Identity Verification in the Digital Era

In this article, GreySpark Partners discusses how:

• IDV serves as the cornerstone of security and regulatory compliance for VASPs and financial institutions in the digital era.
• The IDV ecosystem has evolved significantly since 2020, integrating AI, biometrics and blockchain to address operational requirements and regulatory mandates.
• Identity fraud is increasing at an alarming rate, with trends such as synthetic identity fraud, deepfakes and cross-border fraud causing billions of USD in losses.
• Hong Kong, Singapore, the EU and the UK have distinct approaches to IDV and non-face-to-face (NFTF) onboarding regulations.
• National digital identity platforms such as Singapore’s SingPass, Hong Kong’s iAM Smart and the EU’s upcoming EUDI Wallet are reshaping the IDV landscape.
• The implementation of IDV solutions provides business value through fraud prevention, regulatory compliance, competitive differentiation and operational efficiency.
• The IDV marketplace features diverse vendors categorised as global leaders (Sumsub, Onfido, Jumio), regional specialists (Tradelink, IDnow), niche innovators (Prove, AU10TIX) and Know Your Customer (KYC) / Know Your Business (KYB) specialists (Know Your Customer, Trulioo).

Identity fraud has become a significant risk to capital markets firms, with global losses exceeding USD 56 bn, annually. Fraudsters are increasingly leveraging sophisticated methods, such as deepfakes and synthetic identities, to bypass traditional verification systems. Consequently, deploying a robust and scalable IDV solution is essential to stay ahead of these evolving threats and safeguard both businesses and their customers.

Throughout this article, GreySpark emphasises that taking a comprehensive IDV approach to the onboarding of remote customers can bolster trust, streamline operations and scale internationally while mitigating risks and meeting stringent regulatory demands.

1.0 The Evolving Identity Verification Ecosystem

For financial institutions, including VASPs, traditional banks and brokerages, the shift to NFTF client onboarding presents both opportunities and challenges. Since the COVID-19 pandemic (2020 to 2023), which accelerated the development and deployment of digital solutions for remote users, the identity verification ecosystem has advanced significantly to deliver secure, efficient solutions for client authentication.

Effective, modern remote customer onboarding processes integrate cutting-edge technologies, such as artificial intelligence, biometrics and blockchain. The process begins with AI-based document verification, which analyses security features, such as microtext and holograms, on government-issued ID. Biometric authentication, including facial recognition with liveness detection, confirms the client’s physical presence, mitigating the risk of impersonation. Additional safeguards, such as behavioural analytics and location tracking or interaction patterns, further strengthen fraud prevention. This comprehensive approach ensures a robust, streamlined onboarding experience.

VASPs operating internationally must deploy IDV solutions for NFTF onboarding that are able to adapt to diverse operational processes, jurisdictions and client demographics. Regulatory bodies in major jurisdictions largely follow guidance from the Financial Action Task Force (FATF), which is considered to be the global anti-money laundering (AML) and counter-terrorism financing (CTF) authority. These regulators impose rigorous KYC and KYB standards on financial institutions, including VASPs, retail broker-dealers, investment advisors and retail banks, as well as other institutions which are required to carry out client onboarding. Financial institutions must be mindful of the fact that any IDV solution they may choose must balance stringent compliance with operational efficiency.

1.1 Rising Trends in Identity Fraud

Identity fraud is escalating at an alarming rate, outpacing traditional security measures and presenting new challenges across the financial sector. As fraudsters adopt increasingly sophisticated tactics, emerging trends highlight the urgent need for proactive defences and adaptive solutions. These evolving threats, outlined in Figure 1, demonstrate how fraudsters attempt to and, in many cases, successfully do exploit system vulnerabilities.

These trends underscore a staggering financial toll, with US consumer fraud losses alone climbing to USD 12.5 bn in 2024, a 25% surge from the previous year. These present risks, increasing in both sophistication and frequency, underscore the need for advanced IDV solutions that leverage AI, machine learning and biometric technologies in order to stay ahead of fraudsters.

Beyond direct financial losses, the cryptocurrency industry faced over USD 5.8 bn in fines in 2023, a significant jump from the much smaller USD 30 mn in fines in 2022. This increase was driven by a USD 4.3 bn fine imposed on Binance by a coalition of US regulatory agencies, for, among other things, failing to properly identify and ban users from sanctioned jurisdictions.

2.0 Identity Verification in Asia Pacific and Europe

Digital operations in financial services have been tempered by diverse regulatory approaches, particularly in regard to safeguarding digital identities. One way in which this is observed is in whether or not there is widespread adoption of government-backed digital identity platforms. National digital identity (NDI) platforms provide citizens with official digital IDs, which facilitate secure and streamlined access to various services. A leading example of this is Singapore’s NDI initiative, SingPass, which is a digital identity system managed by the Government Technology Agency. Launched in 2003, SingPass allows residents to access over 2,000 government and private sector services. The platform encompasses two-factor authentication (2FA) and biometric verification, including facial recognition and fingerprint scanning, to ensure secure transactions.

The following analysis explores how jurisdictions, including Hong Kong, Singapore, the EU and the UK, are addressing NFTF onboarding challenges, highlighting key points in their regulatory frameworks, digital identity initiatives and unique market challenges.

2.1 Hong Kong

The Securities and Futures Commission (SFC) of Hong Kong issued the ‘Circular to Intermediaries: Remote Onboarding of Overseas Individual Clients’ in 2019, which established best practices for licensed financial intermediaries to onboard remote customers securely and efficiently. The Hong Kong Monetary Authority (HKMA) and SFC jointly oversee NFTF onboarding, which enables digital verification for clients from Hong Kong and approved overseas jurisdictions. The process aligns with global AML standards. With more VASPs, as well as retail brokerages, entering the market, there is growing demand for secure IDV solutions for the associated retail customers.

The SFC and HKMA, as well as the Hong Kong government, are advocating the use of a centralised digital identity platform, iAM Smart. At the time of writing (early 2025), this centralised platform has been adopted by 3.3 mn users and integrates with over 1,100 public and private services. The platform streamlines client authentication, making it a cornerstone of Hong Kong’s IDV ecosystem. The platform offers a unified gateway for NFTF onboarding. It is anticipated that an increasing number of initiatives will further promote the adoption of iAM Smart as a centralised digital identity solution across the financial sector. One such initiative is the iAM Smart sandbox programme launched by the Digital Policy Office, in collaboration with Cyberport (a government-backed digital technology and AI start-up accelerator). This sandbox programme allows financial institutions to conduct mock-up and integration tests of iAM Smart’s API functions, facilitating smoother adoption and integration into its online services. Several prominent financial institutions have already undertaken this integration. For instance, in Hong Kong, the Bank of China uses iAM Smart for mobile account opening, enabling customers to auto-fill application forms with verified personal information. Likewise, Hang Seng Bank and Hong Kong Life Insurance have adopted iAM Smart for identity verification processes.

One Hong Kong-based IDV technology vendor, Tradelink, is advocating for the adoption of digital certificates to facilitate NFTF onboarding processes. By leveraging these recognised digital certificates, financial institutions can streamline identity verification and, subsequently, reduce their due diligence burden when onboarding remote customers. These certificates are electronic credentials, issued by a trusted certification authority (CA) that use cryptographic techniques to securely associate an individual’s identity with a public key. By binding the public key to the verified identity of the certificate holder, digital certificates enable secure, encrypted communication and ensure that parties can trust the identities of those with whom they are interacting online. In the context of NFTF onboarding, digital certificates facilitate the authentication of clients remotely, while ensuring data integrity and security, reducing the need for physical document verification and enhancing the efficiency of the onboarding process. This approach has the potential to extend secure onboarding beyond current volumes, improving scalability and efficiency across Hong Kong’s financial services industry. Tradelink’s solution, TD-Sign, enables e-Passport holders to remotely apply for recognised certificates issued by Digi-Sign, a wholly owned subsidiary of Tradelink. In fact, Digi-Sign is the only commercially recognised CA under Hong Kong’s Electronic Transactions Ordinance.

Hong Kong’s 2023 crypto licensing regime has spurred VASPs, such as HashKey and OSL, to pioneer NFTF onboarding processes that use blockchain technology for secure, scalable onboarding. These initiatives reflect the territory’s ambition to remain a global crypto hub. Despite this progressive approach, Hong Kong is in a unique position due to its proximity to and relationship with mainland China. Strict Chinese capital controls, designed to limit money outflows and maintain financial stability, have influenced the manner in which China-affiliated firms operate in Hong Kong, with many  referring traditional face-to-face onboarding processes over digital alternatives. This has created a distinctive regulatory environment where Hong Kong’s open NFTF framework exists alongside a traditional onboarding approach. In response, local financial institutions have developed pragmatic hybrid onboarding models which offer digital processes for Hong Kong residents, while maintaining physical verification  procedures for mainland clients. This effectively navigates the regulatory divergence between the two jurisdictions.

2.2 Singapore

The Monetary Authority of Singapore (MAS) mandates robust NF2F onboarding measures, requiring financial institutions to use reliable digital tools, such as biometric verification and liveness detection, alongside a risk-based approach which requires enhanced due diligence for higher-risk customers. The regulator mandates that institutions establish processes and ensure that they continue to comply with data protection laws and maintain audit trails. Singapore stands out as a fintech leader with SingPass, the country’s national digital identity system. The SingPass is widely adopted across the financial services sector in Singapore. SingPass provides both Singaporean citizens and residents with secure access to a wide array of private and public services. Through a single set of credentials, users can authenticate themselves for over 2,700 digital services offered by more than 800 agencies and businesses. The SingPass app enhances security by enabling multi-factor authentication methods, including biometric verification such as facial recognition and fingerprint scanning. An integral component of SingPass is MyInfo, a personal data management platform enabling users to pre-fill digital forms with their verified personal information, retrieved from government sources. By consenting to the sharing of this data, users can reduce the need for repetitive data entry and physical document submission. Singapore’s SingPass plays a pivotal role in the IDV ecosystem, frequently complementing third-party solutions. Indeed, Singaporean financial institutions often integrate with both MyInfo and a third-party IDV solution to establish a robust NFTF onboarding framework. For instance, a VASP onboarding a Singaporean citizen or resident may use MyInfo to rapidly retrieve and auto-fill a customer’s personal information, reducing manual data entry. At the same time, the VASP could deploy an IDV vendor’s biometric verification to ensure the person submitting the application is indeed the rightful owner of the identity. This combined approach ensures the individual submitting the application is the rightful owner of the identity put forward during the account opening process. In this manner, SingPass and MyInfo are foundational tools for identity verification in Singapore while third-party IDV solutions provide additional verification capabilities which are critical for remote onboarding. Together, they offer a comprehensive and secure framework for NFTF onboarding processes in the financial sector.

The MAS guidelines’ risk-based approach is notably pragmatic, balancing innovation with security. For higher-risk customers, such as those in cross-border transactions, firms often combine NF2F tools with Singapore’s robust AML framework. This has made Singapore a model for jurisdictions aiming to harmonise digital onboarding with international compliance standards. Singapore’s IDV ecosystem thrives on collaboration between public and private sectors. Through forward thinking guidelines, MAS has spurred the development of an API-driven infrastructure, enabling firms to plug into trusted third-party IDV providers seamlessly. This interconnected ecosystem enhances efficiency and scalability for NFTF onboarding across industries.

With the Personal Data Protection Act (PDPA), Singapore aligns its NF2F onboarding requirements with stringent data protection standards. Financial institutions must not only secure customer data but also ensure transparency in how biometric and digital identification data is processed. The PDPA mandates that financial institutions ensure biometric and digital identity data is collected with explicit consent, transparently disclosed for only specified purposes, securely protected against unauthorised access, and retained for only as long as necessary before being subsequently deleted. In addition, the PDPA requires that any significant data breaches be promptly reported to both the regulator and affected individuals.

2.3 European Union (EU)

The EU has established a comprehensive regulatory framework for the remote onboarding of individuals, with significant implications for VASPs and financial institutions. This framework has largely been established under the guidance of the European Banking Authority (EBA), with the actual enforcement of these guidelines being the responsibility of national competent authorities (NCAs) within each member state. These NCAs are responsible for supervising and ensuring compliance from institutions operating under their jurisdiction. The EBA’s comprehensive guidelines on the use of remote customer onboarding solutions, officially titled EBA/GL/2022/15, came into effect in October 2023. These guidelines mandate that financial institutions:

• Adopt a risk-based approach to customer due diligence.
• Assess and document the adequacy of their remote onboarding solutions and processes.
• Ensure the authenticity of customer identification documents.
• Implement robust security measures to protect personal data.
• Conduct ongoing monitoring and regular reviews of remote onboarding processes to adapt to emerging risks and technological advances.

The objective of these guidelines is to establish a harmonised framework for financial institutions across the EU for the secure and effective onboarding of remote customers. The EBA also mandates robust biometric verification methods including liveness detection to prevent spoofing attacks. These standards are particularly relevant for VASPs, which rely heavily on remote onboarding processes. Nonetheless, despite the unified regulatory framework, the actual implementation of these regulations varies across member states, creating challenges for financial institutions operating across multiple EU jurisdictions. This fragmentation necessitates adaptable verification systems capable of meeting the diverse national interpretations of EU directives.

The EU’s updated eIDAS 2.0 regulation, adopted in February 2024, introduces the European Digital Identity Wallet (EUDI Wallet). This ‘wallet’ is a secure mobile app that will soon allow EU citizens to store identity credentials across borders. It will facilitate access to both public and private services. For instance, allowing individuals to open a bank account, or to confirm their identity when signing up to an insurance provider or when applying for a loan. The objective of this initiative is to enhance interoperability and trust in remote identity verification processes across the EU. At the time of writing in early 2025, the wallet is being trialed through four large-scale pilot projects. The projects are referred to as NOBID, POTENTIAL, DC4EU and EWC.

Each pilot is funded by the European Commission and involves various stakeholders, including financial institutions, regulatory bodies and technology providers, working together to assess the feasibility and effectiveness of using the EUDI wallet in real-world scenarios. For instance, the POTENTIAL pilot is focused on exploring the wallet’s applications for KYC and anti-money laundering (AML) compliance, which has direct implications for IDV providers in the financial services sector.

The upcoming introduction of the EUDI will disrupt IDV vendors operating in Europe. The EUDI wallet’s ability to provide government-certified digital identification may reduce the need for third-party verification services, as financial institutions and other businesses can access trusted identity data directly through the wallet system. As observed in similar initiatives – Singapore’s SingPass and Hong Kong’s iAM Smart – government digital identity systems can alter the IDV landscape. In Singapore, major banks DBS and OCBC have integrated SingPass’s facial verification directly, rather than using third-party vendors for matching. In response, forward-thinking vendors will pivot to complementary roles within this new ecosystem. This new role includes becoming integration specialists that orchestrate verification processes across both the EUDI and traditional methods, as well as becoming trust service providers within the EUDI framework itself.

In regard to AML and counter terrorist funding (CTF), the EU relies primarily on its AML Directive (AMLD) – the 6th iteration is the most recent. AMLD5 brought VASPs under AML obligations, extending KYC obligations to virtual asset-related activities. These directives standardise KYC / AML rules across all member states, harmonizing customer due diligence procedures, penalties for non-compliance, and reporting requirements. For VASPs, AMLD6 explicitly requires enhanced due diligence measures and full compliance with FATF’s Travel Rule, which mandates the sharing of originator and beneficiary information for virtual asset transfers. This poses both regulatory and technical challenges for IDV vendors. Vendor platforms must now support interoperable KYC flows and real-time data exchange while maintaining compliance with the General Data Protection Regulation (GDPR).

The GDPR significantly impacts how customer data is collected, processed and stored during identity verification procedures. Financial institutions and VASPs must implement privacy by-design principles in their verification systems, ensuring data minimisation and purpose limitation while maintaining comprehensive records for compliance purposes. IDV vendors, acting as data processors, play a critical role by offering configurable APIs that allow VASPs to set retention policies, perform data deletion on request and maintain encrypted audit trails. Furthermore, the use of cloud-based identity solutions involving third-country data transfers requires strict adherence to GDPR’s cross-border transfer rules.

2.4 United Kingdom (UK)

Under both the guidance and the supervision of the Financial Conduct Authority (FCA), the UK has developed a distinctive approach to identity verification following its exit from the EU, balancing innovation with robust security requirements. The UK’s Digital Identity and Attributes Trust Framework (DIATF) establishes standards for secure, interoperable digital identity verification. This framework aims to create a market for reusable digital identities that can reduce verification friction while maintaining high security standards. The UK government estimates this approach could reduce identity fraud by up to 10% by the end of 2025.

Although maintaining alignment with FATF standards, the UK is gradually diverging from some EU regulations. The Money Laundering Regulations 2017, overseen by the FCA, form the core of the UK’s AML framework. Though originally aligned with EU standards, these regulations are evolving to reflect the UK’s specific priorities and approach to financial regulation. As of January 2020, the FCA became the AML / KYC regulator for UK virtual asset businesses, requiring all VASPs to register and comply with the same AML regulations that apply to traditional financial institutions. The registration process is notably rigorous, with only a small percentage of applicants successfully completing the process. This strict approach has shaped the UK’s VASP landscape, with many businesses either enhancing their compliance frameworks or relocating to more favourable jurisdictions.

The UK has placed increased emphasis on robust governance for the biometric technologies used in identity verification, following the Ryder Review in 2022. This review was an independent legal analysis led by Matthew Ryder KC, the former Deputy Mayor of London, and commissioned by the Ada Lovelace Institute. It scrutinsed the governance of biometric data in England and Wales, specifically evaluating:

• Whether existing UK laws, such as the Data Protection Act and Common Privacy Law, are sufficient to regulate how biometric technologies are used.
• The human rights implications of such technologies, regarding privacy, non-discrimination, and freedom of expression and assembly. With a particular focus on whether biometric systems, especially facial recognition, can produce biased or inaccurate outcomes.
• Whether the use of biometric technologies is governed by laws that are clear, consistent and democratically authorised.

The Ryder Review found that the UK’s legal framework for biometric technologies is both fragmented and outdated, lacking clear regulation across sectors. The review raised human rights concerns, including risks to privacy and discrimination. It also concluded that uses of biometric technologies often fall short of the rule of law due to weak oversight, unclear legal authority and limited public accountability. Since this review, the UK has placed increased emphasis on robust governance for biometric technologies used in identity verification, including for addressing algorithmic bias. However, concrete legislative actions aligning with the Ryder Review’s recommendations remain pending.

2.5 Regional Divergence and Cross Border Challenges

The global patchwork of identity verification regulations creates significant challenges for financial institutions and VASPs operating across multiple jurisdictions. The lack of standardised digital ID frameworks means that firms must implement different IDV flows for different regions, affecting scalability and creating operational complexity. A customer onboarded in one jurisdiction may need to undergo a completely different verification process when accessing services in another region. This affects whether documents signed during digital onboarding are legally binding across borders, creating potential legal uncertainties for international financial services.

Some jurisdictions, particularly in emerging markets, lack clear NF2F onboarding guidelines, leaving VASPs in regulatory grey zones where compliance expectations are unclear or subject to sudden changes. Data protection laws such as Singapore’s PDPA or the EU’s GDPR often restrict where biometric and identification data can be stored, requiring local data centres or specific cloud configurations. This creates additional complexity for global identity verification solutions, potentially requiring region-specific deployments of verification technologies.

The uneven implementation of the FATF Travel Rule across jurisdictions creates challenges for VASPs as they must develop systems capable of exchanging originator and beneficiary information for cross-border transactions while accommodating varying local requirements and timelines.

3.0 Business Cases for IDV Solutions

The adoption of IDV solutions is no longer an operational necessity but is increasingly becoming a strategic imperative for businesses. The primary driver of this is fraud prevention. Firms see some potential to reduce financial losses from fraud and protect their brand reputation. During the remediation process which can sometimes triple the amount the company has already lost to fraud with the addition of investigation expenses, legal fees and other recovery measures. Cryptocurrency fraud incidents, in particular, have surged by over 24,000%, since 2016. To counter this, robust identity verification technology has become essential to mitigate these risks, especially for VASPs handling high-value transactions.

Confidently adhering to divergent regulatory standards is a leading concern following the implementation of comprehensive compliance frameworks and hefty enforcement action. In 2024, alone, global AML / KYC fines exceeded USD 4.2 bn in 2024. For financial institutions serving retail customers to avoid these fines, the implementation of comprehensive verification systems is critical. An effective remote onboarding solution will enable businesses to enter new markets with confidence by supporting international IDs and local regulations.

For VASPs looking to capture the growing APAC market, which is estimated to be USD 12.8 tn in cross-border payments as of 2024, adaptable verification systems that are capable of accommodating diverse regulatory requirements are essential. The VASP market is both concentrated and competitive, with Binance and Crypto.com accounting for about a third of total spot trading volume (35% and 11%, respectively) while numerous other platforms contend for the rest of the market share and seek to challenge incumbents. Conducting business in this customer-centric, competitive market, VASPs are under pressure to provide seamless, frictionless onboarding. Effective remote onboarding solutions can reduce onboarding time by over 90%, significantly improving conversion rates. Some vendors report that the implementation of their solution has led to an 85% enhancement in customer satisfaction. For VASPs competing for market share, streamlined verification is a critical differentiator, particularly as the typical crypto user expects technological sophistication and minimal friction.

Modern IDV solutions are critical for firms to achieve operational efficiency, manual verification processes must be automated to save time and resources, as well as meet regulatory and customer expectations. Firms implementing fully digital verification processes report a reduction of up to 70% in onboarding costs, with automated checks reducing processing hours and requiring less staff intervention. Not only does this minimise manual errors, as well as the associated cost of error-handling, but it will allow staff to be re-allocated to more high-value activities. Moreover, effective remote solutions are highly scalable, allowing firms to meet higher customer volumes without a proportional increase in staffing.

From a macro perspective, enhanced identity verification and fraud prevention contributes to the overall VASP market stability. For the volatile crypto sector, often perceived as a haven for scams and illicit activities, improved verification is an essential step toward fostering mainstream acceptance and encouraging institutional participation.

4.0 Competitive Landscape of the IDV Marketplace

The Identity Verification (IDV) marketplace is a rapidly expanding sector driven by escalating identity fraud, digital transformation and stringent regulatory requirements. As of March 2025, the market features a diverse and competitive landscape with an estimated 50 to 70 key firms, ranging from those with a global offering to emerging startups. When niche and regional offerings are included, the number of firms with an IDV solution exceeds 100. One report estimates the market was USD 14.86 bn in 2025, and is expected to grow to USD 26.94 bn by 2030 (CAGR 12.64%). For financial institutions evaluating identity verification (IDV) solutions, selecting the right provider hinges on understanding a diverse marketplace tailored to specific needs and priorities.

4.1 Key Vendors and Their Specialisations

Leading identity verification (IDV) vendors can be categorised based on their market roles and specialised offerings: global leaders, regional specialists, niche innovators and KYC / KYB specialists, reflecting their strategic focus and target industries.

4.1.1 Global Leaders

Global leaders deliver comprehensive IDV solutions with broad geographic reach and cross-industry applicability.

4.1.2 Regional Specialists

Regional specialists focus on localised expertise, tailoring IDV solutions to  specific jurisdictional requirements and compliance frameworks.

4.1.3 Niche Innovators

Niche innovators target specific use cases or technologies, offering specialised IDV solutions for emerging or high-demand markets.

4.1.4 KYC / KYB Specialists

KYC / KYB specialists deliver targeted solutions for individual (KYC) and business (KYB) verification, integrating compliance checks with operational efficiency.

5.0 Next-Generation Identity Verification: From Wallets to Biometrics

The identity verification (IDV) landscape is transforming rapidly, offering financial institutions and VASPs a mix of opportunities and hurdles. Biometric systems face growing scrutiny over bias, pushing vendors to ensure fairness and accuracy amid tightening regulations. Reusable identity wallets, such as the EU’s EUDI Wallet and Singapore’s SingPass, are poised to cut onboarding friction and costs, enhancing experiences for frequent users. Meanwhile, AI-driven IDV innovations, which are vital for liveness checks and fraud detection, must adapt to emerging AI regulations in major jurisdictions, balancing cutting-edge technology with compliance demands. As traditional finance embraces digital tools and VASPs bolster compliance, verification practices are converging, paving the way for a more unified financial ecosystem.

GreySpark Partners’ deep expertise in this sector, honed through numerous remote onboarding implementations and advisory projects, can assist you in selecting an IDV solution that aligns with your security, regulatory, and user experience goals.