How do qualifying digital IDs fit into customer due diligence?

By NHI Mgmt Group Editorial Team Updated November 9, 2026 Domain: Authentication, Authorisation & Trust

Qualifying digital IDs can support customer due diligence by providing a higher-assurance identity source for verifying a person’s identity and, where applicable, attributes such as name and date of birth. They do not replace sanctions, fraud, or beneficial ownership checks, which still require separate screening and evidence.

How qualifying digital IDs support customer due diligence

Qualifying digital IDs fit into customer due diligence as a stronger identity evidence source, not as a full replacement for the wider due diligence file. They help firms verify a customer’s identity with more confidence, especially where the digital credential is backed by a trusted issuer and can carry verified attributes that reduce manual review.

That makes them most useful at onboarding and refresh points where the firm needs to decide whether the person in front of it is real, present, and the same person previously identified. Identity Proofing and KYC Guide is the most direct match for the verification and assurance side of that workflow.

What qualifying digital IDs do and do not cover

A qualifying digital ID can support the “know your customer” portion of due diligence by helping confirm identity attributes such as name and date of birth, and by improving confidence that the source is genuine. It is most valuable when the firm can trace how the identity was proofed, what assurance level it carries, and whether the credential remains current and trustworthy.

It does not, by itself, answer the separate compliance questions that sit around customer due diligence. Screening for sanctions, politically exposed persons, fraud indicators, adverse information, and beneficial ownership still needs its own control and evidence chain. For that reason, firms should treat the digital ID as one input to the CDD record, not the record itself. CDD, EDD, PEP and sanctions screening covers the checks that remain separate from identity verification.

How firms should operationalise it in CDD

Practically, the key question is whether the digital ID is acceptable for the specific risk tier and customer type you are onboarding. A low-friction digital credential can be enough for straightforward customers, but higher-risk relationships still need stronger corroboration, escalation, or additional evidence before the firm can rely on the outcome.

That means the control design should define which attributes can be accepted from the digital ID, which must be independently corroborated, and when the case moves to enhanced due diligence. If the digital ID is used repeatedly over time, refresh rules should also say when a new verification event is required and what triggers a re-check. Perpetual KYC is useful where the question is how identity evidence should be refreshed after onboarding.

Risk and Threat Considerations

Digital IDs reduce manual work, but they also concentrate trust in the issuer, the wallet, and the verification flow. If those are weak, a firm can end up onboarding the wrong person with high confidence, especially when synthetic identity, document fraud, or account-takeover tactics are in play.

Failure mechanism: The control fails when a firm treats possession of a valid-looking digital ID as proof of the whole customer relationship, rather than proof of one part of the identity evidence set.

Impact: The organisation can pass a false identity into onboarding, miss a sanctions or ownership issue, and carry that error into transaction monitoring, ongoing review, and downstream customer risk scoring.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-63 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-63	Digital Identity Guidelines	Digital IDs rely on identity assurance and verified attributes.
Recommendation — Apply assurance levels and verifier checks before relying on a digital ID for CDD.
NIST SP 800-53 Rev 5	IA-12 — Identity Proofing	CDD depends on trustworthy identity proofing before account opening.
	IA-8 — Identification and Authentication (Non-Organizational Users)	Customer due diligence depends on verifying external persons, not staff identities.
	AC-6 — Least Privilege	CDD workflows should limit who can override, approve, or rely on identity evidence.
Recommendation — Use identity proofing controls to verify the customer before onboarding. Authenticate non-organizational users with controls suited to external customer risk. Restrict approval and exception rights to the minimum necessary reviewers.

Practitioner Guidance

What to verify: Confirm the issuer, assurance level, attribute scope, revocation status, and whether the digital ID was issued under a process your risk team is willing to trust for the specific customer segment. If those details cannot be evidenced, treat the ID as supporting evidence rather than primary evidence.

Decision rule: If the digital ID only proves identity, but the case also requires sanctions, fraud, or beneficial ownership judgement, do not let the credential short-circuit the rest of the file review. Use it to reduce friction, not to collapse the control stack.

Practitioner takeaway: The right use of a qualifying digital ID is to raise the quality of identity verification, while keeping the rest of customer due diligence intact and independently testable.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org