A single KYC check is often insufficient because it proves identity at onboarding, not at the moment a payment is initiated. Fraudsters can take over an account later, so payment approval should rely on current signals such as device trust, behavioural checks, step-up authentication, and sanctions or account-risk screening at transaction time.
Why a single KYC check fails at payment time
A one-time KYC check answers a different question from payment authorisation. It helps confirm who the customer was at onboarding, but it does not prove that the same person still controls the account when a transfer or card payment is initiated. Payment-time risk can change after account takeover, device compromise, or sanction status changes.
The practical gap is timing. KYC is often a static assurance step, while payment approval is a live trust decision. If the only control is an onboarding check, the business is assuming that identity, device, behaviour, and risk have not changed since registration. In fraud cases, that assumption is exactly what fails.
Current payment controls therefore need to combine identity history with present-tense signals. That usually means device trust, session integrity, behavioural analytics, step-up authentication when risk rises, and transaction-time screening that can catch abnormal patterns or sanctions exposure before value leaves the account.
What changes between onboarding and the payment moment
KYC establishes a baseline, not a guarantee of future legitimacy. A customer can start out genuine and later be phished, socially engineered, or taken over by malware, which means the original identity evidence is still true but no longer sufficient for the current action. That is why payment review needs contextual signals tied to the live session and transaction.
At payment time, the question is no longer just “is this customer real?” but “is this specific action consistent with the known customer, the expected device, the expected behaviour, and the current risk profile?” A strong payment decision usually depends on multiple weak signals that together give better assurance than onboarding alone.
That distinction matters most for instant payments, new beneficiaries, unusual amounts, first-time devices, and high-risk geographies. In those cases, the payment event itself is the control point, because the fraud opportunity exists after onboarding and before settlement.
What a transaction-time control set should actually cover
Transaction-time protection works best when it reduces blind trust in the stored customer profile. A payment approval flow should look for device continuity, velocity anomalies, impossible travel, abnormal payee patterns, and session indicators that do not match the customer’s normal profile. Where the risk rises, step-up authentication should force a fresh decision rather than reusing stale trust.
For financial crime and sanctions exposure, the decision also needs current screening. The point is not to re-run full onboarding every time, but to detect conditions that were not visible at account opening, including account compromise, mule activity, or a newly relevant sanctions hit. The FATF Recommendations, AML and KYC framework is useful here because it frames customer due diligence as an ongoing obligation, not a one-off event. For UK- and EU-facing payment teams, the current rule set should also be checked against EBA AML/CFT guidance and the broader AML expectations published by FinCEN.
Risk and Threat Considerations
The main risk is assuming that identity proofing at onboarding still describes the risk state at payment execution. That creates a blind spot for account takeover, device compromise, mule behaviour, and beneficiary change fraud, especially where the payment rail is fast and the window for intervention is short.
Failure mechanism: the attacker does not need to defeat KYC at registration if they can inherit a valid account later, then use the legitimate customer relationship, trusted device history, or stale approval logic to move money at a moment when the organisation is no longer checking the live context.
Impact: the organisation can approve fraudulent payments that appear consistent with an apparently verified customer, which increases direct loss, investigation cost, reimbursement exposure, and the likelihood that sanctions or suspicious-activity obligations are missed at the point where intervention would have mattered.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | IAL — Identity Assurance Levels | KYC establishes initial identity assurance that must be complemented by live payment checks. |
| Recommendation — Use the appropriate assurance level and reauthentication when a payment requires fresh identity confidence. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Payment-time assurance depends on current authenticators, not only onboarding evidence. |
| AU-6 — Audit Review, Analysis, and Reporting | Payment-time anomaly detection needs review of transaction, session, and device signals. | |
| Recommendation — Rotate and validate authenticators so payment approval relies on current, trustworthy credentials. Review transaction logs for anomalies that indicate account takeover or fraudulent payment initiation. | ||
| CIS Controls v8 | CIS-5 — Account Management | KYC gaps at payment time are reduced by controlling active accounts, access, and change events. |
| Recommendation — Continuously manage account changes and disable stale or suspicious access before payment approval. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | The question is about moving from static onboarding identity to current access trust at payment time. |
| Recommendation — Apply stronger access checks when transaction context no longer matches the enrolled customer profile. | ||
Practitioner Guidance
What to prioritise: treat payment-time risk scoring as a separate control from onboarding KYC. The payment decision should be able to override the customer’s historical trust level when the live context changes.
What to verify: confirm that your payment flow can distinguish a verified identity from a currently trustworthy session. If the control set cannot see device, behaviour, and beneficiary-change risk at transaction time, it is not enough for modern fraud patterns.
Decision rule: if the payment is unusual, high value, first-time, or routed through a new device or payee, require step-up authentication and fresh screening before release. If the payment is low risk and the session is stable, the control can remain lighter, but not absent.
Practitioner takeaway: KYC should establish who the customer is, but payment controls must decide whether this specific action is safe right now. The stronger the fraud and sanctions exposure, the less defensible it is to rely on onboarding evidence alone.
Related resources from NHI Mgmt Group
- Guide: Identity Proofing and KYC Guide
- Why do local KYC setups often become insufficient when fintechs expand across African countries?
- Why do financial institutions often require KYC and AML controls when adopting blockchain-based payment systems?
- Why do banks need layered verification instead of relying on a single KYC or KYB check?
- Why do attackers often check model availability before trying to generate content?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org