Notifications
Clear all
Topic starter
11/07/2026 8:45 pm
TL;DR: Customer due diligence workflows sit at the intersection of fraud prevention, regulatory compliance, and sensitive data handling, and Prove Identity’s developer guide shows that API design, data minimisation, and verification friction are the main implementation pain points. The governance challenge is that CDD is no longer just an onboarding feature. It is an identity control plane that must be secured, measured, and integrated like any other critical verification system.
NHIMG editorial — based on content published by Prove Identity: Integrating Customer Due Diligence Workflows, challenges and solutions for developers
Questions worth separating out
A: Security teams should separate policy design from the user interface, define the minimum evidence needed for each risk level, and reserve manual review for exceptions.
Q: Why do customer due diligence workflows create data security risk?
A: CDD workflows handle government IDs, addresses, and other sensitive identity attributes, so poor design can create a high-value data store for attackers.
Q: What do organisations get wrong about automating customer verification?
A: They often assume automation removes governance work, when it actually shifts the control burden into policy design, exception handling, and monitoring.
Practitioner guidance
- Define the CDD decision model Map each onboarding step to a specific outcome, such as pass, challenge, reject, or manual review, and document the evidence required for each state.
- Minimise sensitive data exposure Limit collection to the attributes required for verification, encrypt data at rest and in transit, and restrict access with role-based access control and detailed audit logging.
- Test fallback paths under load Simulate peak onboarding traffic, upstream API failures, and regional policy differences to verify that the workflow does not silently weaken checks.
What's in the full article
Prove Identity's full blog covers the operational detail this post intentionally leaves for the source:
- Code samples showing how to integrate the Start, Validate, Challenge, and Complete flow into an application.
- Jurisdiction-specific compliance handling, including watchlist screening and API-driven rule updates.
- Implementation detail on the Prove Pre-Fill and Phone-Centric Identity approach for reducing onboarding friction.
- Developer-facing SDK coverage across Java, TypeScript, JavaScript, Go, Android, Swift, and web.
👉 Read Prove Identity's developer guide on integrating customer due diligence workflows →
CDD workflows and identity verification: what developers need now?
Explore further
11/07/2026 9:11 pm
CDD is becoming an identity governance control, not just a compliance step. The article shows that customer due diligence now spans verification, fraud screening, data security, and workflow design. That combination places it closer to identity governance than to pure onboarding UX. For practitioners, the lesson is that CDD outcomes need policy ownership, evidence retention, and clear control boundaries.
A question worth separating out:
Q: Who is accountable when a CDD workflow allows a fraudulent customer through?
A: Accountability usually sits with the product owner, compliance function, and security leadership together, because CDD is both a regulatory and control decision. If the workflow approves risky identities, teams need to know whether the failure came from policy, data quality, vendor integration, or a bypassed exception path.
👉 Read our full editorial: CDD workflow integration exposes the identity governance gap
