Digital Onboarding

Digital onboarding is the process of taking on a new customer of a bank, payment company or other regulated firm entirely through a website or mobile app, with no visit to a branch and no paper forms. The customer's identity is checked remotely, a practice often called eKYC (electronic know your customer), using a photo of an identity document, a selfie or short video, and checks against official or commercial databases.

It is the remote, technology-led form of general onboarding, which covers every step of bringing a customer or business partner on board, in person or online. Digital onboarding has to meet the same know your customer and anti-money laundering duties as a face-to-face process, so regulators treat it as a different way of collecting evidence rather than a lighter standard. It is the default channel for neobanks, e-money firms, crypto exchanges and brokers.

Opening a bank account used to work like checking into a hotel: you walked to the desk, handed over your passport, and a clerk looked at the photo and then at your face. Digital onboarding moves that desk into your phone. The app asks you to photograph your ID card and then take a short selfie, and software does the clerk's job of comparing the two.

The software also does things a hotel clerk cannot. It checks that the ID has not been tampered with, that the selfie is a live person and not a photo held up to the camera, and that the name is not on a list of people the bank must refuse. If everything lines up, the account can be open in minutes. If something looks wrong, a human reviewer takes a closer look.

Most digital onboarding journeys combine several layers of evidence, because no single check is reliable on its own:

• Data capture. The customer enters name, date of birth, address and, depending on the country, a national identity or tax number.
• Document verification. The app photographs a passport, driving licence or national ID card, reads the printed data and machine-readable zone, and looks for signs of editing. Some apps read the chip in an e-passport over NFC, which gives stronger proof that the document is genuine.
• Biometric match and liveness. A selfie or video is compared with the document photo through biometric verification, while liveness detection tests for printed photos, screen replays, masks and deepfakes.
• Database checks. Electronic identification verification compares the details with credit bureaus, electoral rolls, telecom or government records.
• Screening. The customer is run through sanctions screening, checks for politically exposed persons and adverse media.

The results feed a risk score. Low-risk customers are approved automatically, higher-risk ones go to manual review or to enhanced due diligence, and some are declined. Business customers go through a longer know your business flow that also identifies directors and beneficial owners.

Where a country has a national digital identity system, onboarding can lean on it instead of document photos. In India, Aadhaar-based e-KYC lets a regulated entity pull verified identity data with the customer's consent, and since January 2020 the Reserve Bank of India has allowed a video-based customer identification process (V-CIP) as an alternative to in-person checks. In Pakistan, banks verify customers against the national identity database held by NADRA, often using fingerprint checks. In the EU, the eIDAS framework supports notified electronic identification schemes, and its revision introduces the European Digital Identity Wallet. In the US, banks still rely mostly on a customer identification program built on documentary and non-documentary checks, as the country has no single national digital ID.

The FATF Recommendations are technology-neutral: Recommendation 10 sets out customer due diligence without requiring a face-to-face meeting. The FATF's Guidance on Digital Identity (March 2020) explains how digital ID systems with different assurance levels can support due diligence and tiered accounts, and it notes that well-designed remote onboarding need not be treated as higher risk by default. In the EU, the European Banking Authority's guidelines on remote customer onboarding solutions (EBA/GL/2022/15) have applied since 2 October 2023 and require firms to test their solution before use, manage outsourcing to vendors and keep evidence of every check. In the UK, the Money Laundering Regulations 2017 and industry guidance accept electronic verification where it is reliable.

Data protection rules also apply. Biometric templates are sensitive personal data under the GDPR and similar laws, so firms need a lawful basis, clear consent screens and a data retention schedule for images and verification records.

Remote channels attract organised fraud because an attacker can try many applications at little cost. The main threats are stolen or forged documents, synthetic identity fraud (a made-up person built from real and fake data), deepfake or injected video streams that bypass the camera, and recruited account holders who later act as money mules. Controls include device fingerprinting, checks on email and phone age, velocity limits on applications from the same device or address, and behavioural biometrics that look at how someone types and holds the phone during sign-up.

Firms also design journeys around risk tiers. A customer with a light check may get a low-limit account, which matches the idea of simplified due diligence for low-risk products, and must complete further checks before limits rise. Drop-off during sign-up is a commercial cost, so product teams and compliance teams usually negotiate how many steps each tier requires. Once the account is open, the customer's profile is handed to transaction monitoring, which checks whether actual activity matches what the customer said at onboarding.

• Financial Action Task Force (FATF)
• European Banking Authority