How should organisations build customer identification and due diligence workflows for non face to face business relationships in Indonesia?

Why This Matters for Security Teams

Non face to face onboarding in Indonesia concentrates identity risk at the point where organisations have the least human assurance and the most compliance exposure. Customer identification and due diligence are not just KYC tasks; they are the control foundation for AML screening, fraud reduction, sanctions escalation, and account lifecycle governance. For remote channels, the practical question is whether the workflow can establish who the customer is, why the relationship is acceptable, and how the organisation will detect drift over time.

Teams often get this wrong by treating document collection as the same thing as verification, or by applying a single workflow to all customers regardless of risk. That usually creates gaps in source reliability, exception handling, and evidence retention. Current guidance favours risk-based design, with stronger checks for higher-risk customers, unusual patterns, and politically exposed persons. It also helps to map the process to control objectives in NIST SP 800-53 Rev 5 Security and Privacy Controls, even when local AML obligations drive the actual policy.

In practice, many security teams encounter identity failure only after suspicious activity, account abuse, or remediation findings have already forced a review rather than through intentional workflow design.

How It Works in Practice

A workable remote due diligence workflow should separate intake, verification, decisioning, and monitoring. At intake, the organisation should collect the minimum required customer data for the relationship type and channel, then validate it against reliable and independent sources. The verification layer should not rely on a single signal. Best practice is evolving toward combining document checks, database lookups, device and behavioural signals, and step-up verification where uncertainty remains. For higher-risk business relationships, enhanced due diligence should include more scrutiny of beneficial ownership, source of funds, purpose of account, and expected activity profile.

Operationally, the workflow needs a decision tree that records why a case was accepted, rejected, or escalated. That means using clear risk rules, threshold-based review paths, and exception handling for partial matches or inconsistent data. It also means making sure analysts can see the evidence behind a decision and that the organisation can reproduce the decision later. In regulated environments, that evidence trail should support audits, investigations, and suspicious transaction reporting.

• Collect identity attributes that are proportionate to the customer risk and business model.
• Validate identity evidence against independent sources, not only customer-submitted documents.
• Apply enhanced due diligence to higher-risk customers, geographies, products, or transaction patterns.
• Maintain audit logs for data captured, checks performed, reviewer actions, and final decisions.
• Refresh due diligence when risk changes, not only at initial onboarding.

For technical control mapping, organisations can also look to the privacy and authentication expectations in NIST SP 800-63B Digital Identity Guidelines and the risk-based governance principles in the FATF Recommendation 10 on Customer Due Diligence.

These controls tend to break down when onboarding is outsourced across fragmented vendors, because evidence quality, review standards, and escalation thresholds become inconsistent.

Common Variations and Edge Cases

Tighter customer due diligence often increases friction, manual review time, and abandonment risk, requiring organisations to balance conversion against compliance assurance. That tradeoff is especially visible in remote onboarding, where customers may use low-quality scans, shared devices, or inconsistent identity data. There is no universal standard for every product and segment, so the workflow should be tuned by customer type, channel, and risk appetite rather than copied unchanged across the business.

Edge cases matter. Sole proprietors, beneficial ownership chains, foreign customers, and customers acting through intermediaries all introduce different verification burdens. Some cases may require human review even if most can be automated. Where local requirements, internal policy, and third-party data availability do not align, the organisation should explicitly document the fallback path instead of silently weakening the control. For identity-heavy steps, the organisation should also consider whether the same evidence can support onboarding and future re-authentication, while avoiding overcollection.

For Indonesian programmes, the key operational discipline is consistency: one documented method for low-risk cases, a stronger path for higher-risk cases, and clear triggers for escalation or refresh. If the workflow cannot explain why a customer passed or failed, it is not ready for audit or scale.

Useful control references for broader program alignment include FATF Recommendation 1 on risk-based approaches and CISA Cybersecurity Performance Goals, which reinforce measurable control design even when the regulatory driver is AML.

Related resources from NHI Mgmt Group

• How should organisations decide when a customer needs enhanced due diligence?
• What do organisations get wrong about customer due diligence?
• Why do customer due diligence workflows create data security risk?
• How can organisations reduce over-privileged OAuth access without breaking business workflows?