TL;DR: Identity, payments and digital onboarding are converging across KYC and authentication, according to Daon, while EU digital wallet adoption will force banks to accept new credentials and cross-channel authentication. The governance challenge is no longer channel consistency alone; it is proving trust across physical and digital onboarding paths.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Daon's blog post: Digital onboarding, payments and identity are converging, and banks will need to govern trust across KYC, authentication and cross-channel onboarding.
Why it matters: This matters because practitioners must align identity proofing, payment authentication and fraud controls across channels before wallet-based and cross-border identity use cases become routine.
Context
Digital onboarding now sits at the intersection of identity assurance, payment authentication and fraud control. When customers can start in branch and finish in an app, or vice versa, the control problem shifts from a single onboarding flow to a governed trust fabric across channels.
The move toward government-issued digital wallets raises the bar again because banks will need to recognise credentials they do not issue themselves. That creates an identity trust framework problem, not just a user-experience problem, and it is where digital identity guidelines become operationally relevant.
Key questions
Q: How should banks govern digital wealth onboarding access across channels?
A: Banks should govern digital wealth onboarding as a sequence of identity checkpoints, not a single login event. The same person or service may need different rights to collect data, validate documents, approve suitability and activate accounts. Strong governance assigns ownership to each checkpoint, records handoffs and limits who can progress a client from one stage to the next.
Q: Why does wallet-based identity change banking governance as well as user experience?
A: Because the bank is no longer only authenticating a customer at login. It is issuing portable credentials, deciding when they can be reused, and defining how revocation works across downstream reliance. That turns identity into a lifecycle governance problem, not just an authentication channel upgrade.
Q: What is the best way to stop fraud in cross-channel onboarding?
A: The best way is to bind the applicant to one verified identity record across web, mobile, call centre and branch flows, then compare device signals, document checks, biometrics and transaction history against a full evidence chain. Step-up verification, liveness detection, and manual review for mismatches stop synthetic identity and account takeover fraud.
Q: How do payment authentication and KYC need to work together?
A: They need to share the same risk view so payment authentication can confirm the transaction is low risk while KYC establishes who the customer is and whether the identity can be trusted. Linking device intelligence, behavioural signals and identity proofing lets step-up controls, such as OTP, biometrics or transaction review, target the same person and event.
Technical breakdown
Cross-channel identity orchestration in onboarding
Cross-channel orchestration is the control layer that keeps proofing, device signals and authentication consistent when a journey moves between branch, web and mobile. The main challenge is not verifying identity once, but preserving assurance when evidence is collected in different places and at different times. That requires the onboarding system to carry risk context forward instead of restarting the trust decision in each channel. See the Customer IAM (CIAM) Guide.
Practical implication: Map every onboarding path to a single assurance model so a customer does not receive weaker checks simply because they switch channels.
Wallet-based authentication and federated trust
A digital wallet changes authentication because the user presents a credential issued by a trusted authority rather than relying only on bank-native identifiers. That creates federation and trust-establishment questions: how the bank validates the wallet, how assurance is represented, and how the bank binds the wallet to its own account lifecycle. In practice, this is closer to identity federation than to a simple login upgrade. See the NIST SP 800-63 Digital Identity Guidelines Guide.
Practical implication: Treat wallet acceptance as a federation design exercise, with explicit rules for assurance, binding and recovery.
Fraud controls at the point of proofing
When onboarding can begin physically and end digitally, fraud controls have to inspect the evidence chain, not just the final document. NFC chip reads, biometric checks and device signals each reduce risk, but none of them is sufficient on its own if the workflow allows a fraudulent enrolment to inherit trust too easily. The technical issue is binding the presented credential to the right person and the right device at the right moment.
Practical implication: Require fraud review at the evidence-binding stage, not only at account activation.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity onboarding is becoming a trust orchestration problem, not a form-filling problem. Once a customer can move between branch, mobile and web during the same journey, the bank has to preserve evidence quality across each handoff. That changes the control objective from completing KYC to maintaining assurance continuity, which is a different governance model altogether. Practitioners should design onboarding as a chain of trust decisions, not a sequence of disconnected screens.
The arrival of wallet-based identity will expose weak federation assumptions. Accepting a government-issued wallet means the relying party must trust the issuing ecosystem, the credential presentation and the recovery path. That is a federation problem with fraud consequences, because a weak binding or recovery process can turn an apparently strong credential into an account takeover path. Banks should treat wallet acceptance as a formal trust framework decision, not a front-end integration.
Verification trust gap: the real risk is the distance between initial proofing and later authentication, especially when a customer is first verified in one channel and later reuses that trust in another. The article points to a market where identity, payments and device signals are being combined, but the governance lesson is broader: assurance must remain valid across the whole lifecycle. Practitioners should close the gap between proofing and ongoing authentication before cross-channel journeys become the default.
Cross-border digital identity will force banks to distinguish recognition from assurance. A wallet issued in one member state may be usable elsewhere, but usability does not automatically mean equal trust. Cross-border onboarding needs policy for assurance levels, issuer trust and exception handling, otherwise interoperability becomes a fraud exposure. Security teams should define what is recognised, what is trusted and what requires step-up verification.
Payment authentication and identity proofing are converging into one control surface. When the same identity credential is used both to onboard a customer and to authorise payment activity, weaknesses in either workflow can affect the other. That increases the value of a unified control model across IAM, KYC and fraud operations. Practitioners should align those teams around one assurance view instead of separate risk decisions.
What this signals
Identity proofing and ongoing authentication are now one programme. Banks that still separate onboarding risk from login risk will struggle as wallet credentials and cross-channel journeys become normal. The programme implication is straightforward: the assurance decision made at enrolment must remain defensible when the same identity is used later to authenticate payments or access accounts.
Verification trust gap: the biggest governance weakness is the handoff between a verified identity and a later relying-party authentication. If the organisation cannot explain why a credential remains trustworthy after channel changes, the control design is incomplete. That is where identity governance, fraud operations and customer authentication need a shared policy model.
As digital wallets and cross-border identity use cases expand, trust decisions will become more policy-driven and less channel-specific. Security teams should prepare for explicit issuer trust lists, assurance mapping and exception handling, because interoperability without governance simply moves the fraud boundary rather than closing it.
For practitioners
- Align KYC and authentication policies Use one assurance model for onboarding, account access and step-up checks so channel changes do not weaken identity proofing or payment authentication.
- Define wallet acceptance rules Set explicit criteria for issuer trust, assurance level, credential binding and recovery before accepting government-issued digital wallets.
- Strengthen cross-channel fraud review Review the evidence chain across branch, mobile and web journeys so biometric, document and device signals are assessed together.
- Coordinate identity and payments teams Create a shared operating model for customer onboarding, account authentication and payment confirmation so policy decisions stay consistent.
Key takeaways
- The core risk is not just onboarding fraud but inconsistent trust decisions across branch, mobile and wallet-based journeys.
- The article points to a broader convergence of identity, payments and authentication that forces a shared governance model.
- Practitioners need to align assurance, issuer trust and evidence binding before cross-channel onboarding becomes the default operating model.
Related NHI Mgmt Group resources: NIST SP 800-63 Digital Identity Guidelines Guide · Identity Proofing and KYC Guide · Customer IAM (CIAM) Guide · Digital Identity, eID and Identity Wallets Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63 and NIST CSF 2.0 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article centres on onboarding and identity proofing across physical and digital channels. |
| SP 800-63C — Federation | Wallet acceptance and cross-border trust depend on federated identity relationships. | |
| Recommendation — Apply SP 800-63A to structure proofing evidence, assurance levels and enrolment decisions across channels. Use SP 800-63C to define how wallet credentials are trusted, bound and accepted by relying parties. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Cross-channel authentication and account access depend on consistent permission and authorisation policy. |
| Recommendation — Align authentication policy with PR.AA-05 so access decisions stay consistent across onboarding and login channels. | ||
| GDPR | Art.32 — Security of Processing | Digital onboarding and identity evidence handling involve personal data and security of processing obligations. |
| Recommendation — Protect onboarding data under Article 32 by limiting exposure, strengthening verification workflows and securing identity evidence. | ||
Key terms
- Digital Onboarding: Digital onboarding is the process of establishing trust in a new customer, business, or account through online identity verification and risk checks. In regulated environments it usually combines identity proofing, fraud screening, and compliance review so the organisation can decide whether to accept, hold, or reject the relationship.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
- Federation: Federation is the arrangement that lets one organisation accept identity assertions from another trusted identity provider. It reduces separate credentials, but it also creates dependency on token validation, trust configuration and certificate or key management. Defenders should check claims, audience restrictions, signing keys and trust relationships.
- Digital Wallet: A digital wallet is a secure software container used to store, protect, and present credentials or identity attributes. In modern identity flows, it acts as the user-controlled presentation layer between the issuer and the verifier, and its behaviour affects consent, assurance, and privacy.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity and secrets management. It is designed for practitioners who need to connect identity controls to broader security and risk decisions.
Published by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org