eIDAS 2.0 high confidence certification raises the bar for IAM

At a glance

What this is: This is a certification update showing that SumSub’s person and business verification modules now align with the highest eIDAS 2.0 confidence level for regulated onboarding in Europe.

Why it matters: It matters because IAM and identity-proofing teams need to separate assurance claims from implementation reality when designing onboarding, fraud controls, and compliance workflows for customers and businesses.

Context

eIDAS 2.0 high confidence certification is a signal about assurance, not just feature coverage. In practice, it tells regulated organisations that a verification flow has been assessed against the highest European confidence threshold for digital identity, which changes how onboarding, fraud resistance, and compliance evidence are evaluated.

For IAM, KYB, and customer identity teams, the important question is whether the assurance level matches the risk of the transaction and the regulatory burden of the sector. A certified workflow may reduce friction, but it also sets expectations for auditability, identity proofing rigor, and how much manual intervention remains acceptable.

Key questions

Q: How should security teams use high-assurance identity certification in onboarding governance?

A: Use it as one input to onboarding design, not as a blanket trust decision. Security teams should map the certification level to transaction risk, sector rules, evidence retention, and exception handling so that assurance claims remain defensible under audit and fraud review.

Q: Why do automated document checks still need governance after certification?

A: Because certification does not remove the need to understand what the automation proves and what it merely infers. Automated checks can improve scale, but organisations still need traceable evidence, fraud escalation paths, and rules for manual override when the workflow reaches an edge case.

Q: What breaks when person and business verification are governed separately?

A: The onboarding decision becomes fragmented. Teams may prove an individual, validate a company, and satisfy AML checks in different systems, but they then struggle to explain the full trust chain, assign ownership, or show consistent evidence when regulators or auditors ask for the complete picture.

Q: What should IAM teams do when a verification flow claims the highest confidence level?

A: They should tighten policy around overrides, retention, and review. A high-confidence flow raises the expectation that exceptions are rare, justified, and logged, so governance needs to focus on where the process can still fail rather than assuming certification alone is enough.

How it works in practice

What eIDAS 2.0 High Level of Confidence means for identity proofing

High Level of Confidence is the strongest assurance tier used in the eIDAS 2.0 context for identity verification. It is not the same as a general security claim, because it speaks to how reliably a system can identify natural or legal persons under regulatory scrutiny. That distinction matters for onboarding workflows that must satisfy both anti-fraud and compliance expectations. When verification becomes a regulated trust decision, the quality of the proofing method, the traceability of the evidence, and the consistency of the control become just as important as the user experience.

Practical implication: Practitioners should map assurance tiers to onboarding risk and avoid treating certification as a substitute for their own evidence model.

Why automated eMRTD reading changes verification design

An eMRTD workflow reads an electronic machine-readable travel document and uses that data in the verification process without a manual agent review. That reduces human bottlenecks, but it also changes where control confidence comes from: document integrity, reading accuracy, fraud detection, and orchestration become more important than reviewer discretion. In regulated environments, automation only helps if the organisation can show that the automated step preserves evidentiary quality and does not create an opaque decision point in the identity journey.

Practical implication: Teams using automated document checks should validate the evidence chain, not just the user conversion impact.

How KYB and person verification now converge under regulated onboarding

The article links individual verification, business verification, AML compliance, and Qualified Electronic Signature journeys into one regulated onboarding pattern. That is important because the identity problem is no longer just proving a person is real. It is also proving that the business behind the transaction is legitimate and that the workflow can stand up across multiple compliance checkpoints. When one platform spans both person and business proofing, governance has to follow the full lifecycle of the onboarding decision, not just the front door step.

Practical implication: Identity teams should govern person and business verification together, because regulatory onboarding now depends on both control planes.

NHI Mgmt Group analysis

Assurance certification is becoming a governance control, not a marketing label. In regulated onboarding, the question is no longer whether a verification product can process an identity request, but whether its assurance level is defensible under audit and fraud pressure. eIDAS 2.0 High Level of Confidence creates a common language for that scrutiny, and organisations should treat it as part of control design rather than procurement decoration.

High-assurance identity proofing now spans people, businesses, and documents in one control surface. The article shows why identity governance can no longer stay split between consumer onboarding, KYB, and document verification. Regulated businesses need one assurance model that covers natural persons, legal persons, and the evidence that ties them together, or the weakest step becomes the compliance failure point.

Automated verification is only as strong as the evidence chain behind it. Fully automated eMRTD reading reduces manual handling, but it also removes a human reviewer from the trust path. That means organisations must place more weight on document integrity, decision traceability, and exception handling, because the control now lives in the machine workflow rather than the analyst queue.

eIDAS 2.0 is pushing IAM toward regulated identity orchestration. The article reflects a broader shift in which identity proofing, AML checks, and qualified signature journeys are being assembled into a single onboarding process. That convergence raises the bar for IAM teams: they must manage assurance, compliance, and fraud controls as one programme instead of separate initiatives.

Qualified confidence creates a new baseline for trust expectations. Once a workflow claims top-tier European assurance, downstream teams will be expected to justify deviations, manual overrides, and exceptions. Practitioners should therefore align policy, evidence retention, and exception governance with the confidence tier they rely on, or the certification advantage disappears at the process edge.

What this signals

High-confidence identity proofing is now an IAM governance issue as much as a compliance one. When assurance tiers become part of regulated onboarding, teams need to decide which transactions justify top-level certification and which still require layered review. That decision belongs in identity governance, not just in legal or fraud operations.

Regulated onboarding is converging around a shared trust layer. Person verification, business verification, AML checks, and signature workflows increasingly sit inside the same journey, which means weak governance in one step undermines the whole outcome. Practitioners should treat the onboarding chain as a single trust decision with multiple controls, not as disconnected checks.

For practitioners

• Map onboarding risk to assurance tier Align customer and business onboarding flows to the assurance level actually required by the transaction, sector, and jurisdiction. Do not use a high-confidence certification to justify lower-risk shortcuts in areas that still need stronger evidence or review.
• Separate automation from evidentiary trust Treat automated eMRTD reading as a control component that still needs traceable evidence, exception handling, and fraud review rules. Validate what the system proves, what it infers, and where human oversight still matters.
• Unify person and business verification governance Design one onboarding governance model that covers natural persons, legal persons, AML checks, and qualified signature journeys together. The practical risk is creating separate review paths that fail to explain the full trust decision.
• Document override and exception handling Define who can override a verified identity outcome, what evidence is required, and how exceptions are recorded for audit. High-assurance certification does not remove the need to govern manual departures from the standard workflow.

Key takeaways

• The article is really about assurance thresholds in regulated identity verification, not just a certification badge.
• The strongest operational implication is that IAM, KYB, AML, and fraud controls now need to be governed as one onboarding chain.
• Teams should validate evidence, escalation, and exception handling before relying on high-confidence certification in production workflows.

Key terms

• High Level Of Confidence: The highest eIDAS 2.0 assurance tier for identity verification. It signals that a verification process has been assessed against a stricter confidence threshold and is intended to support regulated identity use cases where auditability and fraud resistance matter.
• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Qualified Electronic Signature: A higher-assurance signature backed by certificate-based identity and trust service provider controls. It is used where legal recognition and stronger evidentiary value are required, especially in cross-border or regulated workflows where the identity chain must remain defensible.
• KYB Verification: Know Your Business verification is the process of confirming that an organisation is real, accountable, and represented by the right legal entity. It often combines registry checks, document validation, and entity matching so regulated teams can reduce fraud and establish trustworthy business relationships.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.