TL;DR: The UK Money Laundering Regulations 2017 require regulated firms to identify customers, verify identity from a reliable independent source, and keep records for five years, while allowing secure electronic verification that can clear genuine customers faster, according to OneID. The compliance challenge is not proving identity in theory, but building onboarding checks that meet legal assurance without turning verification into a conversion bottleneck.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on OneID's blog post: The UK Money Laundering Regulations 2017 require regulated firms to verify customer identity from a reliable independent source, and secure electronic checks can satisfy that duty without slowing onboarding.
Why it matters: For IAM and compliance teams, the practical issue is balancing regulatory assurance with conversion, because slow or fragile verification flows create both abandonment risk and control gaps.
By the numbers:
- The same data lifted new-customer onboarding by around 15%.
Context
Customer due diligence is the control that proves a new customer is who they claim to be before a regulated relationship begins. In practice, that means identity proofing must be strong enough to satisfy law and supervision, but fast enough that legitimate users do not abandon the process.
The UK Money Laundering Regulations 2017 make that balance explicit: firms must verify identity using a reliable source independent of the customer, and they may do so electronically if the process is secure and appropriately assured. IAM and IGA basics matter here because onboarding controls sit at the intersection of identity verification, governance, and record retention.
Key questions
Q: How should financial institutions automate KYC checks without slowing customer onboarding?
A: Financial institutions should use KYC APIs to automate identity checks at onboarding, because manual review is slow, resource-intensive, and harder to scale. The best implementation connects customer data capture, document verification, government record checks, and risk screening in one workflow. That reduces friction, improves consistency, and lets compliance teams focus on exceptions instead of routine validation.
Q: Why do single-source identity checks create risk in customer onboarding?
A: Single-source checks often fail because they collapse coverage and assurance into one lookup. They miss thin-file customers, create avoidable false negatives, and leave firms unable to prove that the verified identity came from an independent source. Multi-source matching reduces that blind spot and gives compliance teams a stronger basis for acceptance.
A: When due diligence stops at onboarding, organisations can miss changes in ownership, behaviour, geography, or transaction patterns that alter risk after the account is opened. That gap weakens monitoring, limits escalation, and can leave suspicious activity undetected. Effective programmes treat customer verification, review, and risk reassessment as continuous controls, not a single checkpoint.
Q: Which controls matter most when regulators review KYC and CDD programmes?
A: Regulators usually look for independent identity evidence, clear ownership of onboarding decisions, documented risk-based escalation, and records that can be produced on demand. They also expect firms to know which supervisor applies to the business line. A programme that cannot explain its evidence standard or retention rules is usually underpowered.
Technical breakdown
What Regulation 28 actually requires from identity verification
Regulation 28 sets three core duties for customer due diligence: identify the customer, verify the customer's identity, and assess the purpose and intended nature of the relationship. Where the customer is not an individual, firms must also identify beneficial owners and understand ownership and control. The important point is that verification is not a self-attestation exercise. The evidence must come from a reliable source independent of the person being checked, which is why onboarding controls need evidential backing rather than just form fields and declarations. See the Identity Proofing and KYC Guide.
Practical implication: Map each onboarding step to a specific evidential requirement, not just to a workflow status.
Why secure electronic identity checks can satisfy the rule
The Regulations recognise electronic verification when the process is secure from fraud and misuse and provides an appropriate level of assurance. In practice, that usually means combining multiple independent data sources rather than relying on a single lookup. The legal test is not the channel itself but the quality of assurance it produces. For firms, that shifts the design problem from paper collection to evidence orchestration, source trust, and exception handling for thin-file or hard-to-match customers.
Practical implication: Design electronic verification around source diversity, assurance level, and escalation paths for mismatches.
What ongoing monitoring and record retention change in KYC programmes
CDD is not complete at onboarding. Ongoing monitoring requires firms to keep customer information current and review activity for consistency with what they know about the customer. The retention duty adds a second lifecycle control: firms must keep CDD records for five years after the relationship ends or the transaction completes, with a ten-year cap. That makes KYC a lifecycle governance problem, not a one-time verification event. Read the Ultimate Guide to NHIs: Lifecycle Processes for Managing NHIs.
Practical implication: Treat identity evidence as governed records with refresh, review, and deletion rules.
Threat narrative
Attacker objective: The objective is to obtain an approved customer relationship without satisfying the identity assurance standard the Regulations require.
- Entry occurs at onboarding when a firm accepts weak or incomplete identity evidence as sufficient to open a relationship.
- Credential access is not the issue here; the relevant failure is allowing identity claims to pass without independent verification.
- Impact appears when poor verification either admits the wrong customer or pushes genuine customers out of the funnel, creating compliance and revenue risk.
Breaches seen in the wild
- Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Regulation 28 is a governance test, not a document-collection exercise: the obligation is to verify identity from a reliable independent source, which means the control lives in evidence quality rather than in whether a customer uploads a file. That distinction matters because firms often mistake process completion for assurance. The practitioner implication is that onboarding design must be measured against evidential independence, not form completion.
Electronic verification changes the control design, not the legal duty: secure digital checks can satisfy the Regulations, but only when they produce an appropriate level of assurance and resist fraud or misuse. That means the programme has to evaluate source reliability, match quality, and exception handling as one control chain. The implication is that faster onboarding is defensible only when assurance is explicit, not assumed.
Thin-file customers expose a blind spot in single-source KYC: when one data source cannot establish identity, the issue is often coverage, not fraud. OneID's example suggests that multi-source matching can recover legitimate customers that narrower checks miss, which changes how teams should think about false negatives. The implication is that onboarding controls must distinguish between inability to verify and inability to trust.
Record retention turns KYC into a lifecycle discipline: five-year retention and ongoing monitoring mean identity evidence must remain usable after onboarding closes. That creates a lifecycle governance obligation that is often overlooked in customer onboarding design. The implication is that firms need controls for refresh, retention, and eventual deletion, not just initial verification.
What this signals
Identity assurance and customer conversion now need to be designed together: firms cannot treat verification as a back-office compliance hurdle if the onboarding path loses good customers before the check completes. The more the business depends on digital acquisition, the more KYC quality becomes a front-end control issue as much as a regulatory one.
Multi-source matching is becoming the practical baseline for defensible digital KYC: a single data source may be enough for low-risk relationships, but it is rarely enough to explain why an identity decision is reliable. For practitioners, the real question is whether the programme can prove why a match is trusted, not just whether a match was returned.
For practitioners
- Define the identity evidence standard Specify which independent sources count for each risk tier and require teams to document why those sources are reliable enough for the relationship.
- Separate verification from screening Keep customer identity verification distinct from sanctions, PEP, transaction monitoring, and affordability checks so each control has a clear owner and failure mode.
- Test thin-file onboarding paths Measure how often legitimate applicants fail a credit-reference-only check and whether secondary sources recover them without weakening assurance.
- Build retention and refresh rules into workflow Tie CDD refresh, record retention, and deletion timing to the customer lifecycle so evidence remains usable for audit without being kept indefinitely.
- Review supervisory mapping by sector Confirm which supervisor applies to each regulated business line, because the compliance owner changes by activity and sector classification.
Key takeaways
- The article frames KYC as a legal assurance problem, not just a user-experience problem, because regulated firms must verify identity from independent evidence.
- Its practical evidence point is that electronic checks can work at speed, but only when they draw on more than one trustworthy source or a clearly governed equivalent.
- For practitioners, the control question is whether onboarding can prove identity, retain evidence, and still avoid driving legitimate customers out of the process.
Related NHI Mgmt Group resources: Ultimate Guide to NHIs: Lifecycle Processes for Managing NHIs · IAM and IGA Basics · Top 10 NHI Issues
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article centres on verifying customer identity during onboarding, which maps directly to proofing guidance. |
| SP 800-63C — Federation | The article references government-certified digital verification sources and trusted external identity evidence. | |
| Recommendation — Apply SP 800-63A to structure evidence collection, assurance levels, and verification outcomes for onboarding. Use SP 800-63C concepts to govern trusted identity assertions from external providers. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity verification determines whether a customer relationship is authorised to start at all. |
| Recommendation — Link onboarding approval to verified identity and documented entitlement decisions. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | The article's core failure mode is accepting identity claims without sufficient independent verification. |
| Recommendation — Check whether digital identity flows accept self-asserted claims where stronger authentication evidence is required. | ||
| CIS Controls v8 | CIS-5 — Account Management | KYC and CDD are account lifecycle controls for customer identities in regulated firms. |
| Recommendation — Govern customer account creation, verification, and retention under CIS-5 lifecycle discipline. | ||
Key terms
- Customer Due Diligence: Customer due diligence is the process of verifying a customer’s identity and understanding the risk attached to that relationship. Wallet-based presentations can streamline it, but the institution remains accountable for deciding which attributes are trusted and how exceptions are handled.
- Reliable Independent Source: A reliable independent source is identity evidence that comes from outside the customer's own statement and can be trusted for verification. It may be documentary or electronic, but it must support the identity claim without depending on self-declaration alone.
- Electronic Verification: Electronic verification is the use of digital data sources and matching processes to confirm identity instead of, or alongside, manual document review. In regulated onboarding, its value depends on assurance quality, fraud resistance, and whether the process produces evidence that stands up to audit.
- Ongoing Monitoring: Ongoing monitoring is the continuous review of identities, systems, and activity to detect risk, misuse, and policy drift after access is granted. In IAM and NHI governance, it tracks behavior, privilege changes, secret use, and anomalous actions so security teams can spot compromise, enforce least privilege, and support timely response.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 27, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org