Continuous identity assurance is replacing one-time KYC checks

At a glance

What this is: This is an analysis of how European identity regulation is pushing customer verification away from one-time KYC checks and toward continuous, event-driven assurance.

Why it matters: It matters because practitioners running customer identity, fraud, IAM and compliance programmes need a model that can react after onboarding, not just at account creation.

By the numbers:

• The European Anti-Money Laundering Authority is required to submit its draft regulatory technical standards on customer due diligence in July 2026.
• The EUDI Wallet must be accepted by regulated businesses under eIDAS 2.0 by 2027.
• Fraudulent payment transactions across the EEA totalled €4.3 billion in 2022, according to the joint ECB/EBA report on payment fraud cited by IDnow.
• By 2024, fraudulent credit transfers had risen 16% year-on-year to €2.2 billion, with card fraud adding another €1.3 billion on top, according to the EBA-ECB’s 2025 payment fraud report cited by IDnow.

Context

Customer identity programmes often fail because they treat verification as a single event instead of an ongoing control. In fraud-heavy environments, that leaves a long gap between the point of proof and the point of risk, especially when device compromise, SIM swap and account takeover happen after onboarding. The shift now visible in Europe is a move from isolated checks to continuous assurance, with stronger links between identity proofing and downstream access decisions.

This is where identity proofing and KYC stops being a front-door exercise and becomes a lifecycle governance problem. The article's core argument is that the real security issue is not whether a customer once passed a check, but whether the business can still trust that identity relationship when conditions change.

Key questions

Q: Why do onboarding checks fail to catch later eKYC fraud?

A: Because fraud often appears after the initial proofing decision, when attackers exploit account changes, transaction requests or weaker review paths. An onboarding-only model assumes trust remains stable, but lifecycle risk changes as soon as the customer starts using the account.

Q: When should organisations re-check customer identity instead of relying on the original KYC result?

A: They should re-check identity when a customer changes payment details, activity patterns, account limits, or any other signal that changes the risk profile. The original KYC result is only valid for the state it covered, not for every future stage of the relationship.

Q: What are the signs that static KYC controls are failing?

A: Common signs include repeated identity artefacts across channels, successful logins after suspicious onboarding, and fraud cases that become obvious only when data is compared with other organisations or prior attempts. If your controls only work at registration, they are probably missing the higher-risk moments where abuse actually happens.

Q: How should teams prepare for eIDAS 2.0, AMLR and PSD3 together?

A: Treat them as one operating change, not three isolated obligations. The practical response is to redesign customer identity assurance so it can accept new evidence types, re-check trust after change events, and support strong authentication and due diligence from the same control model.

Technical breakdown

Why one-time KYC fails after onboarding

A one-time KYC flow answers a narrow question: did this person satisfy the checks at enrolment? It does not monitor for later compromise of the phone, email, device or session that were used to establish trust. That creates a blind spot for account takeover, synthetic identity abuse and post-onboarding fraud. In practice, the verification artefact becomes stale while the relationship remains active, so the control protects only the initial transaction, not the living account. The security problem is temporal: trust is established once, but risk evolves continuously. Systems that cannot re-evaluate trust after a change event are architecturally incomplete for modern fraud conditions. See the NHI Lifecycle Management Guide.

Practical implication: Design customer verification as a continuous lifecycle control, not a one-off onboarding gate.

How event-driven identity assurance works

Event-driven assurance means the identity system reacts when something material changes, such as a device replacement, suspicious login location, credential reset or wallet-based credential update. Instead of re-running full verification on a fixed schedule, the programme uses risk signals to decide when to step up, re-check or restrict. This is closer to trust orchestration than static KYC because the decision is tied to context, not just to the original identity proofing event. For identity teams, the technical shift is from status-based approval to state-based monitoring, where the relationship can be revalidated without forcing a full restart of the onboarding journey.

Practical implication: Trigger re-verification and stronger authentication from risk events rather than calendar intervals.

Why EUDI Wallet acceptance changes identity architecture

The EUDI Wallet introduces a more portable trust layer across the European digital economy, but only if businesses can consume it without rebuilding their verification stack every time the regulation or credential model changes. That means identity architecture has to absorb multiple evidence types, changing assurance levels and new authentication methods without breaking the customer journey. The practical challenge is interoperability: regulated organisations must treat the wallet as one trust signal inside a broader identity relationship, not as a standalone replacement for their existing control stack. This is a governance and architecture problem as much as a regulatory one. See the Digital Identity, eID and Identity Wallets Guide.

Practical implication: Build identity flows that can accept new trust signals without reworking the full customer journey.

Threat narrative

Attacker objective: The attacker wants to assume the customer’s trusted identity relationship well after onboarding and use that trust to move money and expand account control.

1. Entry occurs when a legitimate customer completes initial KYC and receives account access based on a point-in-time identity check.
2. Credential or device compromise follows later, through SIM swap, email compromise or device cloning, giving the attacker the ability to present as the customer.
3. Escalation happens inside the live account, where the fraudster moves funds and adds payees before the original KYC decision is ever revisited.
4. Impact is account takeover and financial fraud that the original onboarding check cannot detect or stop.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

One-time KYC is a conceptual failure in modern fraud governance. The article is right to frame the issue as structural rather than technological. A single verification event cannot govern a relationship that changes over time, especially when device, channel and credential state can all be altered after onboarding. The security control is not failing because it is poorly tuned; it is failing because it was never designed for post-onboarding risk. Practitioner implication: move identity assurance from a checkpoint to a lifecycle control.

Identity relationship management is now the more accurate operating model than identity checking. Continuous assurance reflects how fraud actually behaves in the real world. The important governance shift is that trust must be re-evaluated when the environment changes, not only when the customer first appears. That makes identity evidence, device state and transaction context part of the same control plane. Practitioner implication: align customer trust decisions to change events, not to enrolment alone. See NHI lifecycle management as a useful analogue for lifecycle thinking.

Continuous assurance is the right named concept for this shift. It describes a model where identity confidence is maintained through ongoing signals rather than preserved by a one-time proof. This is increasingly relevant where fraud tools, wallet credentials and strong customer authentication must work together across the full relationship. The article shows that regulators are moving in the same direction, which makes the governance gap harder to ignore. Practitioner implication: build assurance logic that can be re-triggered whenever trust conditions degrade.

European regulation is converging on lifecycle assurance, not static compliance. eIDAS 2.0, AMLR and PSD3 are pushing toward a single trust model that spans onboarding and ongoing use. That matters because programmes built around isolated KYC checks will struggle to demonstrate resilience once continuous verification becomes the expectation. The operational issue is not just meeting a deadline; it is redesigning customer trust so it remains valid after the first login. Practitioner implication: treat regulatory convergence as an architecture redesign trigger.

What this signals

Identity assurance is moving from proof to posture. That shift matters because the control objective is no longer to verify a person once, but to keep confidence current as devices, credentials and risk signals change. Programmes that still treat KYC as a completed task will struggle to keep pace with fraud patterns that evolve after onboarding.

Continuous trust requires continuous governance. eIDAS 2.0 and adjacent regulations are pushing the market toward evidence reuse, event-driven re-verification and stronger linkage between identity proofing and authentication. Teams should expect future customer journeys to look less like a gate and more like a monitored relationship, where the next control decision depends on what changed.

Identity relationship management is the concept practitioners should now operationalise. It means the customer record, authentication state and risk posture are governed together, so a later change can trigger a fresh decision without rebuilding the whole journey.

For practitioners

• Replace one-time KYC with lifecycle verification Map onboarding, re-verification and step-up events into a single customer identity journey so trust can be reassessed after compromise indicators appear.
• Define event triggers for re-verification Trigger review when the customer changes device, logs in from a new geography, resets credentials or shows signs of SIM swap or email compromise.
• Align fraud and compliance controls Make AML, authentication and customer due diligence operate on the same evidence set so compliance decisions reflect live risk, not stale identity proof.
• Prepare for EUDI Wallet acceptance Plan for wallet-based identity evidence as an additional trust signal, with architecture that can accept new verification methods without redesigning the whole journey.

Key takeaways

• The core weakness is not bad onboarding checks but the assumption that trust stays valid after the first verification.
• The article ties that weakness to a large and growing fraud problem, with European payment fraud measured in billions of euros.
• The practical response is to govern customer identity as a live relationship that can be re-verified when conditions change.

Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · NHI Lifecycle Management Guide · Ultimate Guide to NHIs: Regulatory and Audit Perspectives

Key terms

• Continuous Identity Assessment: An approach that evaluates trust after onboarding, not only at account creation. It is especially relevant in marketplaces because risk shifts during recovery, payout changes, and high-value transactions, where a once-trusted identity may no longer deserve the same confidence.
• Identity relationships: Identity relationships are the connections that define which accounts, tokens, agents, systems, and permissions interact with each other. They matter because risk often emerges from the path between identities, not from any single event seen in isolation.
• Event-Driven Re-verification: A verification approach that triggers additional checks when something meaningful changes, such as a device switch, location anomaly or credential reset. It replaces fixed reassessment schedules with decisions based on live risk, which is better suited to fraud and account takeover conditions.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM and secrets management. It is designed for practitioners who need to connect identity control to broader security and compliance decisions.