# FATF Guidance on Digital Identity (2020): Guidance on Digital Identity

Source: https://www.bankingnewsai.com/ai-regulation/documents/fatf-digital-identity-guidance-2020
Last updated: Oct 15, 2026

The FATF's Guidance on Digital Identity, published on 6 March 2020, explains how regulated entities can use digital ID systems to meet the customer identification and verification requirement of Recommendation 10(a) and to support ongoing due diligence under Recommendation 10(d). Its test is reliability and independence: understand the assurance levels of the digital ID system's identity proofing, authentication and governance, using frameworks such as the NIST 800-63 Digital Identity Guidelines and the EU's eIDAS regulation, then decide whether those levels are appropriate for the money-laundering and terrorist-financing risks at stake. It says non-face-to-face onboarding that relies on a reliable, independent digital ID with appropriate risk mitigation 'may present a standard level of risk, and may even be lower-risk', and it is technology-neutral and non-binding.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) |
| Type | Guidance |
| Status | Final |
| Published | Mar 6, 2020 |
| Applies to | Governments and AML/CFT supervisors; financial institutions, virtual asset service providers and designated non-financial businesses using digital ID systems for customer due diligence under Recommendation 10; digital ID service providers (non-binding) |
| Official text | https://www.fatf-gafi.org/en/publications/Financialinclusionandnpoissues/Digital-identity-guidance.html |

## Key points

- Recommendation 10(a) requires identifying the customer and verifying identity 'using reliable, independent source documents, data or information'; the guidance reads 'reliable, independent' in a digital context as a system whose technology, governance, processes and procedures 'provide appropriate levels of confidence that the system produces accurate results'.
- Two-step risk-based approach (paragraph 7): (a) understand the assurance levels of the digital ID system's main components, including its technology, architecture and governance, and (b) make a broader, risk-based determination of whether, given those levels, the system is appropriately reliable and independent for the ML, TF, fraud and other illicit-financing risks at stake.
- Maps digital ID components to CDD: identity proofing and enrolment, binding of credentials and authentication all bear on Recommendation 10(a); authentication matters where a customer onboards with pre-existing digital ID credentials rather than an in-house solution.
- Relies on open, consensus-driven assurance frameworks and technical standards (NIST 800-63, eIDAS, ISO/IEC work) rather than naming technologies; jurisdictions adapt the approach to their own frameworks.
- Asks regulated entities to reconsider policies that always class non-face-to-face relationships as high-risk (paragraph 25) and says lower-assurance systems may suffice for simplified due diligence where ML/TF risk is low, including tiered CDD that supports financial inclusion (paragraph 24).
- Asks regulated entities to use anti-fraud and cyber-security processes, such as monitoring authentication events for systematic misuse of lost, compromised, stolen or sold credentials, to feed ongoing due diligence and suspicious-transaction monitoring (paragraph 26), and to keep authorities able to obtain the underlying identity evidence (paragraph 27).
- Asks governments for clear, risk-based rules allowing reliable digital ID for CDD (paragraph 12), principles- and outcomes-based identity requirements (paragraph 14), coordination with data-protection and privacy authorities (paragraph 16), regulatory sandboxes (paragraph 17) and audit or certification of digital ID systems against transparent assurance frameworks (paragraph 18).

## What changed for banks

Before the guidance many AML regimes treated remote onboarding as inherently high-risk; it made assurance-level-based digital onboarding a recognised way to satisfy Recommendation 10 and, through NIST 800-63 and eIDAS, tied AML identity verification to the identity-assurance standards that biometric and AI-based KYC vendors are measured against. The FATF's December 2025 horizon scan now warns that deepfakes target exactly the video and biometric checks this guidance enabled, so the assurance-level assessment it asks for has to include synthetic-media resistance.

## Use cases it governs

- [AML / KYC](https://www.bankingnewsai.com/ai-regulation/by-use-case#aml-kyc)
- [Fraud detection](https://www.bankingnewsai.com/ai-regulation/by-use-case#fraud)
- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)
- [Cybersecurity](https://www.bankingnewsai.com/ai-regulation/by-use-case#cybersecurity)

## What does the FATF digital identity guidance ask regulated entities to do?

Paragraphs 22 to 27 of the executive summary address regulated entities directly. They ask a bank to understand how identity proofing and authentication map to the elements of customer due diligence, to take an informed risk-based approach that matches the digital ID system's assurance levels to the ML/TF risk of the customer and product, to consider lower-assurance systems for simplified due diligence, to stop treating every non-face-to-face relationship as high-risk, to use anti-fraud and cyber-security signals from the ID system in ongoing monitoring, and to keep the underlying identity evidence obtainable by authorities. All of it sits under Recommendation 10(a) and 10(d).

| Rule | Authority | What it requires | Status | Source |
| --- | --- | --- | --- | --- |
| Recommendation 10(a) — reliable, independent verification | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) | The underlying obligation the guidance applies: verify identity 'using reliable, independent source documents, data or information'. | In force | [FATF Recommendations](https://www.bankingnewsai.com/ai-regulation/documents/fatf-recommendations) |
| Guidance paragraph 22 | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) | Understand the basic components of digital ID systems, particularly identity proofing and authentication, and how they apply to the required CDD elements. | Non-binding guidance, March 2020 | [FATF Guidance on Digital Identity (2020)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-digital-identity-guidance-2020) |
| Guidance paragraph 23 | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) | Take an informed risk-based approach to relying on digital ID for CDD: understand the system's assurance levels for identity proofing and authentication, and ensure they are appropriate for the ML/TF risks of the customer, product, jurisdiction and geographic reach. | Non-binding guidance, March 2020 | [FATF Guidance on Digital Identity (2020)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-digital-identity-guidance-2020) |
| Guidance paragraph 24 | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) | Consider whether lower-assurance digital ID systems may be sufficient for simplified due diligence in low-risk cases, including a tiered CDD approach that supports financial inclusion where permitted. | Non-binding guidance, March 2020 | [FATF Guidance on Digital Identity (2020)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-digital-identity-guidance-2020) |
| Guidance paragraph 25 | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) | Review internal policies that always classify non-face-to-face relationships or transactions as high-risk: verification on reliable, independent digital ID with appropriate mitigation 'may be standard risk, and may even be lower-risk'. | Non-binding guidance, March 2020 | [FATF Guidance on Digital Identity (2020)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-digital-identity-guidance-2020) |
| Guidance paragraph 26 | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) | Use anti-fraud and cyber-security processes to support identity proofing and authentication, for example monitoring authentication events to detect systematic misuse of lost, compromised, stolen or sold credentials, and feed them into ongoing due diligence and suspicious-transaction monitoring. | Non-binding guidance, March 2020 | [FATF Guidance on Digital Identity (2020)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-digital-identity-guidance-2020) |
| Guidance paragraph 27 | [FATF](https://www.bankingnewsai.com/ai-regulation/fatf) | Ensure access to, or a process for authorities to obtain, the underlying identity information and evidence used for identification and verification. | Non-binding guidance, March 2020 | [FATF Guidance on Digital Identity (2020)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-digital-identity-guidance-2020) |

### What this means in practice

- Document the assurance level (identity proofing, binding, authentication) of every digital onboarding channel and the ML/TF risk tier it is approved for.
- Add deepfake and injection-attack resistance to the assurance assessment: the FATF's December 2025 horizon scan says deepfakes are used to 'manipulate biometric authentication' and circumvent CDD.
- Route authentication anomalies into transaction monitoring so that account-takeover signals reach the SAR process.

## FAQ

### Can a bank rely on digital ID for KYC under the FATF standards?

Yes, where national law allows it. The guidance says a digital ID system can satisfy the 'reliable, independent' verification requirement of Recommendation 10(a) if the regulated entity understands the system's assurance levels for identity proofing and authentication and judges them appropriate for the ML/TF risks of the customer, product and jurisdiction.

### Is remote onboarding high-risk under the FATF digital identity guidance?

Not automatically. The guidance says non-face-to-face identification that relies on reliable, independent digital ID systems with appropriate risk-mitigation measures 'may present a standard level of risk, and may even be lower-risk', and asks regulated entities that always classify remote relationships as high-risk to review that policy (paragraph 25).

## Related documents

- [FATF horizon scan on AI and deepfakes (2025)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-horizon-scan-ai-deepfakes-2025) — Horizon Scan: Artificial Intelligence and Deepfakes — Impacts on Money Laundering, Terrorist Financing and Proliferation Financing (Dec 22, 2025)
- [FATF new technologies for AML/CFT report (2021)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-new-technologies-aml-cft-2021) — Opportunities and Challenges of New Technologies for AML/CFT (Jul 1, 2021)
- [FATF data pooling and collaborative analytics stocktake (2021)](https://www.bankingnewsai.com/ai-regulation/documents/fatf-data-pooling-collaborative-analytics-2021) — Stocktake on Data Pooling, Collaborative Analytics and Data Protection (Jul 1, 2021)
- [FATF Recommendations](https://www.bankingnewsai.com/ai-regulation/documents/fatf-recommendations) — International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation: The FATF Recommendations (consolidated text updated October 2025) (Feb 15, 2012)
- [FIN-2026-Alert005 (Digital Asset Investment Scam Centers)](https://www.bankingnewsai.com/ai-regulation/documents/fincen-alert-2026-scam-centers) — FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers (Sep 3, 2026)
- [FIN-2026-Alert004 (Federal Student Aid Fraud)](https://www.bankingnewsai.com/ai-regulation/documents/fincen-alert-2026-federal-student-aid-fraud) — FinCEN Alert on Fraud Schemes Targeting Federal Student Aid (Jul 24, 2026)
- [Hill House oversight testimony (Jun 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fdic-testimony-oversight-prudential-regulators-2026) — Statement of Chairman Travis Hill: Oversight of Prudential Regulators (Jun 4, 2026)
- [SR 26-2](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2) — Revised Guidance on Model Risk Management (Apr 17, 2026)

Last reviewed Oct 15, 2026. Cite the official text (https://www.fatf-gafi.org/en/publications/Financialinclusionandnpoissues/Digital-identity-guidance.html) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/fatf-digital-identity-guidance-2020
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (42 authorities, 243 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.