Electronic identity verification (eIDV): eID, chip, database

An examiner or auditor who opens the file of a customer onboarded by phone asks three things: which electronic method proved the identity, what it was checked against, and where the result is stored. Some countries run a queryable national identity database; in others, firms check documents against credit files and commercial databases.

What is electronic identity verification?

Identity verification checks that a customer is real and is who they claim to be. Identification records the claim; verification tests it against evidence the customer did not create. In AML programs its role is the first customer due diligence measure, and its importance is that it keeps accounts out of stolen and invented names. FATF's June 2026 text of Recommendation 10 calls for "reliable, independent source documents, data or information" (FATF Recommendations).

Electronic identity verification runs that check on evidence that is itself electronic. A passport photographed in an app for a document upload travels electronically, yet it is a remote document check. AMLA's final report allows that route only for a customer who cannot reasonably present the document face to face and has no eID at the required level, and the firm must be able to justify it (Article 7(1) and (3)).

Digital identity verification and online identity verification mean the same. Automated or not, eIDV is the identity step of KYC verification, and an analyst decides the exceptions.

Which methods does electronic identity verification use?

Three types of identity verification methods count as electronic, each with its own uses and limits.

Table 1. Three electronic methods and what each proves (as of October 2026)

A database match shows only that an identity exists. A chip read shows the issuing state signed the data and nobody changed it, though passive authentication "does not prevent an exact copy or IC substitution" (ICAO). Only an eID also authenticates the person using it: the issuer proofed that person when it issued the means, and every use needs factors the holder controls. EU law draws the line there from 10 July 2027: an eID at "substantial" or "high" counts on its own, while a document needs independent sources "where relevant" (AMLR Article 22(6)).

How does an eID verify identity?

An eID is proofed once, at issue, and authenticated at every use. FATF's Guidance on Digital Identity (paragraph 65) says authentication establishes that the person "is the same person who was identity proofed and enrolled". A firm relying on an eID checks four things:

• The level. eIDAS Article 8 sets low, substantial and high. At high, the issuer may compare "one or more physical characteristic" of the applicant with an authoritative source (Implementing Regulation (EU) 2015/1502, 2.1.2).
• The factors. Substantial needs "at least two authentication factors from different categories" (2.2.1).
• The scheme. The Commission's notified eID schemes list (updated 2 February 2026) shows Germany's identity card eID at high, notified 26 September 2017.
• The rule. EU law accepts electronic identification now (Directive Article 13(1)(a)), and AMLA's final report lets a firm use a qualifying eID face to face as well (Article 6(4)). In the UK, an electronic identification process counts as an independent source when it is "secure from fraud and misuse" and gives assurance that the claimant is that person (MLR 2017 regulation 28(19)).

How does an NFC chip read verify a passport or ID card?

A customer holds a passport to a phone. The app reads the machine readable zone, uses it to open the chip (Basic Access Control, or its successor PACE) and reads data group 1, the zone's data, and data group 2, the face image (ICAO Doc 9303 Part 10, 4.7.1 and 4.7.2).

Next it follows the data's signature up to the issuing state's Country Signing Certification Authority, the "national trust point" (Part 12, 3.1). This passive authentication proves the data "authentic and not changed". Comparing the printed zone with the chip's copy shows chip and booklet "belong together" (Part 11, Table 1).

Neither check shows that the person holding the phone owns the passport; that takes biometric matching, one of eKYC's checks. Without a chip or an NFC phone, the app has only document images.

Ensuring data security and confidentiality with eIDV tools starts with that face image. Processed to identify a person uniquely, it is biometric data of a special category (GDPR Article 9(1)), and from 10 July 2027 the AMLR lets firms process such data only where "strictly necessary" (Article 76(1)).

How does a database identity check work?

Between November 2018 and August 2020, Robinhood Financial approved about 14 million new accounts on "a largely automated customer identification process" that sometimes passed customers whom its vendors' data had not reasonably verified (FINRA AWC, 6 March 2025). After a 2021 lookback it closed more than 100,000 accounts.

A database cross check compares the typed details with "a consumer reporting agency, public database, or other source" (1020.220(a)(2)(ii)(B)). In Canada, FINTRAC's credit file method needs a Canadian file at least three years old, built on more than one tradeline.

A match proves that the identity exists. It does not show that the applicant owns it: a synthetic identity built on real details can pass, while a thin file fails. AMLA's report has firms weigh "the ease with which" data "can be forged" when judging a source (Article 8(1)(e)). In the US, the record keeps "the methods and the results" and the "resolution of any substantive discrepancy" (1020.220(a)(3)(i)(C) and (D)).

How do you choose the right method, and where do electronic checks fail?

From 1 October 2003 to 19 October 2012, Wells Fargo Advisors' CIP system skipped verification on nearly 220,000 new accounts, reading recycled customer identifiers as already verified (FINRA AWC, 18 December 2014). An internal test found the gap in January 2012.

Five choices per product decide whether the advantages of eIDV software hold up:

• The rule. Industry use cases differ: which method each rule accepts alone, and which needs a second source.
• What customers hold. An eID, a chipped document, an NFC phone, or none of them.
• Risk. In the UK, a remote relationship without safeguards such as a 28(19) process is a high risk factor for enhanced due diligence (EDD) (MLR regulation 33(6)) and for the KYC risk rating.
• The fallback. Where the evidence is too poor to check remotely, EBA guideline 40 has the onboarding interrupted, then restarted or sent to a face to face check.
• The count. Count results, not files: compare the accounts opened each day with the verification results stored, because a method that never ran leaves no mismatch for anyone to review.

complead, formerly Sanction Scanner, starts where the identity verification solution stops. Document and biometric identity verification stays with the firm's IDV provider, and the verified identity reaches the customer risk assessment model as an input. In customer onboarding, the KYC checks, sanctions and PEP screening and adverse media then run on one record in a single request.

Which 2026 dates matter for electronic identity verification?

• Chip, 23 February. Amendment 2 to Doc 9303 Part 11: PACE in chips issued from 1 January 2027, PACE only from 1 January 2028, and Basic Access Control out of circulation by 1 January 2038.
• eID, 9 June. Version 1.0 of the UK's digital verification services trust framework was finalized; it applies once the first conformity assessment body is accredited against it, no earlier than 1 September 2026.
• Credential, 8 September. In FinCEN's FAQ, an unexpired state mobile driver's license can count as government issued identification for a bank's CIP if it also serves to "evidence nationality or residence and bear a photograph or similar safeguard".
• eID, 30 September. AMLA published its final report on the CDD standards, which "will be submitted to the European Commission for adoption".

Each product's written procedure still has to name the electronic method it accepts alone, and the route for an applicant whom none of the three methods can check.

Related terms

• KYC verification. The whole identity check for one customer, from the details taken down to the record kept.
• Proof of address. A document or record showing where a customer lives, asked for in some markets.
• Synthetic identity fraud. An identity stitched together from real and invented details, which a database match can pass.
• eKYC. Remote KYC verification: document, face and data checks, with liveness detection, without meeting the customer.
• Optical character recognition (OCR). Software that reads the printed fields and machine readable zone of IDs.
• eIDAS. The EU regulation that sets eID assurance levels and the European Digital Identity Wallet.

How this entry was checked. On 28 October 2026 each rule, standard and FINRA letter below was reopened at its source: eIDAS with Implementing Regulation (EU) 2015/1502 and the Commission's notified schemes list; ICAO Doc 9303 Parts 10, 11 and 12; EBA/GL/2022/15; Regulation (EU) 2024/1624, the amended Directive (EU) 2015/849 and AMLA's final report of 30 September 2026; FATF Recommendation 10 in its June 2026 text and FATF's Guidance on Digital Identity (March 2020); UK MLR 2017 regulations 28 and 33; GDPR Article 9; 31 CFR 1020.220, FinCEN's FAQ of 8 September 2026 and FINTRAC's verification methods; FINRA's letters of acceptance, waiver and consent for Robinhood Financial and Wells Fargo Advisors; and the UK trust framework 1.0. The passport held to a phone is an illustration. By Emirhan Akgün, Software Engineer at complead. Fact checked by: Javid Khasayev, Senior Anti Fraud Specialist at GoldenPay, 29 October 2026. Last reviewed: 29 October 2026.