Continuous KYC assurance: what it means for identity teams

TL;DR: One-time KYC checks cannot detect fraud that appears after onboarding, according to IDnow, as eIDAS 2.0, the EU AMLR and PSD3 push Europe toward continuous, event-driven identity assurance. The shift makes identity relationships, not isolated checks, the governing model for customer trust.

Editorial analysis by NHI Mgmt Group, based on content published by IDnow: “The Identity Check is Dead. Long Live the Identity Relationship.”.

By the numbers:

• The European Anti-Money Laundering Authority is required to submit its draft regulatory technical standards on customer due diligence in July 2026.
• Fraudulent payment transactions across the EEA totalled €4.3 billion in 2022, according to the joint ECB/EBA report on payment fraud cited by IDnow.
• By 2024, fraudulent credit transfers had risen 16% year-on-year to €2.2 billion, with card fraud adding another €1.3 billion on top, according to the EBA-ECB’s 2025 payment fraud report cited by IDnow.

Key questions

Q: Why do onboarding checks fail to catch later eKYC fraud?

A: Because fraud often appears after the initial proofing decision, when attackers exploit account changes, transaction requests or weaker review paths.

Q: When should organisations re-check customer identity instead of relying on the original KYC result?

A: They should re-check identity when a customer changes payment details, activity patterns, account limits, or any other signal that changes the risk profile.

Q: What are the signs that static KYC controls are failing?

A: Common signs include repeated identity artefacts across channels, successful logins after suspicious onboarding, and fraud cases that become obvious only when data is compared with other organisations or prior attempts.

Practitioner guidance

• Replace one-time KYC with lifecycle verification Map onboarding, re-verification and step-up events into a single customer identity journey so trust can be reassessed after compromise indicators appear.
• Define event triggers for re-verification Trigger review when the customer changes device, logs in from a new geography, resets credentials or shows signs of SIM swap or email compromise.
• Align fraud and compliance controls Make AML, authentication and customer due diligence operate on the same evidence set so compliance decisions reflect live risk, not stale identity proof.

Bottom line: The core weakness is not bad onboarding checks but the assumption that trust stays valid after the first verification.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →