Identity is a fact. Trust is a prediction.
For years, digital onboarding has treated verifying identity as the whole task. Banks have invested heavily in eKYC, document verification, facial biometrics, liveness detection, OCR, and digital signatures, and these technologies have made customer onboarding faster, more secure, and far more convenient. They have also answered one specific question well: is this person who they claim to be.
That question remains necessary, but it is no longer sufficient.
Genuine Identities, Fraudulent Outcomes
Across banking, fintech, and financial crime prevention, a pattern keeps repeating. A customer with a completely genuine identity becomes a money mule. A customer who passes every onboarding check goes on to commit first-party fraud. A legitimate, fully verified account becomes the destination for scam proceeds or the starting point of a money laundering network.
In each case, identity was never the problem, trust was.
Some of the most sophisticated financial crimes active today do not rely on fake identities at all. It relies on genuine identities used for fraudulent purposes, which is precisely what identity verification cannot catch.
Trust Cannot Be Verified Like Identity
By design, identity is confirmed through a document, a biometric match, or a database lookup. Trust does not work that way. It emerges from the convergence of several signals, and no single one of these is decisive on its own:
- Device intelligence
- Behavioral patterns
- Network relationships
- Historical risk indicators
- Digital footprint
- Transaction intent
- Consistency across the customer journey
Together, these signals help build confidence in a customer relationship. Identity remains the foundation of onboarding. But identity tells an institution who a customer is. Trust tells it how likely that customer is to misuse the financial system.
A Trust Score Is Still a One-Time Check
Many institutions that have made this shift have done something specific: they added trust signals to the onboarding gate. That is real progress. It is also, on its own, an incomplete version of the shift.
A trust assessment calculated once is still a single decision made at a single moment. It simply uses richer inputs than a document scan did. The gate became smarter but it remains just a gate.
That distinction matters because trust, unlike identity, does not hold still. A customer who looks low risk on day one can look markedly different on day ninety. A dormant account can activate to move money for a mule network. A verified small business can begin receiving transfers that have nothing to do with the business it was onboarded for. None of these customers would necessarily fail a trust assessment run today. They would only fail a later run, which is the assessment most onboarding programs stop performing once the file closes.
A Shift Already Underway, Just Not Yet in Banking
This argument is not unique to banking. Gartner has described a similar shift in security and risk management more broadly, under a framework it calls Continuous Adaptive Risk and Trust Assessment, or CARTA. Its core premise – move away from a single, static, yes-or-no decision at the gate, toward continuous, real-time assessment of risk and trust for as long as the relationship lasts.
Security teams in other industries have been operating this way for close to a decade. Banking has made some real progress on the trust half of this shift but not enough on the continuous half.
What the Next Generation of Onboarding Looks Like
The next generation of onboarding is likely to look less like a gate and more like a standing assessment, one that draws on identity, behavior, device and network signals, and a customer’s conduct across every channel they use to interact with the institution, including conversations conducted by voice, not only forms filled in on a screen.
Some institutions are already asking a further question: whether this kind of ongoing trust assessment should be rebuilt from scratch inside every institution, or whether it can be run as a continuously managed capability, purpose-built for this problem.
The Objective Onboarding Has Not Yet Adopted
Identity verification will remain the foundation of onboarding. But foundations are not objectives.
The objective is no longer only to verify who a customer is. It is to make a better, continuously updated decision about whether that customer can be trusted, for as long as the relationship lasts. Because the costliest fraud is rarely the transaction an institution manages to stop. It is the customer it should never have onboarded, and then never asked about again.
