Know Your Customer rules were designed to stop financial crime, but in practice, they are increasingly being bypassed by both human error and machine-generated deception.
Last year, Barclays was fined £42 million (roughly $56.9 million) for failing to properly vet clients for money laundering risks. In this case, the UK lender had access to all the information required to flag the offending clients but failed to follow through.
More broadly, similar issues persist across the banking sector. In many instances, institutions conduct perfunctory KYC checks during onboarding but fail to maintain ongoing monitoring. It is often only after the fact that they discover their “verified” customers had been bribed or coerced into becoming money mules.
Meanwhile, the threat landscape itself is also evolving. In a growing number of recent cases, cybercriminals have used technologies such as artificial intelligence to generate convincing fake documents and synthetic identities capable of bypassing financial institutions’ verification protocols.
Taken together, these challenges are driving a broader assessment of the KYC model. In a recent PaymentsJournal podcast, Jon Jones, Chief Commercial Officer at Data Zoo, and Jennifer Pitt, Senior Fraud Analyst at Javelin Strategy & Research, discussed how these risks are accelerating the evolution of identity verification, and how trusted data within a layered approach has become essential to identifying and addressing modern fraud threats.
Establishing Trusted Registries
Although the pandemic is often credited with accelerating the shift toward digital identity proofing, the change had already been underway for years. One key driver has been the growthof the digital economy, which has helped organizations build substantial datasets on users’ biometric information, behavioral analytics, and device intelligence.
While this data can be a powerful tool for identity verification, it is of limited value if it is inaccurate.
“The role of data in KYC is becoming increasingly important and it comes down to one word: trust,” Jones said. “The advancement of AI has resulted in single-layered solutions becoming somewhat compromised and institutions increasingly need to leverage authoritative data. For example, checks through government or credit-based authorities have become table stakes going forward.”
“If you look at fake images and documents, it’s very easy to have them created now,” he said. “Creating a synthetic identity from an image or a document is not that hard, but maintaining the presence and consistency across government records or credit bureaus is much harder. It requires the need for trusted registries in some form of the process.”
Synthetic identities pose a particular challenge because they are created by blending real and fabricated data into a new entity. This means there is no direct victim to report fraudulent activity, and often no clear red flags for organizations at onboarding.
This is just one of the reasons why changes to the current KYC model have become paramount.
“When I was in banking, I saw that KYC was treated as a onetime check and the KYC team would just look at static identity data,” Pitt said. “Once that matched, they would move on, and KYC wasn’t being done after that initial check. What we need is the idea of perpetual or continuous KYC, where we’re using automated tools to look at KYC or identity verification processes in the background.”
The Three Levels
In addition to ongoing customer checks, there must be protocols in place to continuously validate data. Data has become the lifeblood of an effective KYC process, and the potential for corruption through fraudulent or erroneous information makes stringent verification essential.
“We typically look at trust from three levels,” Jones said. “The first one is the authoritative nature of the data, meaning does it come from a real-time primary source like a government record or an M&O with clear privacy policy guidance? This is essential. The second one is looking at transparency. Organizations need to see what data sources were checked, what attribute levels were matched, and what level they were matched.”
“The third one is basic coverage,” he said. “From an identity verification perspective, we work in a global world. It’s not just a U.S.-based or UK-based solution, where data is prevalent. It’s looking to make sure that we are catering for all geographies and all demographics, and that isn’t easy.”
One of the most challenging demographics to evaluate is the thin-file population, often composed of young adults or immigrants with limited or no credit history. Due to this reduced digital footprint, it can be difficult to verify their identities, yet this group now comprises roughly 76 million people in the U.S., or about a third of all adults.
Another challenge in maintaining accurate data is that customer profiles are constantly changing as individuals open new accounts or update addresses. This fluidity makes it critical to implement mechanisms that can constantly check and cross-check information.
“One of the things organizations often miss is there are two parts of identity verification,” Pitt said. “There’s the identity verification itself, is the information being presented that of a real person? That addresses things like synthetics, deepfakes, information that is not that of a real person.”
“The other piece is identity proofing. Is that identity that’s being presented the actual identity of the person that’s presenting it?” she said. “We need to make sure we have both of those pieces and not just one.”
Data Confirms Identity
Evolving toward a more effective KYC model will require a layered identity verification approach. This model evaluates multiple factors, including known identity data, biometrics, behavioral and contextual signals, device interaction patterns, and shared threat intelligence.
It is critical to take all these inputs so that no single data point is given undue weight.
“Trusted data sits within the verification workflow as a foundational layer and asks the question, does this identity actually exist in the real world?” Jones said. “Capabilities such as document verification are extremely powerful. I’ve worked for some of the leading vendors in the world, and they asked the question as to whether the person presenting a document is real and matches the ID, whereas trusted data helps confirm that the identity itself exists and is consistent across multiple records.”
“Biometrics confirms the person and data confirms the identity, and you need both,” he said.
Alongside improved fraud detection, one of the biggest advantages of a layered verification approach is that it can strengthen security without increasing customer friction.
For example, if an organization begins with document verification as the first step in the onboarding workflow, it can extract most of the data required for trusted validation from these documents. This includes information such as name, address, national ID, and date of birth—all of which can be captured using optical character recognition (OCR) technology.
“When we talk about identity verification, we often talk about this from the fraud detection lens, but identity verification can help with other things,” Pitt said. “It does reduce customer friction for people that aren’t fraudsters, and it improves the customer experience because of that. It helps with compliance issues, and it also enables institutions to apply more risk-based verification to determine where and when additional data checks need to be invoked.”
Defense in Depth
The benefits of adopting a layered identity verification approach are spurring the metamorphosis of Know Your Customer, Know Your Business, and anti-money laundering processes.
“I like to think of it as defense in depth, which is what cybersecurity professionals tend to call it,” Pitt said. “The idea that one fraud detection method might be thwarted by fraudsters and then there is another defense that might help. We’re going to start to see a shift more towards this perpetual or ongoing KYC. For any good-sized business, we need to be able to vet the customers and vet who is actually doing business with us.”
As identity verification tools evolve, there will likely be a continued shift towards secure, portable digital identity schemes that enable online verification of consumers.
For example, Australia’s ConnectID is a program which allows users to verify their identity with businesses or government agencies using information already verified by their financial institution. The objective is to simplify online verification and reduce unnecessary data sharing.
Some of the primary use cases for such programs include age verification, which has become a pressing need in many online environments. This includes both safeguards to protect children and requirements to ensure adults meet age thresholds of 18 or 21, depending on jurisdiction.
Alongside these developments, the overarching driver behind the need for stronger identity verification models is the rapid proliferation of sophisticated technologies.
“We’re going to continue to see a shift to a data-first model, which from AI perspective is driving the element of trust to the forefront,” Jones said. “To do that, you need to be 100% reliant on direct real-time validation against trusted assets and you need to do that globally. Increased adoption is going to come by using data as a layer within orchestration workflows.”
The post The Future of KYC Is Layered—and Data-Driven appeared first on PaymentsJournal.
