TL;DR: Digital identity has shifted from a transaction check to a real-time control layer for banks as AI fraud, account takeover, and new onboarding channels raise the stakes, according to Alloy. The governance challenge is no longer authentication alone but continuous identity, risk, and fraud coordination across the full customer lifecycle.
At a glance
What this is: Alloy argues that digital identity has become a strategic banking control because fraud, onboarding risk, and AI-driven attack paths now require continuous verification and lifecycle monitoring.
Why it matters: This matters to IAM and fraud teams because identity proofing, authentication, and monitoring now have to operate as one governance model across human and emerging agentic interactions.
Context
Digital identity in banking is the set of controls that bind proofing, authentication, and ongoing monitoring to the same customer journey. As banks expand online services and add AI-enabled experiences, one-time checks no longer cover the fraud and trust decisions that now happen continuously across onboarding and servicing.
The governance gap is that many institutions still treat identity as a point control instead of a lifecycle capability. That model struggles when risk moves across channels, vendors, and transaction types, especially when agentic AI identity becomes part of the trust boundary.
Key questions
Q: How should banks structure identity controls across onboarding and servicing?
A: Banks should treat onboarding, login, servicing, and fraud monitoring as one lifecycle control model. That means proofing, authentication, and KYC draw from shared policy and telemetry, so assurance does not reset at each channel boundary. The main objective is to keep the risk decision current as the customer moves from access to value-bearing actions.
Q: Why do risk-based authentication controls matter more for payments and servicing?
A: Because the highest fraud risk usually appears after a session is established, not at the first login. Risk-based controls let banks raise assurance only when device, behaviour, or transaction context changes, which reduces friction without weakening protection. That makes authentication a live decision engine rather than a one-time gate.
Q: What breaks when identity monitoring is not connected to authentication and fraud controls?
A: When identity monitoring is isolated, teams miss lifecycle changes that often signal takeover or abuse, such as device swaps, phone number changes, or suspicious authorization patterns. The result is fragmented decisioning, slower response, and weaker fraud containment. Security teams lose the ability to correlate signals in real time, which increases the chance that a risky actor can keep moving through the customer journey.
Q: What does Know Your Agent mean for banking governance?
A: It means banks need a way to identify, authorise, and retire non-human actors that can act on a customer’s behalf. The critical questions are who delegated the authority, what actions the agent can take, and how that authority is constrained over time. Without that layer, agentic automation becomes an ungoverned trust extension.
Technical breakdown
Why banking identity has become continuous rather than transactional
Banks used to rely on discrete identity checks at onboarding or login, but modern digital services create a stream of trust decisions. Identity proofing establishes who the customer is, authentication proves they are present, and KYC monitoring watches for changes in behaviour or risk after the account is opened. When those functions are split across teams and tools, the bank gets inconsistent policy, duplicated data, and slow fraud response. The real technical change is that the rules engine now has to operate across the full customer lifecycle, not only at the edge of access. See the Customer IAM (CIAM) Guide.
Practical implication: Treat identity proofing, authentication, and KYC as a single control plane rather than separate programs.
How risk-based authentication changes the trust model
Risk-based authentication adjusts the required assurance level based on context such as device, behaviour, transaction value, and anomaly signals. Instead of requiring the same step every time, the system can step up to MFA, block a transaction, or request additional verification when the risk score changes. This matters because banking fraud is dynamic: account takeover, synthetic identity, and authorised push payment attacks often look legitimate until the last moment. The control works only when telemetry, policy, and response are tightly connected. See the Workforce Identity Security Guide.
Practical implication: Use contextual signals to trigger step-up controls before high-risk actions complete.
Where deepfakes and agentic AI reshape identity assurance
Deepfakes and agentic AI both weaken the assumption that a human voice, face, or session is inherently trustworthy. Deepfake fraud targets the verification moment, while agentic systems introduce non-human actors that may initiate actions, request access, or operate delegated authority. That creates a governance problem for banks: the identity model must distinguish a verified customer from an authorised automation path. The technical question is no longer only whether an interaction is genuine, but whether the actor behind it has the right authority for the requested action. Read AI Agents vs Agentic AI.
Practical implication: Extend identity governance to cover delegated and automated actors, not just human logins.
Threat narrative
Attacker objective: The attacker aims to move money, hijack customer accounts, or abuse trusted identity workflows before the bank can validate the action in real time.
- Entry begins with synthetic identity creation, account takeover, or deepfake-assisted social engineering that passes superficial checks.
- Credential access or trust abuse follows when the attacker uses weak step-up controls, stale assurance, or delegated authority to reach sensitive servicing actions.
- Escalation occurs as the attacker moves from login access into payments, account changes, or fraud workflows that were not tied tightly enough to identity assurance.
- Impact is financial loss, consumer trust damage, and broader fraud propagation across channels and institutions.
Breaches seen in the wild
- Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Digital identity is now a lifecycle governance problem, not a login problem. Banks that keep proofing, authentication, and KYC in separate operational lanes create policy drift and response latency. The article’s core insight is that trust decisions now happen across onboarding, servicing, and payment authorisation, so identity governance has to span the whole customer journey. Practitioners should treat continuous verification as the operating model, not the exception.
Verification trust gap: The article points to a widening gap between what banks think they have verified and what their fraud systems can still trust later in the journey. That gap grows when AI-generated fraud, deepfakes, and mobile channels introduce higher-quality deception into the same controls that were built for simpler web sessions. Practitioners should close that gap by aligning verification strength to downstream transaction risk.
Agentic AI turns customer identity into delegated authority management. Once a bank allows an agent to act on behalf of a customer, the problem is no longer only Know Your Customer but Know Your Agent and the scope of authority granted to it. Agentic AI identity becomes relevant because delegation, registration, and retirement now matter as much as authentication. Practitioners should define how non-human actors are enrolled, limited, and revoked before they are trusted in production.
Strong customer authentication is becoming an orchestration issue, not a single-factor issue. The article shows that banks need to link identity proofing, risk-based step-up, and transaction binding into one decision flow. That aligns with broader identity governance thinking: assurance has to be recalculated at the moment of value transfer, not cached from a prior check. Practitioners should redesign authentication as a policy engine for high-risk actions, not a fixed checkpoint.
From our research library:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Read next: Agentic AI Identity Guide
What this signals
Digital identity governance is converging with fraud operations. Banks can no longer separate identity assurance from fraud detection when the same customer journey now includes onboarding, servicing, payments, and delegated automation. The programme implication is that policy, telemetry, and response need a single decision path, or the bank will keep detecting risk after the value transfer has already happened.
Verification trust gap: The key failure mode is not weak verification alone but stale trust carried forward from a previous step. Once a customer or agent is accepted, downstream actions often inherit that earlier decision even when the context has changed. Banks should watch for any control design that treats proofing as permanent rather than revisitable.
Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption. That gap matters for financial services because delegated automation can become part of the customer journey before governance is ready. Banks should assess whether their identity model can distinguish human intent, delegated authority, and machine-executed action before they scale AI-enabled servicing.
For practitioners
- Unify proofing, authentication, and KYC decisions Build a shared rules engine so onboarding, login, servicing, and fraud review use the same risk signals and policy outcomes.
- Bind step-up controls to transaction risk Trigger stronger verification when payment value, device context, or behavioural anomalies cross policy thresholds rather than on static schedules.
- Add explicit governance for agent-mediated actions Define how delegated or automated actors are registered, what authority they receive, and how that authority is revoked or constrained.
- Test fraud scenarios across channels and vendors Exercise account takeover, synthetic identity, and deepfake-assisted payment paths end to end so response teams can see where controls break under real operating conditions.
Key takeaways
- Digital identity in banking now spans proofing, authentication, fraud monitoring, and delegated authority rather than a single access event.
- The main risk is governance fragmentation, where separate teams and tools fail to keep assurance current as customers move across channels and services.
- Banks need lifecycle identity controls that can re-evaluate trust at the moment of transaction, especially when AI-driven fraud and agentic automation are in play.
Related NHI Mgmt Group resources: Agentic AI Identity Guide · Deepfakes, Social Engineering and AI Impersonation Guide · Customer IAM (CIAM) Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST CSF 2.0 and NIST AI RMF set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article centres on identity proofing as one of the three core banking capabilities. |
| SP 800-63B — Authentication | Risk-based authentication and step-up controls are central to the article's banking model. | |
| Recommendation — Align onboarding and proofing workflows to SP 800-63A so customer identity assurance is established before account activation. Apply SP 800-63B to bind authentication strength to contextual risk and transaction sensitivity. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article emphasises consistent authorisation across banking journeys and delegated actions. |
| Recommendation — Use PR.AA-05 to keep authorisations consistent across channels, services, and delegated access paths. | ||
| GDPR | Art.32 — Security of processing | The article discusses identity and fraud controls that process personal data and require security safeguards. |
| Recommendation — Implement appropriate technical and organisational measures under Art.32 for identity, fraud, and authentication data. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | Agentic AI appears as a new trust boundary that needs governance and accountability. |
| Recommendation — Establish AI governance roles that define delegated authority and accountability for agentic identity use cases. | ||
Key terms
- Digital identity management: The governance of how identities are created, verified, authorised, monitored, and retired across their full lifecycle. It covers people, machines, and cloud access paths, with the goal of ensuring access is both usable and accountable.
- Risk-Based Authentication: An access model that changes verification requirements based on the estimated risk of the request. It combines identity assurance, device posture, application sensitivity, and contextual signals to decide whether to allow, block, or step up verification before access is granted.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
- Delegated Authority Model: A delegated authority model defines who is allowed to approve, review, or execute control-related decisions across the enterprise. It helps ensure requests reach the correct responsible party, especially when control owners, managers, and process owners sit in different teams, regions, or systems.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect identity governance to modern banking, automation, and access risk.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org