Advanced: remote identity proofing and assurance levels.

Digital identity and customer due diligence

FATF Recommendation 10 asks institutions to identify customers and verify that identity "using reliable, independent source documents, data or information". It says nothing about paper versus digital. In 2020 the FATF published its Guidance on Digital Identity to explain how digital identity systems can meet that test.

The guidance splits a digital identity system into parts, and you should too:

• Identity proofing and enrolment answers "who are you?". It collects evidence, checks the evidence is genuine (validation), makes sure the identity is unique, links the person to the evidence (verification, for example a face comparison with liveness) and finally binds the verified identity to authenticators the person controls.
• Authentication answers "are you the same person who was proofed?" each time they return, using something they have, know or are. One factor alone is generally not considered trustworthy enough.
• Portability or federation, an optional part, lets one verified identity be used with other services.

Assurance levels describe how much confidence you can place in each part. The FATF says they help decide whether a digital identity system is "reliable, independent" in the sense of Recommendation 10. It does not prescribe any particular level and treats a level as a floor, not a ceiling.

Remote is not automatically high risk. The FATF's interpretive note lists non-face-to-face business as an example of possibly higher risk, but the 2020 guidance says remote onboarding that relies on reliable, independent digital identity with proper controls may be standard risk, or even lower risk at higher assurance levels. The FATF's 2025 financial inclusion guidance repeats the point: remote relationships are a higher-risk example only where suitable controls are missing, and enhanced due diligence should not be applied to every remote customer by default.

The guidance offers a three-question decision path for an institution: is this digital identity system authorised by government for due diligence; if not, do you know its assurance levels, by certification or your own assessment; and are those levels right for the money laundering and fraud risk of the product? Each part, proofing and authentication, is judged separately and need not sit at the same level.

Assurance levels in NIST SP 800-63-4

The US National Institute of Standards and Technology (NIST) published the final SP 800-63-4 digital identity guidelines in July 2025, replacing the 2017 version. They are written for US federal agencies and are voluntary for everyone else, but they are the most detailed public reference model and are widely used outside the US.

NIST keeps three separate scales:

• IAL, identity assurance level, for proofing;
• AAL, authenticator assurance level, for logging in;
• FAL, federation assurance level, for sharing an identity with other services.

An organisation assesses the impact of getting identity wrong and picks each level separately, then records its choices and any adjustments.

The identity assurance levels (SP 800-63A-4):

• IAL1 gives some assurance that the identity exists and that the applicant is linked to it. It can be done remotely or in person, with or without a person watching.
• IAL2 needs more evidence and stronger checks, and is designed to resist targeted attacks and basic forgery. It can also be remote and unattended.
• IAL3 must be done on site, attended by a trained proofing agent, though the agent may attend through a kiosk the provider controls, and a biometric is collected and kept.

Evidence is graded fair, strong or superior. Superior evidence carries attributes signed by the issuer and verifiable cryptographically, as on a chip-based passport. IAL2 needs, for example, two pieces of strong evidence or one superior.

The 2025 revision adds requirements that matter for eKYC:

• Knowledge-based questions (such as "which of these addresses have you lived at?") may no longer be used to verify identity.
• Providers must run a fraud management programme, including checks against death records and analysis of remote channels for high-risk signals.
• Remote biometric capture must use presentation attack detection tested to ISO/IEC 30107-3, and face matching has published accuracy targets, including a limit on how much worse it may perform for any demographic group.
• All remote proofing needs controls against injected and forged media, such as detecting virtual cameras and emulators. NIST notes that a biometric comparison on a captured sample does not by itself stop these attacks.
• Account recovery, a common weak point, has its own rules and must always trigger a notification to the account holder.

The EU approach and remote onboarding rules

eIDAS levels. The EU's eIDAS Regulation of 2014 sets three assurance levels for electronic identification means: low, substantial and high. An implementing regulation in 2015 sets what identity proofing each level requires. At substantial, the person must be verified as holding recognised evidence that is checked as genuine, with steps against lost, stolen or expired documents. At high, the evidence must include a photo or biometric checked against an authoritative source, and the person must be compared physically with it. Unlike NIST, an eIDAS level applies to the whole identification means, not to each part, and neither framework publishes an official mapping between the two scales.

The European Digital Identity Wallet. The 2024 revision of eIDAS requires each member state to provide at least one wallet, free to individuals and issued at assurance level high. Regulated private services that must use strong customer authentication, banks among them, must accept the wallet when a user chooses it. Both deadlines run from implementing acts adopted in late 2024, which places them at roughly the end of 2026 for wallets and the end of 2027 for banks.

ETSI TS 119 461 (2025), the European standard for identity proofing for trust services, sets two levels, baseline (substantial confidence) and extended (high confidence), and names presentation and injection attacks, including deepfakes, as threats. From 2027 it becomes the reference standard for qualified certificates under EU law. It is not an anti-money laundering rule for banks.

The EBA guidelines on remote customer onboarding apply to EU banks and financial institutions from 2 October 2023. They are a useful checklist wherever you operate:

• written policies on which customers and products may be onboarded remotely, which steps are automated and which involve a person;
• an assessment and testing of the solution, including against fraud and impersonation, before it goes live, and ongoing monitoring with review triggered by rising fraud attempts;
• document checks on security features, tampering, the MRZ check digits, and whether the image was simply photographed from a screen, using chip data where feasible;
• for unattended checks, a photo or video taken at that moment, liveness detection and strong matching; for video calls, a trained employee and an interview guide; and some randomness so that attackers cannot rehearse;
• extra checks where risk is higher, such as a first payment from an account in the customer's own name at a regulated institution.

Reliance, re-use and the weak points after onboarding

Reliance. Under FATF Recommendation 17, an institution may rely on a regulated third party for parts of due diligence, but it must obtain the identity information immediately, be able to get the underlying evidence without delay, consider country risk, and keep ultimate responsibility. In a digital identity setting, the FATF adds that the relying institution should also obtain the assurance levels involved. Outsourcing to an identity service provider is not reliance: the institution remains responsible for the provider's work. Reliance covers onboarding, not ongoing due diligence.

Re-use. A strong identity proved once can be used again. eIDAS allows a new identification means to be derived from an existing notified substantial or high one without repeating the proofing, and the EU wallet is built for this. The FATF encourages institutions to judge proofing strength and authentication strength separately when they rely on such identities.

The weak points are after onboarding. A perfectly proofed account can still be taken over or sold:

• Authentication attacks such as credential stuffing, phishing and interception of one-time codes; the FATF notes that SMS codes can be phished and points to phishing-resistant authenticators.
• Credential selling and mules: account holders who sell or rent their verified accounts, which the FATF calls digital mules.
• Account recovery, where an attacker who cannot pass proofing simply claims to have lost access. NIST requires recovery to be at least as strong as the account's authentication, with a notification every time.

The FATF encourages using authentication data, such as device and location signals, in ongoing monitoring. The practical lesson is that identity assurance is a life cycle, not a single check at the door.

Inclusion without lowering the bar

Strict identity rules can shut people out. The World Bank's ID4D programme estimates that about 800 million people worldwide have no official identity document and at least 2.8 billion have no government-recognised digital identity to transact online (2025 estimates). The FATF's 2025 guidance says an overly cautious approach can exclude legitimate customers, and that exclusion itself is a money laundering risk because it pushes people to informal channels.

The frameworks offer tools rather than shortcuts:

• Tiered or progressive due diligence: lower proofing for low-risk products with limits, raised as the customer's needs grow. The FATF suggests pairing lower proofing with stronger authentication.
• More than one route: NIST asks providers to offer several proofing types and verification pathways that give comparable assurance overall, for example a non-biometric route alongside a biometric one.
• Trusted referees and applicant references: in NIST's 2025 terms, a trusted referee is a trained agent who can make a risk-based decision when someone cannot complete the normal process, and an applicant reference is a person who vouches for the applicant and is proofed themselves. Their sessions are recorded with reasons.
• Biometric alternatives: the FATF notes that biometric-only methods can exclude, for example, older people and manual workers with worn fingerprints.

Data protection runs through all of this. NIST limits proofing data to the minimum needed to establish the identity, prevent fraud and serve the relying service, and requires consent and published retention rules for biometrics. The EBA asks for defined retention periods and logged access. The FATF asks anti-money laundering and data protection authorities to coordinate.

In Kenya: the Proceeds of Crime and Anti-Money Laundering Regulations, 2023 require reporting institutions to verify identity using reliable, independent sources and to have policies for the risks of non-face-to-face relationships, both at onboarding and afterwards; reliance on third parties is allowed with a written agreement and ultimate responsibility kept by the institution. For payment service providers, the National Payment System Regulations, 2014 require customers' identity numbers to be verified independently through the national population register (formerly IPRS) or other means the Central Bank approves. The Central Bank's older prudential guideline asks that non-face-to-face checks confirm identity as robustly as face-to-face ones. Check the current rules and any newer Central Bank guidance.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.