How identity verification works
The law separates two acts. Identification is collecting the customer's details, and verification is proving them on the basis of documents, data or information from a reliable and independent source, the wording of Directive (EU) 2015/849 (Article 13).
- Document check: a passport or identity card, inspected for forgery
- Chip read: the data on the document's chip, read over NFC
- Biometric match: a selfie compared with the document's photo, with a liveness check
- Database check: details matched against registers or credit bureau data
- Electronic identity: a national eID scheme or another trusted digital identity
When identity has to be verified
In the EU, identity is verified before a business relationship starts or a transaction is carried out. Member States may allow verification to be completed while the relationship is being set up, where that is needed so as not to interrupt normal business and the risk is low (Article 14).
A firm that cannot complete the checks does not open the relationship or carry out the transaction, and considers making a report. In the UK, regulation 28 of the Money Laundering Regulations 2017 sets the duty, and counts a document issued by an official body as independent even when the customer supplies it.
From 10 July 2027, the EU's AML Regulation fixes the data to collect for a person: all names, place and full date of birth, nationalities and usual place of residence (Article 22).
Where identity verification sits in a product
Verification runs at onboarding, and again when details change, a document expires or something looks wrong. The result feeds the risk score, the sanctions and PEP screening and the account limits. A pass says that the identity is real and belongs to the applicant, not that the customer is low risk.
Identity verification, authentication or KYC?
- Authentication
- Confirms that a returning user is the person verified earlier, with a password, a device or biometrics. Verification happens first, and far less often.
- KYC
- The full duty: verification, plus beneficial owners, the purpose of the relationship and ongoing monitoring.
- Age verification
- Checks only that a person is above a set age, and may not establish who the person is.
Where Identity verification shows up in a platform
Modules that do the work
- KYC / AMLIdentity checks, screening and ongoing monitoring, with the verification provider you choose.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
- Directive (EU) 2015/849, the Anti-Money Laundering Directive, consolidated (EUR-Lex)
- Money Laundering Regulations 2017 (legislation.gov.uk)
- Regulation (EU) 2024/1624, the AML Regulation (EUR-Lex)
General information, not legal advice: what applies to you depends on your services and your market.