Identity Verification Requirements Map: KYC, Age and Remote Onboarding Rules by Economy

The same remote onboarding flow can be compliant in one market and unlawful in the next, because each economy sets its own rules on what identity evidence counts, how it is checked and how long the proof is kept. A selfie and document check that satisfies a UK bank under the Money Laundering Regulations may fall short of the European Banking Authority's remote onboarding guidelines, and neither matches the live video process the Reserve Bank of India requires. This map sets the customer identification and verification rules of the European Union, India, Singapore, the United Kingdom and the United States side by side, shows what each says about remote and electronic verification, and notes where age checks add a separate duty. For how proofing itself works, see the Identity Proofing and KYC Guide. This map is for onboarding product owners, financial crime and compliance leads, and the identity engineers who build and secure the verification pipeline. Status as of 12 November 2026.

Source note: this map summarises the official texts linked in the references (EUR-Lex, EBA, legislation.gov.uk, eCFR, RBI and MAS) as of 12 November 2026. Confirm against the official text before relying on it.

Key takeaways

• Every regime asks the same three questions. Identify the customer, verify the identity against a reliable and independent source, and understand the purpose of the relationship. They differ on which sources count, when verification must finish and what remote methods are allowed.
• Electronic identity is now written into the law. The EU AML Regulation names eIDAS electronic identification at substantial or high assurance and qualified trust services as valid verification means, and UK regulation 28(19) accepts an electronic identification process that is secure from fraud and misuse.
• Remote onboarding has its own control set in some markets. The EBA guidelines (applying since 2 October 2023) and the RBI's Video based Customer Identification Process set specific requirements for liveness, document authenticity, recording, evidence storage and outsourcing.
• Timing differs and drives product design. The EU requires verification before the relationship starts (with narrow exceptions and a no-transactions rule), while US banks verify within a reasonable time after the account is opened.
• Proof of the check is itself an obligation. Records of what was checked, how and with what result must be kept (five years under the US Customer Identification Program rule), which makes the verification evidence store a high-value target that needs its own security controls.

Regulations and frameworks at a glance

Until 10 July 2027 the EBA guidelines operate under the AML Directive regime; the Regulation then takes over the CDD rules.

Scope: who must verify, and what triggers it

All five regimes attach the duty to regulated financial activity, not to identity verification as such. Three triggers recur.

• Establishing a business relationship: opening an account or starting an ongoing relationship.
• Occasional transactions: one-off transactions above thresholds set in each regime, which require due diligence even without an account.
• Doubt or change: suspicion of money laundering, doubts about previously obtained identification data, or a change in the customer's risk. India adds fixed periodic updation: at least every 2 years for high-risk customers, 8 years for medium risk and 10 years for low risk, counted from account opening or the last update.

Beneficial owners are verified too: EU Article 22(7) applies the same verification options and requires central registers to be consulted. Business onboarding is covered in the KYB Guide.

What each regime requires

European Union

• Verification means (Article 22(6)): an identity document, passport or equivalent, or electronic identification means that meet the requirements of the eIDAS Regulation, (EU) No 910/2014, at assurance level substantial or high, or relevant qualified trust services. Recital 66 says electronic identification under eIDAS should be taken into account and accepted by obliged entities.
• Timing (Article 23): verification takes place before the business relationship is established. It may be completed during establishment where that is needed not to interrupt normal business and the risk is low, as soon as practicable after initial contact. A credit or financial institution may open an account before verification is complete only if safeguards stop any transaction until the measures are done.
• Technical standards (Article 28(1)): the Anti-Money Laundering Authority (AMLA) was given until 10 July 2026 to draft standards that include the reliable and independent sources usable for verification and the attributes that electronic identification means and qualified trust services must carry. Confirm the adopted text before designing to it.
• Wallets: the European Digital Identity Wallet is built on the eIDAS framework that Article 22(6) points to. See the eIDAS 2.0 Guide for the wallet rules and the EU AML Regulation and AMLA Guide for the wider AML package.

India

• V-CIP as face-to-face: the RBI (Commercial Banks - Know Your Customer) Directions, 2025, which consolidated the 2016 KYC Master Direction, define the Video based Customer Identification Process (paragraph 5(2)(xvi)) and set its minimum standards in paragraph 27. It is a live, informed-consent audio-visual interaction run only by specially trained officials of the regulated entity, with questions varied so the session cannot be pre-recorded.
• Technical controls (paragraph 27(1)): face liveness and spoof detection with high-accuracy face matching, blocking of IP addresses from outside India or spoofed addresses, live GPS coordinates and a date-time stamp on the recording, and vulnerability assessment, penetration testing and security audit by CERT-In empanelled auditors.
• Data sovereignty and ownership: infrastructure sits on the regulated entity's premises and secured network; where cloud is used, the entity owns the data, recordings move to its servers immediately after the session and the technology provider retains none. Data and recordings are stored in India.
• Evidence sources: Aadhaar OTP e-KYC, offline Aadhaar verification (XML or QR no more than three working days old at the time of V-CIP), CKYCR records and equivalent e-documents including DigiLocker. See the India Aadhaar and Digital Public Infrastructure guide.
• Go-live gate: accounts opened through V-CIP become operational only after a concurrent audit.

Singapore

• Verification (paragraph 6.9): banks verify the customer's identity using reliable, independent source data, documents or information; persons appointed to act for the customer (6.10(b)) and beneficial owners (6.14B, reasonable steps) are verified to the same type of source.
• Non-face-to-face (paragraphs 6.27 to 6.29): banks must have policies and procedures addressing the specific risks of non-face-to-face relations and transactions, apply them at onboarding and in ongoing due diligence, and perform CDD measures at least as robust as those required in person.
• Timing (paragraphs 6.32 to 6.34): verification is completed before business relations start and before set non-account transactions (for example a transaction over S$20,000 or a cross-border wire transfer over S$1,500). Deferral is allowed only where essential not to interrupt normal business and the risk is managed, with verification completed as soon as reasonably practicable.
• Records (paragraph 12.3): CDD information kept for at least five years after the relationship ends or the transaction completes, longer where linked to an investigation or suspicious transaction report.

United Kingdom

• Customer due diligence (regulation 28(2)): identify the customer, verify the identity unless already verified, and assess and where appropriate obtain information on the purpose and intended nature of the relationship.
• Reliable source (regulation 28(18)): verify on the basis of documents or information obtained from a reliable source independent of the customer. Documents issued or made available by an official body count as independent even when the customer supplies them.
• Electronic identification (regulation 28(19)): information from an electronic identification process, including electronic identification means or a trust service, counts as reliable and independent where the process is secure from fraud and misuse and capable of providing assurance that the person is who they claim to be, to the degree necessary for the money laundering and terrorist financing risk.

Regulation 28(19) is a security test, not a technology list: a firm relying on a remote verification provider must be able to show why the process resists fraud and misuse.

United States

• Minimum information (31 CFR 1020.220(a)(2)(i)): name, date of birth for individuals, a residential or business street address, and an identification number (a taxpayer identification number for US persons; for non-US persons a TIN, passport number and issuing country, alien identification card number or another government photo document).
• Verification (a)(2)(ii): within a reasonable time after the account is opened, through documents (an unexpired government-issued photo ID for individuals), non-documentary methods (contacting the customer, checking a consumer reporting agency or public database, references from other financial institutions, a financial statement), or both. Procedures must address customers without photo ID, unfamiliar documents and accounts opened without an in-person visit.
• Records (a)(3): identifying information kept for five years after the account is closed; verification records, including the method used, results and how discrepancies were resolved, kept for five years after the record is made.

Remote onboarding controls the rules expect

The EBA guidelines are the most detailed published control set for remote onboarding, and the RBI rules overlap with them closely.

Neither text names injection attacks or deepfakes in these words, but "capture at the time of verification" and "detect images captured from a screen" are exactly the checks those attacks defeat. The Deepfake-Resistant Identity Verification Guide and the Biometric Liveness and Presentation Attack Detection Guide cover the techniques.

Age checks: a separate duty with different rules

Age assurance laws sit outside the AML regimes and answer a different question: is this user a child, not who is this person. In the UK, section 12 of the Online Safety Act 2023 requires in-scope services to use age verification or age estimation, or both, to prevent children encountering primary priority content harmful to children, and the method must be highly effective at correctly determining whether a user is a child. Two design consequences follow.

• Different evidence: age estimation may be acceptable for an age gate but is not identity verification for KYC; do not reuse one result as the other.
• Data minimisation: an age check should return an over or under answer, not a stored identity document, unless another rule requires the document.

Australia, US state laws and children's design codes are mapped in Age Assurance and Children's Design Codes, and methods in the Age Assurance Guide.

Where identity fits: securing the verification pipeline

Every regime above produces a store of identity documents, face images, video and verification results, and every remote flow depends on machine-to-machine connections to verification providers, registries and wallets. Those connections run on API keys, client credentials and signing keys: non-human identities that can read or alter the most sensitive customer data the firm holds.

• Provider credentials: give each integration its own credential with the narrowest scope, rotate it, and alert on use from unexpected networks. See the API Key Management Guide.
• Result integrity: accept verification outcomes only through signed callbacks or authenticated pulls, so a forged "pass" cannot be injected into the onboarding workflow.
• Evidence access: restrict read access to the evidence store to named investigators and audit every retrieval; bulk export should need approval.
• Compromise planning: a breached verification provider exposes documents that cannot be rotated. See the identity verification platform compromise playbook.

Compliance steps

1. Inventory flows by market: list every onboarding and recovery flow, the economies it serves and the licence under which each customer is onboarded.
2. Map each flow to its rule: record the instrument, the verification means accepted, the timing rule and the record retention period from the table above.
3. Close timing gaps: where the EU before-relationship rule applies, enforce a hard block on transactions until CDD completes, and test it.
4. Run the pre-implementation assessment: for EU and EEA flows, document the EBA paragraph 13 to 17 assessment, including fraud and ICT testing, before launch and after material change.
5. Add electronic identity routes: accept eIDAS substantial or high means and qualified trust services where the EU Regulation allows them, and plan for wallet-based presentation.
6. Contract for the rules: put data location, retention, change notice and audit rights into provider contracts; for India, confirm the provider retains no V-CIP data.
7. Prove it: keep a supervisor-ready pack per market: policy, assessment, test results, monitoring reviews and sample evidence records.

Measures: flows with a current documented assessment, accounts transacting before CDD completed (target zero), early-life fraud rate per flow, and provider credentials past their rotation date.

Common failure patterns

• One global flow: a single selfie and document flow shipped to every market without checking local rules, such as India's live video and data location requirements.
• Accounts that transact early: account opening allowed before verification without the no-transactions safeguard that EU Article 23(3) requires.
• Uploads treated as live capture: gallery uploads or camera feeds accepted without checks for screen capture or injected video, which defeats the "capture at the time of verification" expectation.
• Evidence kept without protection: years of passport images and selfies retained to meet record rules but stored with broad access and long-lived provider credentials.

Practitioner checklist

• Maintain a register of onboarding flows by economy with the governing instrument and status date.
• Block transactions until CDD completes wherever the EU timing rule applies.
• Keep a dated pre-implementation assessment and test report for each remote solution.
• Require live capture with liveness, screen-capture and injection detection on every remote flow.
• Accept eIDAS substantial or high electronic identification and qualified trust services where allowed.
• Set retention per market (five years under the US CIP rule) and delete on schedule.
• Scope, rotate and monitor every verification provider credential and signing key.
• Recheck AMLA technical standards and national rules quarterly and update this register.

Standards and references

• EUR-Lex: Regulation (EU) 2024/1624 on the prevention of the use of the financial system for money laundering or terrorist financing
• European Banking Authority: Guidelines on the use of remote customer onboarding solutions (EBA/GL/2022/15)
• legislation.gov.uk: Money Laundering Regulations 2017, regulation 28
• eCFR: 31 CFR 1020.220, Customer identification program requirements for banks
• Reserve Bank of India: (Commercial Banks - Know Your Customer) Directions, 2025
• Monetary Authority of Singapore: Notice 626 on prevention of money laundering and countering the financing of terrorism (banks)
• legislation.gov.uk: Online Safety Act 2023, section 12

This guide summarises identity verification and KYC requirements as of 12 November 2026 and is not legal advice. Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Perpetual KYC · Age Assurance and Children's Design Codes · Identity Security Regulatory Map