact: A bad identity decision at onboarding can lead to unauthorized employment, compliance failure, fraudulent access, and weak accountability for any later actions taken under that hire’s name.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | IAL — Identity Assurance Level | Regulated hiring turns on assurance that the applicant matches the claimed identity. |
| Recommendation — Match proofing depth to the role's required assurance level and document the final identity decision. | ||
| NIST SP 800-53 Rev 5 | IA-12 — Identity Proofing | The question centers on proving a person is who they claim to be before onboarding. |
| IA-8 — Identification and Authentication (Non-Organizational Users) | Hiring verification concerns an external person being accepted into the organisation. | |
| Recommendation — Require identity proofing evidence that supports the employer's acceptance decision. Use external-user identification and authentication controls to support onboarding checks. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | The subject is about managing identity evidence and acceptance during onboarding. |
| Recommendation — Define identity verification responsibilities and acceptance criteria for onboarding. | ||
| OWASP ASVS | V6 — Authentication | The distinction between evidence checks and person verification is an authentication issue. |
| Recommendation — Separate document validation from the control that binds the person to the asserted identity. | ||
Practitioner Guidance
What to verify: Make sure the organisation’s standard clearly states what the digital check proves and what the in-person check proves. If both are required, the record should show that they are separate control steps with separate decision value, not duplicate paperwork.
Decision rule: If the role or regulator expects the employer to validate the person, not just the documents, keep a live identity step even when remote checks are available. If the process cannot show who performed the final identity judgment, treat that as a control gap.
What good looks like: The onboarding file should show a consistent chain from evidence review to live confirmation to hiring approval, with any mismatch or exception escalated before access or start date is granted.
Practitioner takeaway: Digital checks reduce friction, but they do not automatically satisfy the employer’s duty to make the final identity decision. In regulated hiring, the live check is valuable because it preserves accountability and closes the substitution gap that remote evidence alone can miss.
Related resources from NHI Mgmt Group
- Why do identity and fraud teams still struggle with trust when customer interactions move across digital and in-person channels?
- What breaks when digital ID checks still rely on collecting full identity data instead of just the age result?
- Who is accountable when a digital identity programme handles age verification and other regulated checks incorrectly?
- What breaks when hotel check-in still depends on manual identity checks and queues?