Identity verification trends in 2027

Identity verification trends in 2027 are being shaped by legal deadlines, not just new technology. On 1 April 2027, Japan will remove a remote verification method based on an ID photograph and selfie submitted through an app. The change applies to businesses covered by its anti-money laundering rules. On 10 July 2027, the EU Anti-Money Laundering Regulation (AMLR) will harmonise core customer due diligence requirements across Member States.

Both dates are already set in law. For Know Your Customer (KYC) processes, the practical question goes beyond whether a document appears genuine. Businesses also need confidence that the person presenting it is its rightful holder. Japan’s changes and the EU’s developing standards make that connection increasingly important for remote onboarding.

Changes across Asia, the US and the EU in 2027 will affect verification methods, biometric systems and age checks. They do not all impose the same requirements. Businesses should distinguish binding deadlines from draft standards and assess which obligations apply to their services.

The EU AMLR strengthens remote identity verification requirements

From 10 July 2027, Article 22(6) of the AMLR provides document-based verification and electronic options under eIDAS, including electronic identification at substantial or high assurance levels and relevant qualified trust services. These provisions establish a common EU framework without eliminating every national requirement.

Further detail appears in the Anti-Money Laundering Authority’s (AMLA) draft standards on customer due diligence, finalised in September 2026 and subject to European Commission adoption. The standards specify the technical measures for implementing AMLR CDD obligations, prioritising eIDAS-compliant electronic identification methods, such as eIDs, the EUDI Wallet and qualified services, before resorting to alternatives like document verification if electronic identification cannot be completed, with justification for not using electronic methods. For alternatives like document verification, standards propose holder checks, secure communications, readable evidence, and timestamped records. Verification should stop when technical problems or doubts undermine the process. A selfie match alone does not demonstrate that these proposed holder-verification and recordkeeping safeguards have been met.

Article 79 of AMLR further prohibits covered institutions from maintaining anonymous accounts, including crypto-asset accounts that allow anonymisation. Existing anonymous account holders and beneficiaries must undergo due diligence before those accounts are used. Our EU AMLR guide explains the wider obligations.

Chip and wallet verification gain ground alongside document checks

Japan offers a clear example of how remote verification is changing. Its June 2025 amendment removes the app-based ID-photo-and-selfie method from 1 April 2027, following concerns about impersonation. It shifts remote verification towards reading an identity document’s integrated circuit (IC) chip. Specified alternatives remain available for customers who cannot use chip-based verification.

In Europe, Article 5f of eIDAS 2.0 requires in-scope banks and other private service providers subject to strong user authentication requirements to accept the EU Digital Identity (EUDI) Wallet at users’ request. The deadline is 36 months after the relevant implementing acts enter into force, pointing to around December 2027.

Australia is also set to expand its government Digital ID System from 1 December 2026, allowing accredited private providers to support access to selected government services.

For businesses, the priority is to support these methods without excluding customers who lack compatible credentials. Document-based alternatives will remain necessary where local rules permit them.

Reusable digital credentials can reduce repeated document uploads

Digital identity verification in 2027 may increasingly involve receiving and evaluating trusted identity attributes rather than collecting the same documents at every interaction. Reusable digital credentials support this shift by allowing people to share verified information with different services.

The European Commission describes EUDI Wallets as allowing users to store digital credentials and disclose only the details needed for an interaction, such as age or nationality. This selective disclosure limits the additional personal information a business receives.

Reusing identity information also requires understanding how it was verified. The OpenID Foundation’s eKYC and Identity Assurance work standardises the exchange of verified identity information and supporting details, including how verification was performed, what evidence was presented, and when the checks took place.

For businesses preparing for 2027, the priority should be to assess the source and verification history of the information they receive, rather than automatically accept every digital credential. This helps teams determine whether the evidence meets the requirements of their service.

The opportunity is to reduce repeated document requests and unnecessary data collection while retaining a clear basis for trusting the identity information presented.

Biometric verification faces AI and cybersecurity requirements

The EU’s AI Omnibus, which entered into force on 27 July 2026, moved obligations for Annex III high-risk AI systems, including certain biometric systems, to 2 December 2027.

Annex III of the AI Act excludes biometric verification used solely to confirm a claimed identity from its high-risk remote biometric identification category. One-to-one face matching at onboarding is therefore not high-risk on that basis alone. Other uses, including certain biometric categorisation and remote identification systems, require a separate assessment of the applicable rules.

The Cyber Resilience Act (CRA) applies its main obligations from 11 December 2027. In-scope products can include verification software development kits (SDKs) and wallet applications. Vendors will need evidence of security by design, secure default settings, and vulnerability handling. Buyers should assess those capabilities during procurement rather than treating every verification product as automatically covered.

Age-assurance laws will drive digital identity adoption

Age-assurance laws are creating new reasons to use digital identity verification tools, including checks on age and parental authority. Utah’s amended App Store Accountability Act introduces key age verification and parental consent requirements from 6 May 2027.

India’s Digital Personal Data Protection (DPDP) Rules introduce verifiable parental consent requirements for children’s data from around May 2027, subject to specified exemptions. This creates a separate need to establish that the consenting parent is an identifiable adult.

For app-store-based checks, developers may receive an age-category signal rather than collect identity documents themselves. Businesses should assess whether their age verification processes can use these signals securely, resist bypass, and limit personal data collection. The objective is reliable proof of eligibility, not full identity disclosure at every interaction.

Fraud will move faster than any single rulebook

Fraud networks already cross borders faster than regulators can align Shufti’s Identity Fraud Report 2026, which analysed verification data from the first half of 2026, found that 2.01% of fraudulent attempts linked by shared attributes (like device, document, selfie) spanned more than one country. The typical interval between appearances in different countries was 9 minutes and 33 seconds, and the fastest was 38 seconds.

As the EU harmonises customer due diligence requirements and Japan changes its permitted remote verification methods, attackers may target markets or channels that accept weaker evidence. Businesses preparing for 2027 should therefore assess connections between verification attempts across markets, as well as evaluate each application on its own.

Identity verification in 2027 needs a risk-based, multilayered approach

These threats show why a single successful check may not provide enough confidence in a digital identity. A document may appear genuine while the device, behaviour or connections to other applications raise concerns.

Shufti’s Identity Fraud Report 2026 describes combining document and biometric checks with device fingerprinting, network analysis and behavioural signals to support risk-based decisions.

The National Institute of Standards and Technology NIST uses assurance levels in its Digital Identity Guidelines to align identity proofing and authentication controls with risk, while considering fraud, privacy and customer experience.

For 2027, businesses should use these combined signals to determine whether the standard checks provide enough confidence or whether further evidence is needed. A practical approach could follow three paths.

• Lower risk: Complete the required checks without adding unnecessary steps.
• Additional risk: Request further evidence or apply targeted checks to resolve concerns.
• High-risk combinations: Escalate for enhanced review or reject the application when the evidence supports that decision.

The aim is to strengthen detection without making every customer complete the same verification journey. Risk-based checks should reduce unnecessary friction, not replace the minimum assurance required for the service.

Five ways to prepare your identity verification systems for 2027

Compliance and product teams should turn these developments into a plan for the markets and services they support. The priorities below connect regulatory requirements with verification methods, risk decisions, and customer experience.

Map requirements to each market and service: Record which rules apply, when they take effect, and what evidence each process needs. Distinguish binding law from draft standards, and assess KYC and age-assurance obligations separately rather than applying one checklist to both.

Support trusted verification methods and check the holder: Prepare for chip and wallet verification alongside permitted document-based methods. For reusable credentials, assess the source, verification history and whether the information meets the service’s requirements. For remote document checks, review holder verification, appropriate liveness controls and secure, timestamped records.

Connect fraud signals to risk-based decisions: Review document, biometric, device and behavioural signals together, including links across markets where lawful. Define when to complete standard checks, request further evidence or refer an application for review. Keep minimum required checks in place for lower-risk customers.

Build age assurance around eligibility and privacy: Determine when an app-store age signal is sufficient and when further checks or verifiable parental consent are needed. Limit personal data collection to what the service and applicable rules require.

Assess vendor readiness and retain audit evidence: Review whether the AI Act and CRA apply to each product and intended use. Request relevant security documentation, vulnerability-handling procedures, and test reports. Check what the testing covers rather than assuming a liveness result also demonstrates protection against injection attacks.

How Shufti helps in Identity Verification

Identity verification requires businesses to check two things: whether the identity evidence is genuine and whether it belongs to the person presenting it. Shufti helps businesses make these checks across physical identity documents and digital identity credentials.

For passports and ID cards with built-in chips, Shufti’s NFC verification reads the information stored on the chip and checks whether it is genuine and has been tampered with. For digital identity wallets and mobile driving licences (mDLs), Shufti helps businesses check digital credentials and confirm that they are valid.

Businesses also need to confirm that the person presenting the identity is the rightful holder. Shufti’s selfie liveness works alongside document verification. It compares a live selfie with the photo on the identity document and helps detect attempts to trick the system using screen replays, masks, AI-generated faces or virtual cameras.

Shufti’s passive liveness technology achieved iBeta Level 3 presentation attack detection conformance in testing against ISO/IEC 30107-3. The testing was conducted by an NVLAP-accredited laboratory, providing independent evidence of the tested implementation’s performance that businesses can consider when assessing vendors.