How should organisations handle customer identification and due diligence for non-face-to-face business relationships in France?

Why This Matters for Security Teams

Non-face-to-face onboarding creates a gap between the person presenting the identity and the evidence used to trust that identity. For organisations operating in France, that gap affects AML screening, fraud prevention, sanctions exposure, and the auditability of the entire customer acceptance decision. The practical challenge is not simply collecting more data, but proving that the identity evidence, assurance level, and due diligence steps match the customer risk.

Current guidance in identity assurance and security control design suggests that remote processes need explicit verification logic, traceable decision points, and retention of evidence that can be reviewed later. That aligns with broader control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where organisations must demonstrate that access to onboarding systems, case files, and approval workflows is restricted and logged. In practice, many security teams encounter weaknesses only after a disputed account opening, a fraud investigation, or a regulator asking why remote checks were accepted without sufficient proof of who was actually verified.

How It Works in Practice

For French non-face-to-face business relationships, the operational approach should start with a customer risk classification, then map the required identity evidence, verification depth, and escalation path. Organisations typically need to distinguish between low-risk remote onboarding, higher-risk customers, and cases that require enhanced due diligence. The process should define what counts as acceptable evidence, how that evidence is validated, and who can approve exceptions.

Practitioners usually implement the control chain in five steps:

• Collect core identity attributes and verify them against reliable sources where permitted.
• Assess whether the delivery channel creates additional impersonation, document tampering, or account takeover risk.
• Apply stronger checks when the customer profile, geography, product, or transaction pattern raises risk.
• Record the rationale for acceptance, rejection, or escalation so the decision can be defended later.
• Protect onboarding systems, reviewer access, and case notes with least privilege and logging consistent with NIST control expectations.

Identity proofing and customer due diligence are closely related but not identical. Proofing establishes that the person is who they claim to be; due diligence decides whether the relationship should proceed and under what conditions. For remote channels, current guidance suggests that organisations should also assess whether the workflow is vulnerable to synthetic identities, document fraud, or mule-account creation. Where automation is used, human review should remain available for exceptions and higher-risk cases. This is especially important when onboarding feeds downstream payment, credit, or platform-access decisions, because weak first-party checks often become fraud-loss problems later. These controls tend to break down when onboarding is heavily automated across multiple jurisdictions because local evidence rules, exception handling, and reviewer authority are not consistently enforced.

Common Variations and Edge Cases

Tighter due diligence often increases onboarding friction and review cost, requiring organisations to balance customer conversion against regulatory defensibility. That tradeoff is real, and best practice is evolving around how much automation can be safely used without reducing assurance.

One common edge case is a low-risk customer who presents clean documentation but uses a high-risk delivery channel, such as a fully remote flow with no trusted device history. Another is a business customer whose beneficial ownership is hard to establish quickly, which may require staged onboarding rather than a binary accept or reject outcome. For some sectors, the due diligence standard may also be shaped by payment risk, outsourcing, or critical service dependencies, so the onboarding team cannot work in isolation.

There is no universal standard for every remote onboarding scenario, so organisations should keep French legal references current and avoid copying generic AML wording from other jurisdictions. Where the organisation uses agentic automation or AI-assisted triage, the model’s decision support should be governed carefully, because a fast decision is not the same as a defensible one. The safest pattern is to treat remote onboarding as a controlled identity and risk workflow, not just a digital form. If the process cannot show who verified what, when, and on what basis, it is not ready for a regulator, an auditor, or a fraud investigation.

Related resources from NHI Mgmt Group

• How should organisations decide when a customer needs enhanced due diligence?
• What do organisations get wrong about customer due diligence?
• How should healthcare organisations govern non-human identities that handle patient data?
• Who is accountable when wallet-based customer due diligence fails?