How should teams verify people during regulated onboarding?

What regulated onboarding is trying to prove

Regulated onboarding is not just about collecting a name and a document set. The team has to establish that the person presenting is the right person, that the evidence is current enough for the risk involved, and that the service is being opened on a defensible basis. For that reason, verification should be risk-based rather than one-size-fits-all.

At the low end of the risk spectrum, documentary evidence can be sufficient if the organisation is comfortable with the residual risk and the use case does not require stronger assurance. As the risk rises, teams should move toward authoritative electronic sources, recent records and, where appropriate, extra authentication to reduce impersonation and synthetic identity risk. The Joiner-Mover-Leaver (JML) Guide is a useful companion when onboarding is tied to downstream access changes and lifecycle control.

In practice, the verification standard should match the consequence of onboarding error. A low-friction process may be acceptable for low-value relationships, but higher-risk onboarding needs stronger evidence of existence, freshness and entitlement before the account or relationship is approved.

Which evidence sources are stronger, and why

Source strength matters because not all evidence answers the same question. A passport, licence or other documentary item can help with face-to-face or remote proofing, but it mainly demonstrates that an identity document exists and appears consistent. It does not always prove that the person is currently eligible for the specific regulated service.

Authoritative electronic sources are stronger when the organisation needs confidence in current status, current name, address, registration, employment or licensing data, or other facts that can change over time. Current records reduce the chance that onboarding succeeds on stale or manipulated evidence. When the regulated activity depends on a formal status, the verifier should prefer the source that most directly answers that status question, not the one that is easiest to collect.

Extra authentication is useful when the business needs to link the applicant to a trusted source record or confirm continued control over a channel already associated with the person. That can include step-up checks, live challenge response or validation against an existing authoritative account. The point is to raise confidence in continuity, not merely to duplicate document review.

FATF Recommendations, AML and KYC framework supports a risk-based approach to customer due diligence, which is the same logic regulated onboarding should follow when deciding how much assurance is enough.

How to make the decision defensible in practice

The defensible decision is to align the verification method to the specific onboarding risk, then retain evidence of how that choice was made. If the service can be misused for fraud, financial crime, privileged access or regulated activity, the team should be able to show why the selected checks were proportionate to that exposure.

• Use documentary evidence when the service risk is low and the document type is accepted as sufficient.
• Use authoritative electronic sources when the key question is current status, eligibility or existence in a trusted register.
• Add extra authentication when you need to verify continuity of control over a known channel or account.
• Escalate to manual review when signals conflict, records are stale, or the evidence set does not resolve the risk.

For teams that want a broader identity control reference, IAM and IGA Basics helps connect onboarding verification to provisioning, access review and entitlement governance.

Risk and Threat Considerations

Weak onboarding creates an obvious opening for impersonation, document fraud and account creation on the basis of stale or synthetic information. The practical risk is not only bad data at entry, but downstream abuse if the wrong person is granted a regulated relationship, account or entitlement.

Failure mechanism: Organisations over-trust a single document, fail to validate freshness, or rely on evidence that does not match the actual risk of the service being opened. That allows an attacker or dishonest applicant to pass onboarding without proving current eligibility.

Impact: The result can be fraudulent account creation, misissued access, compliance failure, recovery cost and harder remediation later because the initial trust decision was wrong.

Practitioner Guidance

What to verify: Verify both identity and eligibility, not just the existence of a document. For regulated onboarding, the key question is whether the evidence still matches the person and the use case on the day approval is granted.

Decision rule: If the consequence of a bad onboarding decision is material, move away from document-only checks and require current, authoritative evidence plus any extra authentication needed to close the risk gap.

Practitioner takeaway: The right control is the one that matches the onboarding risk, because regulated verification is about proving a current, eligible person, not merely collecting something that looks like identity evidence.

Related resources from NHI Mgmt Group

• How should regulated businesses verify an SSN during onboarding without creating avoidable friction?
• How should compliance teams verify a legal entity identifier during KYB onboarding without slowing down transaction review?
• Should organisations use the same process for onboarding people and machine identities?
• Who is accountable when automated identity verification supports regulated onboarding?