What is identity intelligence, and Why does more data create more false positives?

Identity intelligence combines six kinds of signals into one risk score for a customer, then updates that score as new signals arrive. The six signals are the document someone presents, their face, the device they use, how they behave during a session, what watchlists say about them, and what government registries confirm. 

That is the definition most of the market uses, and it is also why compliance teams buy an identity intelligence platform and then watch their alert queue grow rather than shrink. 

The assumption underneath it is that intelligence improves as you connect more sources: add device data, add adverse media, add behavioural analytics, and the picture should get clearer. 

But, in reality, it usually gets noisier, because each new source generates its own matches against a customer record that was never firmly tied to one person. What separates useful identity intelligence from expensive noise is whether every signal is tied to one verified person before any of it is scored. 

What is identity intelligence?

Identity intelligence is the layer that turns identity data into a risk decision that you can explain to teams and auditors. The irony is that most teams already have that data, but they lack the conclusion that’s drawn from it and the ability to show someone how they reached that conclusion.

The three things it has to do

1. It needs to tie every signal to one verified person: The platform matches each incoming signal against an identity that was proven at onboarding, then decides whether that signal belongs to the same human being or to somebody different. Device data, watchlist hits, and behavioural alerts all attach to a single customer profile, so the system holds one view of that person rather than several partial ones.
2. It should update as new signals arrive: Risk is recalculated whenever something material changes, such as a new sanctions entry, an unfamiliar device, or a change of address. The score reflects where the customer stands now, and the platform re-checks the existing base continuously instead of waiting for a scheduled review.
3. It should show the reasoning behind every score: Each result breaks down into the individual fields that produced it and the weight each field carried. Compliance teams can trace any decision back through its inputs, which is what allows them to explain it to an auditor or a regulator later. 

How is identity intelligence different from identity verification?

Identity verification asks whether someone is who they claim to be, once. Identity intelligence asks how much risk that person carries and whether that risk is changing. Verification comes first, and identity intelligence is only as reliable as the verification sitting underneath it. 

Why the difference matters to regulators

FATF Recommendation 10 requires ongoing due diligence and scrutiny of transactions throughout the business relationship, not a single check at the door. A verification record shows that you checked someone, whereas an intelligence record shows that you formed a view of their risk and kept it current. 

The same expectation runs through the EU’s Anti-Money Laundering Regulation 2024/1624, which applies from 10 July 2027 and sets one common set of customer due diligence rules across every member state. A firm whose identity programme stops at onboarding will be able to produce records of checks, and very little else. 

What is a digital identity graph?  

A digital identity graph is the data structure that makes that tying-together possible. Every identifier connected to a customer becomes a point in the graph, including email addresses, phone numbers, device fingerprints, IP ranges, document numbers, and stored face templates. Every confirmed or suspected link between two identifiers becomes a line joining them. 

How the graph is put together

A graph records connections, which an ordinary customer table does not. A customer table can tell you that one account used a particular device. A graph can tell you that the same device fingerprint sits behind dozens of accounts opened within the same few weeks, which turns a routine login into evidence of a coordinated group.

Why matching one face against many records matters

The same idea applies to faces. A one-to-one check confirms that the person in front of the camera matches the photo in their document. A one-to-many check analyses whether that same face already sits in your customer base under a different name.

One person running several accounts under different names passes the one-to-one check every single time, because each document really does match the face presenting it. Only a one-to-many check catches the reuse of that document. 

Why does more identity data mean more AML false positives?

More data creates more false positives whenever the new signals are matched against a name instead of against a person. A name is a weak identifier. Different spellings, accent marks, reversed first and last names, and common surnames all produce matches that look plausible and describe somebody else entirely. Each list you add multiplies those matches rather than settling them.

Why adjusting the match score never fixes it

Fuzzy matching, which scores how closely two names resemble each other, has no setting that works. If you set the threshold high and you miss the sanctioned person whose name reached your system through a different alphabet. If you set it low and your analysts spend the week clearing customers who happen to share a surname with someone on a list. Teams move that threshold back and forth for years without improving either outcome, because the threshold was never the thing that was the problem.

What should an identity intelligence platform include?

Five things separate a working identity intelligence platform from a set of checks wired together. Weigh any option against all five, because a gap in one weakens the rest.

1. One verified identity to attach everything to: Every later signal needs to hang off an identity that was properly proven once, not off a customer reference number.
2. A shared data layer: Document checks, face checks, screening, and monitoring all have to be written into the same customer profile, because separate systems cannot produce a single view of risk.
3. Continuous re-screening: Ongoing monitoring should recheck existing customers as lists change, rather than waiting for the next scheduled review.
4. Scoring you can adjust and explain: Compliance teams need to set their own weights and thresholds and to see which fields drove each result.
5. Evidence an analyst can open: Every score needs to unfold into the evidence beneath it, because nobody can approve a decision they cannot inspect.

Where does AI help, and where does it not?

AI suits sorting and ranking a large alert queue. It does not suit being the final answer, and that boundary is where most implementations go wrong.

What AI models do well

Models handle volume and correlation far better than fixed rules. They pick up combinations of weak signals that no analyst would connect by hand, and they adjust as attack patterns change, which a rulebook cannot do until somebody rewrites it. The clearest win is automatic dismissal of alerts that probably describe a different person, because that work never had any value to begin with.

Where responsibility stays with people

Regulators ask why a decision was made, and a model output nobody can explain is not an answer. Accountability stays with the person reviewing the case, backed by a written policy, an audit trail, and reasoning a human can read. AI should shrink the queue and put the important cases at the top, and the judgement on those cases should still belong to your analyst.

How Shufti approaches identity intelligence

Shufti’s AML screening attaches every hit to an identity already verified by document and face. Date of birth, nationality, document number, and entity type captured during onboarding feed straight into the match score, so a hit that contradicts the verified record is dropped automatically instead of queuing up for somebody to dismiss by hand. The engine weighs who the customer is rather than how their name is spelt, and the field-level score behind each decision stays visible for audit.

That screening covers 4,000+ watchlists and 2.6M PEPs across 215+ jurisdictions, refreshed every 15 minutes, so a newly listed customer surfaces within minutes rather than at the next scheduled review.