Who is accountable when customer verification and due diligence controls are not aligned to local law?

Why This Matters for Security Teams

When customer verification or due diligence controls do not match local law, the failure is usually not a technical one first. It is a governance failure that creates inconsistent onboarding, weak evidence trails, and avoidable regulatory exposure. The regulated firm remains accountable even when the workflow is outsourced, automated, or embedded in a vendor platform. That makes control ownership, legal review, and exception handling part of the security problem, not just the compliance problem.

NHIMG’s research shows how often weak operational discipline compounds risk: in the Ultimate Guide to NHIs, NHI Mgmt Group notes that only 20% of organisations have formal processes for offboarding and revoking API keys, which is a useful reminder that control gaps persist when ownership is unclear. The same pattern appears in regulated verification programs, where legal requirements change faster than policy updates and systems keep running with outdated rules. Alignment to NIST SP 800-53 Rev 5 Security and Privacy Controls helps establish review, accountability, and auditability expectations, even though local law still sets the substantive requirement.

In practice, many security teams discover misalignment only after a regulator, auditor, or correspondent bank has already challenged the process.

How It Works in Practice

Accountability should be assigned at the firm level, with clear ownership across compliance, legal, operations, and the security function. The practical question is not who performed the check, but who approved the control design, who validated it against local law, and who is responsible for keeping it current. A firm can delegate execution, but it cannot delegate accountability.

Effective programs usually separate three layers:

• Policy ownership: define what verification is required for each jurisdiction, customer type, and risk tier.
• Operational execution: implement the checks in onboarding, periodic review, and exception handling workflows.
• Control assurance: test whether the workflow matches the law, retains evidence, and escalates exceptions.

That structure maps well to the control discipline reflected in the Ultimate Guide to NHIs - Standards, where governance is treated as a lifecycle function rather than a one-time approval. It also aligns with the documentation and monitoring expectations in NIST control practice, especially where a firm must show that procedures were approved, reviewed, and tested. For high-risk or cross-border onboarding, current guidance suggests that legal sign-off should be required whenever a local requirement changes, not only at annual policy review.

In mature programs, the evidence pack includes the local legal basis, the risk decision, the control owner, the exception approver, and the test result for each jurisdictional variant. These controls tend to break down when a single global workflow is used across jurisdictions with different verification thresholds, because the same process cannot satisfy conflicting legal requirements.

Common Variations and Edge Cases

Tighter alignment to local law often increases operational complexity, requiring organisations to balance regulatory certainty against speed, cost, and customer friction. That tradeoff becomes sharper in multinational firms, digital onboarding journeys, and third-party verification models where the provider executes the control but the regulated firm still carries the exposure.

One common edge case is when local law is ambiguous or changes quickly. In those situations, best practice is evolving rather than settled: firms should document the legal interpretation, set a review cadence, and keep a dated record of decisions. Another edge case is reliance on a vendor screening or identity verification platform. Outsourcing may reduce workload, but it does not transfer accountability. The firm still needs contractual rights, validation testing, and the ability to override or suspend a workflow if local law changes.

The same applies when exceptions are frequent. If compliance teams approve too many manual overrides, the process stops being a control and becomes a habit. In those cases, the right fix is often redesign, not more exception forms. The operational lesson is simple: local-law alignment must be treated as a living control set, reviewed as part of change management and control testing, not as a static policy appendix.

Related resources from NHI Mgmt Group

• What breaks when customer verification and due diligence are not aligned to Thailand regulatory expectations?
• Who is accountable if customer identification and due diligence controls fail in Colombia?
• Who is accountable when remote identity verification and due diligence controls fail in a regulated market?
• Who is accountable when background checks are required but local law limits what can be collected?