Topic starter
11/08/2026 3:14 pm
TL;DR: New EU anti-money laundering rules will make eID-based onboarding the default and push financial institutions toward stronger identity proofing, with the draft RTS shaping customer due diligence and digital onboarding requirements ahead of a July 2027 effective date, according to iProov. The real governance issue is not just compliance timing, but whether identity stacks can resist deepfakes and injection attacks without creating an assurance gap at onboarding.
Editorial analysis by NHI Mgmt Group, based on content published by iProov: “AMLR Requires eIDAS-compliant Identity Verification. Is Your Tech Stack Ready?”.
By the numbers:
- The new EU anti-money laundering regulations come into force on 10th July 2027.
- A single bad actor opened 46 bank accounts with ABM AMRO using stolen identity information and deepfakes.
Key questions
Q: What breaks when remote onboarding still relies on document and selfie checks?
A: The control breaks when the verification path assumes visible evidence is enough to prove identity.
Q: Why do stronger identity proofing controls reduce AML risk?
A: Because AML controls only work if the identity behind the account is real enough to be trusted.
Q: How can security teams tell if onboarding controls are not providing real assurance?
A: A weak onboarding programme shows up when fraud is only discovered after interview completion, device issuance, or access grant.
Practitioner guidance
- Map onboarding paths to eID assurance levels Inventory every digital onboarding route and record which ones can support eID at Substantial or High assurance, then identify where fallback methods are still in use without justification.
- Separate presentation and injection attack controls Test whether your verification stack can detect synthetic media entering the data stream, not just forged documents or replayed faces visible to the camera.
- Review certification lead times now Compare current vendor certification status with the July 2027 deadline and remove any deployment path that cannot be proven ready in time.
Bottom line: The article shows that EU AML onboarding is shifting from document-centric verification to regulated identity assurance anchored to eIDAS.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:27 pm
The regulatory centre of gravity is shifting from identity collection to identity assurance. EU AML onboarding is no longer mainly about gathering enough customer data to satisfy a form. It is about proving that the verification method itself can withstand modern fraud tactics and still support risk-based due diligence. For practitioners, that means onboarding controls must be judged by assurance quality, not by convenience or legacy habit.
A few things that frame the scale:
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to the State of Secrets in AppSec.
- Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.
A question worth separating out:
Q: What should organisations do when eID is required but not yet certified in time?
A: They should treat certification timing as a deployment risk and not a procurement afterthought. If an onboarding path cannot be certified before the deadline, it should not be counted on for the regulated flow. The safer choice is to redesign the onboarding route early enough to avoid a last-minute compliance gap.
👉 Read our full editorial: EU AML rules tighten identity verification for digital onboarding