TL;DR: The EU’s new AML rulebook will harmonise customer due diligence across the EEA and move onboarding away from document-and-selfie checks toward eIDAS-compliant digital credentials, with traditional verification increasingly treated as a fallback, according to Daon. The governance shift is toward higher assurance, better auditability, and less dependence on legacy, country-by-country identity proofing.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Daon's blog post: EU AML reform is pushing customer onboarding toward harmonised, digitally assured identity verification and away from document-only checks.
Why it matters: This matters because AML, KYC, and identity teams will need to rework onboarding, evidence retention, and refresh processes around trusted credentials and consistent assurance levels.
Context
AML onboarding is moving from local variation to a more standardised European model, which means identity assurance can no longer be designed country by country. The practical issue is not just regulatory change, but the need to make onboarding evidence, verification confidence, and customer record quality consistent across jurisdictions.
For organisations that still depend on passport-plus-selfie review, the gap is operational as much as regulatory. Identity proofing and KYC now has to accommodate digital credentials, trusted sources, and refreshable records instead of treating document inspection as the default control.
Key questions
Q: How should teams handle fallback identity verification in regulated onboarding?
A: Use fallback verification only as a controlled secondary path, with step-up checks, clear approval rules and full audit logging. It should confirm the same identity attributes as the primary route, for example biometrics, document checks, database corroboration or supervised review, so regulated onboarding does not rely on an untracked exception.
Q: Why does document-based KYC become less effective under digital identity frameworks?
A: Document-based KYC becomes less effective when digital identity frameworks shift assurance from static copies of identity documents to stronger, reusable proofing and authentication signals. Passports and utility bills can be forged, outdated, or weakly linked to the person presenting them, so firms need liveness checks, authoritative data sources, and risk-based identity proofing.
Technical breakdown
How eIDAS-compliant identity verification changes onboarding assurance
eIDAS-based verification replaces a single document check with a trust framework that can anchor identity to national eID schemes, the European Digital Identity Wallet, or qualified trust services. That matters because the assurance comes from the credential source and the trust framework around it, not only from the visible document or selfie. In practice, the verifier is no longer just checking resemblance or document integrity. It is asserting that the identity signal was issued, signed, and recognised under a legal and technical framework that carries stronger evidential weight. See the W3C Digital Credentials API Guide.
Practical implication: Treat digital identity acceptance as an assurance-design decision, not as a cosmetic replacement for manual review.
Why document-and-selfie checks become a fallback control
Document-based onboarding does not disappear, but it changes category. When a suitable digital identity route or qualified trust service is unavailable, the organisation has to justify why it used a weaker path and how it still reached acceptable assurance. That shifts the control from routine first choice to exception handling. It also makes documented rationale, source corroboration, and decision traceability part of the control itself, because auditors will want to know why the stronger route was not used.
Practical implication: Define explicit fallback criteria and evidence requirements for every non-digital onboarding path.
How customer refresh programmes fit the new AML model
The reform is not limited to new customer entry. Legacy customer files may fail future evidence expectations even if they were acceptable under older national processes, which is why refresh and remediation work becomes a governance issue. The technical problem is not only missing data, but mismatched assurance levels across older records. Organisations will need a way to identify which records can be carried forward, which need re-verification, and which need stronger source corroboration before they can be relied on under the new rulebook. See the EU Digital Omnibus Guide.
Practical implication: Map legacy customer records to the new assurance standard before July 2027 exposure becomes operationally visible.
NHI Mgmt Group analysis
EU AML reform is really an identity assurance reform. The shift is not just about compliance harmonisation; it is about changing what counts as acceptable proof of who a customer is. That moves onboarding away from subjective document review and toward governed, reusable trust frameworks that can support audit and cross-border consistency. Firms that keep treating KYC as a document exercise will find their assurance model lagging the regulation.
Document-and-selfie verification is being demoted from default control to exception path. That changes the control design problem for regulated firms because fallback paths must now be justified, traceable, and evidence-rich. The operational implication is that onboarding policy, not just tooling, has to encode when weaker methods are permissible and how they are documented.
Trusted digital credentials will become the more durable governance anchor for customer identity. The important change is not that documents disappear, but that assurance increasingly attaches to issuers, trust services, and corroborating data sources rather than to a single captured image. That should push identity teams to design for verifiable provenance, not one-off proofing events.
Legacy customer refresh will become a governance workload, not a clean-up task. Existing records may not meet the new assurance bar, especially in higher-risk segments or where onboarding was originally lightweight. Organisations should expect remediation pressure to expose weak evidence retention, inconsistent verification standards, and uneven customer record quality.
What this signals
Trusted-credential onboarding is becoming the new control baseline. As EU rules push identity assurance toward eIDAS-aligned methods, organisations will need onboarding journeys that can accept digital credentials without fragmenting policy across markets. The practical challenge is to make assurance levels explicit so operations, compliance, and fraud teams are judging the same identity evidence in the same way.
The organisations most exposed are the ones that still rely on manual review as their primary control. Once digital identity acceptance becomes the preferred route, legacy processes will survive only where they are tightly bounded, justified, and documented for exception handling.
For practitioners
- Reclassify onboarding by assurance level Separate digital identity routes, qualified trust services, and document-based fallback paths so each has its own policy, evidence, and approval threshold.
- Define fallback criteria for manual verification Document when document-and-selfie checks are allowed, what corroborating sources are required, and what justification must be stored for audit.
- Inventory legacy customer records for remediation Identify which existing files lack sufficient evidence for the new AML environment and prioritise refresh by risk, geography, and onboarding method.
- Align KYC operations with trusted identity frameworks Update onboarding journeys, quality controls, and exception handling so teams can accept eIDAS-compliant credentials without creating parallel manual processes. See the eIDAS 2.0 and the European Digital Identity Framework Guide.
Key takeaways
- EU AML reform is changing customer onboarding from document-centric review to a more governed digital identity model.
- The main operational pressure is not just compliance, but the need to standardise assurance, evidence, and auditability across jurisdictions.
- Firms that wait until July 2027 to adjust will face harder remediation across both new onboarding and legacy customer records.
Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · W3C Digital Credentials API Guide · eIDAS 2.0 and the European Digital Identity Framework Guide · EU Digital Omnibus Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63 and NIST CSF 2.0 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63C — Federation | The move toward trusted digital credentials depends on federated identity assurance and verified assertion sources. |
| Recommendation — Align onboarding trust decisions to federation-grade assurance and validated identity assertions. | ||
| GDPR | Art.32 — Security of Processing | Onboarding and refresh processes must protect identity data and preserve secure evidence handling. |
| Recommendation — Apply security-of-processing controls to identity evidence, retention, and verification workflows. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Customer onboarding establishes identity assurance that underpins later access decisions. |
| GV.RM-01 — Risk Management Strategy | The reform requires a consistent risk strategy for when digital identity is required versus fallback methods. | |
| Recommendation — Tie onboarding assurance to entitlement decisions so identity confidence matches access risk. Set risk thresholds for digital, qualified, and fallback verification paths. | ||
Key terms
- Know Your Customer (KYC): KYC is the process of verifying a customer’s identity and assessing whether the relationship is acceptable to the business. In AML/CFT programmes, it includes identity evidence, risk checks, and ongoing review, not just a one-time signup step.
- Customer Due Diligence: Customer due diligence is the process of verifying a customer’s identity and understanding the risk attached to that relationship. Wallet-based presentations can streamline it, but the institution remains accountable for deciding which attributes are trusted and how exceptions are handled.
- eIDAS Compliant Electronic Identification: eIDAS-compliant electronic identification is a recognised digital identity method that meets EU assurance expectations for trusted remote verification. It provides a standardised basis for proving identity across borders, which helps reduce local interpretation differences in regulated onboarding.
- Qualified Trust Services: Qualified Trust Services are regulated digital trust functions that issue, validate, and preserve legally recognized electronic signatures, seals, timestamps, and certificates. In practice, they establish stronger assurance for identity, authenticity, and integrity in digital transactions by meeting formal legal, operational, and audit requirements under a trust framework.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org