What does FATF Guidance on Digital Identity (2020) say about AI in banking?

What are the key points of FATF Guidance on Digital Identity (2020)?

• Recommendation 10(a) requires identifying the customer and verifying identity 'using reliable, independent source documents, data or information'; the guidance reads 'reliable, independent' in a digital context as a system whose technology, governance, processes and procedures 'provide appropriate levels of confidence that the system produces accurate results'.
• Two-step risk-based approach (paragraph 7): (a) understand the assurance levels of the digital ID system's main components, including its technology, architecture and governance, and (b) make a broader, risk-based determination of whether, given those levels, the system is appropriately reliable and independent for the ML, TF, fraud and other illicit-financing risks at stake.
• Maps digital ID components to CDD: identity proofing and enrolment, binding of credentials and authentication all bear on Recommendation 10(a); authentication matters where a customer onboards with pre-existing digital ID credentials rather than an in-house solution.
• Relies on open, consensus-driven assurance frameworks and technical standards (NIST 800-63, eIDAS, ISO/IEC work) rather than naming technologies; jurisdictions adapt the approach to their own frameworks.
• Asks regulated entities to reconsider policies that always class non-face-to-face relationships as high-risk (paragraph 25) and says lower-assurance systems may suffice for simplified due diligence where ML/TF risk is low, including tiered CDD that supports financial inclusion (paragraph 24).
• Asks regulated entities to use anti-fraud and cyber-security processes, such as monitoring authentication events for systematic misuse of lost, compromised, stolen or sold credentials, to feed ongoing due diligence and suspicious-transaction monitoring (paragraph 26), and to keep authorities able to obtain the underlying identity evidence (paragraph 27).
• Asks governments for clear, risk-based rules allowing reliable digital ID for CDD (paragraph 12), principles- and outcomes-based identity requirements (paragraph 14), coordination with data-protection and privacy authorities (paragraph 16), regulatory sandboxes (paragraph 17) and audit or certification of digital ID systems against transparent assurance frameworks (paragraph 18).

What did FATF Guidance on Digital Identity (2020) change for banks?

Before the guidance many AML regimes treated remote onboarding as inherently high-risk; it made assurance-level-based digital onboarding a recognised way to satisfy Recommendation 10 and, through NIST 800-63 and eIDAS, tied AML identity verification to the identity-assurance standards that biometric and AI-based KYC vendors are measured against. The FATF's December 2025 horizon scan now warns that deepfakes target exactly the video and biometric checks this guidance enabled, so the assurance-level assessment it asks for has to include synthetic-media resistance.

What does the FATF digital identity guidance ask regulated entities to do?

Paragraphs 22 to 27 of the executive summary address regulated entities directly. They ask a bank to understand how identity proofing and authentication map to the elements of customer due diligence, to take an informed risk-based approach that matches the digital ID system's assurance levels to the ML/TF risk of the customer and product, to consider lower-assurance systems for simplified due diligence, to stop treating every non-face-to-face relationship as high-risk, to use anti-fraud and cyber-security signals from the ID system in ongoing monitoring, and to keep the underlying identity evidence obtainable by authorities. All of it sits under Recommendation 10(a) and 10(d).

WHAT THIS MEANS IN PRACTICE

• Document the assurance level (identity proofing, binding, authentication) of every digital onboarding channel and the ML/TF risk tier it is approved for.
• Add deepfake and injection-attack resistance to the assurance assessment: the FATF's December 2025 horizon scan says deepfakes are used to 'manipulate biometric authentication' and circumvent CDD.
• Route authentication anomalies into transaction monitoring so that account-takeover signals reach the SAR process.