TL;DR: UK Government guidance will formally recognise certified digital identities for Money Laundering Regulations compliance, clarifying how firms can use accredited providers for customer due diligence, ongoing monitoring, and higher-risk onboarding, according to Yoti. The shift reduces regulatory uncertainty, but it also raises the bar for governance, attribute assurance, and when additional checks are still required.
At a glance
What this is: UK guidance is set to recognise certified digital identities for AML and CDD compliance, clarifying when accredited identity evidence can satisfy regulatory checks.
Why it matters: This matters because compliance teams need a defensible rule for when digital identity evidence is enough, when extra checks are required, and how to govern attribute trust across onboarding and monitoring.
By the numbers:
- The public consultation drew nearly 200 industry responses from finance, tech, regulators and civil society.
- The UK Government estimates that widespread digital identity adoption could generate £4.3 billion in economic efficiencies by 2034.
- Around 27% of people surveyed reported using a digital identity check to open a bank account.
- Of those surveyed, 75% said the digital identity check was quicker than manual document checks.
Context
The governance gap here is not whether digital identity can work, but when it is sufficiently trusted to satisfy AML and customer due diligence obligations. Regulated firms have needed clearer rules on evidence quality, certification, and escalation because identity assurance for compliance is not the same as simply collecting identity data.
This is primarily an identity verification and compliance governance issue, but it intersects with IAM where organisations must decide which attributes, credentials, or evidence sources are acceptable for onboarding and ongoing monitoring. The article describes a typical market problem in regulated sectors: innovation moved faster than the rulebook.
The new guidance also matters because attribute-based identity evidence creates new decision points. A firm may accept one verified attribute, such as age or address, while still needing stronger proof for higher-risk onboarding or enhanced due diligence.
Key questions
Q: How should regulated firms use digital identity in AML onboarding?
A: Use digital identity as an evidential control, not just a convenience layer. Map it to CDD and EDD decision points, require retention of proofing records, and make sure the output can be defended in audit or supervisory review. If the identity signal cannot be explained, preserved, and reused, it is not ready for regulated onboarding.
Q: When does digital identity evidence still need extra checks in CDD?
A: Extra checks are needed when the risk is higher than the evidence supports, such as complex corporate structures, regulated transactions, or anomalies during onboarding and monitoring. A trusted attribute does not remove the need to re-verify identity when risk, ownership, or transaction behaviour changes.
Q: What do firms get wrong about attribute-based identity verification?
A: They often treat one trusted attribute as if it proves the whole identity. That creates either overconfidence, when evidence is accepted too broadly, or over-collection, when firms demand full documents for decisions that only need a specific verified attribute.
Q: Which governance controls matter most when digital identity is used for AML?
A: The key controls are evidence provenance, assurance mapping, escalation criteria, and ongoing monitoring. Firms should be able to show why a digital identity source is trusted, when it is insufficient, and how it is reviewed when customer or transaction risk changes.
Technical breakdown
Certified digital identity as AML evidence
Certified digital identity changes the evidence model for AML because the control is no longer only document inspection. Instead, firms can rely on a trust framework that defines how identities are verified, who can verify them, and what certification conditions apply. That matters because customer due diligence is a governance process, not a single check. If the source of identity evidence is unclear, compliance teams cannot show that the control chain is reliable or that the evidence fits the risk-based approach required under MLRs.
Practical implication: Map each accepted digital identity source to a documented assurance level before allowing it into onboarding or monitoring workflows.
Attribute assurance versus full identity proof
The guidance highlights a common control tension: a digital attribute such as over 18 or address may be sufficient for one decision, but not for another. Attribute assurance means the organisation can trust the claim being made about a person, while full identity proofing establishes who the person is to a higher level of confidence. Those are related but not interchangeable. Firms that blur them risk over-accepting weak evidence or over-collecting data they do not need, which weakens both compliance and privacy outcomes.
Practical implication: Separate attribute-level acceptance rules from full-identity proofing rules in policy and workflow design.
Risk-based CDD and ongoing monitoring
The article shows why digital identity must be governed as part of the full lifecycle, not just at account opening. Risk-based CDD includes higher-risk onboarding, enhanced due diligence, and continuous monitoring such as sanctions, PEP, and watchlist checks. A certified identity source helps at the front end, but it does not replace later-stage obligations when risk changes. The operational challenge is to define when a trusted digital identity remains valid and when additional verification or review must be triggered.
Practical implication: Build lifecycle triggers that require step-up checks when risk indicators, customer type, or transaction patterns change.
NHI Mgmt Group analysis
Certified digital identity is becoming an AML control, not just an onboarding convenience. The significance of this guidance is that trust in identity evidence now sits directly inside compliance governance. That shifts the conversation from user experience to assurance, certification, and regulatory defensibility. Compliance teams should treat the identity source as part of the control, not an upstream form factor.
Attribute-based evidence will force better policy separation. The article makes clear that a verified attribute such as over 18 is not the same as full customer identity proof. That distinction matters for regulated onboarding, privacy minimisation, and escalation rules under a risk-based model. Practitioners should separate attribute trust from identity proofing in policy, workflow, and audit evidence.
Digital identity governance will increasingly overlap with IAM and lifecycle controls. Once certified digital identity becomes an accepted compliance input, organisations need lifecycle logic for when to accept it, when to re-check it, and when to step up assurance. The broader lesson is that regulated identity assurance now needs operational control points, not just policy statements. Practitioners should design the acceptance rules up front.
UK guidance is also a market signal about standardised trust frameworks. The combination of statutory recognition, accreditation, and regulator-aligned guidance suggests the UK is moving toward a more formal trust model for digital identity. That strengthens portability but also raises the bar for governance consistency. Practitioners should expect more scrutiny on how their chosen evidence source maps to AML obligations.
What this signals
Attribute assurance will become the decisive governance issue. Once digital identity is accepted for AML and CDD, firms need to separate proof of a specific attribute from proof of the whole person. That distinction will shape onboarding policy, risk scoring, and how much evidence an auditor expects to see.
Certified digital identity turns compliance architecture into a trust-design problem. The practical question is no longer whether digital identity exists in the process, but whether the organisation can defend when it is trusted, when it is stepped up, and when it is rejected.
Digital identity governance will increasingly sit alongside identity lifecycle management. If the evidence source can be accepted at onboarding, it also needs a lifecycle rule for review, revocation, and re-verification when risk changes. That is where compliance teams will feel the operational pressure most.
For practitioners
- Define acceptance rules for certified digital identity Document which certified identity sources can satisfy AML and CDD controls, which assurance levels are acceptable, and where enhanced due diligence still needs additional evidence.
- Separate attribute trust from identity proofing Treat claims such as age, address, or residency as distinct from full identity verification, and make sure workflow logic reflects that difference.
- Rework onboarding decision points Insert explicit checks for high-risk clients, regulated sectors, and corporate roles where the guidance still expects stronger review or step-up verification.
- Align monitoring with lifecycle controls Connect sanctions, PEP, and ongoing monitoring alerts to a review process that can revoke acceptance of a digital identity when risk changes.
Key takeaways
- The policy shift is about trust governance, not just digitising onboarding. Certified digital identity is becoming a recognised AML input, which means evidence quality, certification, and escalation rules now matter as much as convenience.
- The clearest operational challenge is separating attribute assurance from full identity proofing. Firms that blur those concepts risk either under-controlling high-risk cases or collecting more personal data than necessary.
- Compliance teams will need lifecycle controls for acceptance, monitoring, and step-up checks. A trusted digital identity is only useful when the organisation can defend when it remains valid and when it must be rechecked.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63 and NIST CSF 2.0 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article is about using certified digital identity as evidence for regulated due diligence. |
| Recommendation — Map onboarding evidence rules to SP 800-63A and document what level of proof each customer segment requires. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The governance question is who or what evidence is authorised to satisfy regulated identity checks. |
| GV.RM-01 — Risk Management Strategy | The article frames digital identity adoption as a risk-based compliance choice across onboarding and monitoring. | |
| Recommendation — Define which trusted identity sources are authorised for AML decisions and review those permissions periodically. Set risk-based acceptance criteria for certified identity evidence and align them with compliance and audit expectations. | ||
| GDPR | Art.5(1)(c) — Data Minimisation | The article explicitly links digital identity to reduced document collection and privacy benefits. |
| Recommendation — Limit identity collection to the attributes needed for each AML decision and avoid storing unnecessary documents. | ||
Key terms
- Certified Digital ID: A certified digital ID is a phone-based credential that has been issued only after the holder’s identity was checked against trusted evidence and the issuing service met a defined trust standard. In practice, it lets a verifier rely on a confirmed attribute, such as age, rather than inspecting a physical document.
- Customer Due Diligence: Customer due diligence is the process of verifying a customer’s identity and understanding the risk attached to that relationship. Wallet-based presentations can streamline it, but the institution remains accountable for deciding which attributes are trusted and how exceptions are handled.
- Attribute Assurance: Attribute assurance is confidence that a specific claim about a person, such as age, address, or residency, is valid. It is narrower than full identity proofing and is useful when a business only needs a particular verified fact rather than a full document set.
- Enhanced Due Diligence: Enhanced due diligence is the higher-intensity review applied when a customer or related party presents elevated risk. It usually means deeper source-of-funds checks, closer monitoring, stronger approval requirements, and clearer evidence retention so the institution can justify why the relationship is acceptable.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management. It helps practitioners connect identity control decisions to broader security and compliance programmes.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org