Know Your Customer (KYC) processes have never been more important for payment providers, but they have also never been as complicated to get right.
KYC is the process by which businesses verify the identity of their customers, which takes place before and during their relationship with the company. It is widely considered the first defence against financial crime.
One of the reasons that it is so hard to get right is because it covers regulatory compliance, fraud prevention and customer experience, three areas that are difficult to balance.
Weak KYC exposes firms to money laundering, fraud and regulatory sanctions, and overly burdensome KYC drives customers away before they complete onboarding.
Finding the right balance is now one of the defining tasks in payments. As with most parts of the industry, new technology and trends are helping in some areas and hindering others.
How KYC requirements are evolving
As one of the first lines of defence against financial crime, the bar for compliant KYC has risen significantly in recent years. Regulators expect firms to continuously understand who customers are and how they behave.
The Financial Action Task Force makes updates to its global standards, prompting jurisdictions to strengthen their own frameworks.
In Europe, the EU’s latest Anti‑Money Laundering (AML) package has introduced a new pan‑European AML authority and raised expectations around data collection, verification and ongoing monitoring.
Alongside this, PSD3 and the revised Payment Services Regulation are set to tighten requirements around customer authentication, data access and risk management.
In the US, FinCEN’s beneficial ownership rules have pushed KYC obligations deeper into the corporate customer base, requiring firms to identify and verify the individuals who control the entities they serve.
In addition to these compliance pressures from above, payment providers face additional challenges of customer expectations around speed and convenience.
Real‑time payment rails and instant account‑to‑account transfers allow money to move in seconds, leaving almost no window to detect suspicious activity before funds disappear.
Open banking adds another layer of identity risk at the point of transaction initiation, where third parties can trigger payments directly from customer accounts.
Balancing compliance and customer experience
Trying to stay compliant and also improve customer experience is a significant challenge for payment providers, which is perhaps most prevalent when onboarding customers.
Research shows that drop-off rates spike when identity verification requires too many steps, too much documentation or too long a wait.
Signicat’s 2022 Battle to Onboard study, surveying 7,600 consumers across 14 European markets, found that 68% abandoned a financial application. This figure rose from 63% in 2020 and 40% in 2016, when the research was first published.
One way to improve the process without letting defences down is through risk-based approaches. This allows providers to calibrate the depth of KYC to the customer risk profile; a low-value consumer account requires less verification than a high-volume merchant processing cross-border transactions.
Another model that providers are adopting is tiered onboarding, where basic access is granted quickly and further verification is completed over time.
Digital IDs change the game
Perhaps the most significant development in KYC for 2026 is the push for government-backed digital identity frameworks, such as the EU‘s eIDAS 2.0 regulation, which is introducing a Digital Identity Wallet that allows citizens to store and share verified identity credentials across borders.
India’s Aadhaar system, which links biometric identity to an identification number for over a billion citizens, is regarded as the global benchmark for what government-backed digital ID can achieve.
Ellie Hewitt, Director of Payments Consulting at KPMG in the UK, has written in the past that digital IDs allow individuals to reuse verified identity across financial institutions, enabling instant, secure and compliant identity verification.
Traditional KYC requires payment providers to collect, verify and store identity documents themselves, a process that is time-consuming, expensive and introduces data security obligations.
However, Digital ID frameworks move that verification upstream, allowing providers to rely on credentials that have already been authenticated by a trusted government or certified third party.
The customer shares only what is needed for the specific transaction, a concept known as selective disclosure, reducing the volume of sensitive data providers need to handle.
The UK is currently working on this through the Digital Verification Services Trust Framework, which is now on a statutory footing and includes more than 45 certified identity providers, including Yoti, Entrust, Digidentity and OneID.
In February 2026, HM Treasury confirmed that the framework can be used for KYC checks under anti-money laundering rules, giving payment providers a certified route to compliant digital identity verification without having to build the infrastructure.
In many markets, like the UK, concerns around data sharing, government surveillance and the security of centralised identity systems have been sticking points for adoption, which could possibly benefit from payment providers educating people on the advantages of this technology.
The growing role of automation and AI
AI is another technology helping improve KYC processes, but is also being used by bad actors.
On the compliance side, the benefits are:
- Document verification that once required manual review can now be completed in seconds using computer vision, reducing onboarding time and human error.
- Biometric checks, including facial recognition, are becoming standard in mobile onboarding flows, making it harder for fraudsters to use stolen credentials.
- Behavioural analytics allow providers to monitor transaction patterns, flagging anomalies that static rule-based systems would miss.
- Perpetual KYC, where customer data is monitored and updated in real time rather than reviewed at fixed intervals.
The other side of this, however, is that the same tech is being used by bad actors. AI-generated deepfakes are used to spoof biometric checks, synthetic identities are being constructed using real data points stitched together by machine learning, and automated bots are being deployed to probe onboarding systems for weaknesses.
Much like fraud detection and prevention, for every advance in AI-driven KYC, fraud techniques can match it.
One emerging concept that is important to note is the challenge of Know Your Agent. As agentic commerce grows, where AI agents act on behalf of users to initiate transactions or complete purchases, the question becomes how to verify the identity of a non-human actor.
Existing frameworks are built around verifying human identity and patterns. The industry is only beginning to grapple with what it means, though companies such as Visa have already launched frameworks.
Best practices for building future-ready KYC processes
The starting point is a risk-based approach because not every customer presents the same level of risk and KYC investment should reflect this. Tiering verification requirements by customer type, transaction volume and geographic exposure allows providers to focus resources where they matter most.
Digital identity integration should be a priority for any provider operating in markets where frameworks exist. Building the infrastructure to accept verified digital credentials reduces friction, improves verification quality and positions providers well as adoption grows.
Perpetual KYC should replace periodic review cycles wherever possible. Monitoring customer data and transaction behaviour continuously is more effective at catching risk and more efficient at scale than scheduling reviews at fixed intervals.
Finally, keeping humans in the loop for edge cases is extremely important. AI-driven KYC is a great innovation but not perfect and the consequences of a false positive or a missed flag are significant enough to warrant human review where the system is uncertain.
