Verifying a customer’s identity used to take days or weeks and required them to physically arrive somewhere with documents. Digital verification, checking an identity against Home Affairs records and bank data, reduced that to minutes. For any business with a legal obligation to know who its customers are, that is the difference between losing an applicant and onboarding them.
The obligation itself comes from the Financial Intelligence Centre Act and its amendments, which require accountable institutions to establish and verify who they are dealing with and to assess the risk in the relationship.
Know who is actually an accountable institution
The obligation reaches considerably further than banks. Estate agents, attorneys, money remittance businesses, long-term insurers and foreign exchange providers all fall inside it, and many smaller operators in those categories do not realise they are covered. The current list and the reporting requirements are published by the Financial Intelligence Centre.
The obligation is risk-based, not a checklist
The amended framework requires considering the risk involved in each relationship or transaction rather than collecting the same documents from everyone. That means more scrutiny where the risk is higher and less where it is low, and it requires a business to have thought about what higher risk looks like in its own context.
Onboarding friction is where customers are lost
A process requiring a branch visit and a week of waiting loses applicants who were ready to buy. Compliance that happens in minutes converts them. Any business with a mandatory verification step should measure how many people start it and how many finish, because that gap is usually larger than anyone expects and is entirely fixable.
Verification is a service you buy, not one you build
Connecting to Home Affairs and banking data is not something a small business builds itself. Providers exist precisely so that a compliance obligation can be met with a service. The commercial question is cost per verification against the value of an onboarded customer, which is straightforward to work out.
Keep the record, not just the outcome
Meeting the obligation means being able to demonstrate later what you checked, when and on what basis. A business that verified properly but cannot produce the record is in the same position as one that did not verify at all, so retention of the evidence matters as much as the check itself.
Frequently asked questions
Which businesses have identity verification obligations?
Accountable institutions under the Financial Intelligence Centre Act, which includes estate agents, attorneys, remittance businesses, long-term insurers and foreign exchange providers alongside banks.
What changed with digital verification?
Checks against official records reduced a process that took days or weeks to minutes, removing the need for the customer to appear in person with documents.
Is the same check required for every customer?
No. The framework is risk-based, requiring more scrutiny where risk is higher, which means a business must define what higher risk looks like for it.
Should a business build its own verification?
Almost never. Providers connect to the necessary data sources, so the decision is cost per verification against the value of an onboarded customer.
Why does record keeping matter so much?
Because you must be able to demonstrate later what was checked and when. A verification you cannot evidence counts for nothing.
Further reading
Originally published in July 2017. Updated September 2026 to explain the verification obligation and how to meet it rather than reporting a processing record.
