The North America Guide to Docless Verification

Document-first onboarding is now a conversion and fraud problem.

US consumers reported 15.9 billion dollars lost to fraud in 2025, the highest figure on record and up from 12.5 billion the year before FTC Consumer Sentinel 2025. The document upload step, the artefact most onboarding flows are built around, now works against operators on two fronts at once: it is where genuine users quit, and it is where fabricated documents walk in.

Digital account opening is the mainstream channel behind that pressure. In the US, 48.3 percent of banked households used mobile banking as their primary way to reach an account in 2023. In Canada, digital methods made up 86 percent of a 22.5 billion transaction payment volume in 2024.

The FBI’s Internet Crime Complaint Center logged 1,008,597 complaints and about 20.9 billion dollars in reported losses in 2025, a 26 percent rise FBI IC3 2025 Report. Canadians reported more than 704 million dollars stolen the same year, also a record, and the Canadian Anti-Fraud Centre estimates only 5 to 10 percent of fraud is reported at all.

Two failures land on the same upload step.

The step where genuine users quit. Asking an applicant to find a physical document, photograph it in good light, and retry after a blurred frame is the highest-friction moment in remote onboarding, and users lost here are rarely recovered. This is a field observation from verification funnels across the region, not a cited statistic.

The step where fraud now enters. Generative AI has made convincing fake identity documents cheap to produce at scale. FinCEN warned financial institutions in November 2024 that criminals use deepfake media, including fabricated identity documents, specifically to defeat verification controls FinCEN deepfake alert.

Underneath both sits a third problem, and it is distinctly North American: synthetic identity. Because the US has no national ID and Social Security numbers are not verified in real time when most accounts open, criminals fabricate people, pairing a real SSN with an invented name and date of birth and letting the profile mature. Financial institutions reported 182 million dollars in synthetic-identity suspicious activity in 2021 across roughly 3,000 SARs, a figure the GAO notes undercounts the real total GAO synthetic identity.

A document photo does nothing against this, because the synthetic applicant presents a person who does not exist rather than impersonating someone real. A flow that runs every applicant through the same document check concentrates friction on the genuine majority while leaving the region’s signature fraud unaddressed.

CIP and FINTRAC already support docless checks.

Docless verification is written into US and Canadian law under the regulator’s own word for it, non-documentary, and it has been there for over two decades. Elsewhere the docless case rests on a regulator having allowed electronic verification. Here the route is named in the regulation text itself, which is the page’s central point and Shufti’s strongest ground in the region.

In the US, the load-bearing authority is the Customer Identification Program rule. Under Section 326 of the USA PATRIOT Act, FinCEN’s CIP rule for banks at 31 CFR 1020.220 permits non-documentary verification and lists the methods in its own words.

These methods may include contacting a customer; independently verifying the customer’s identity through the comparison of information provided by the customer with information obtained from a consumer reporting agency, public database, or other source; checking references with other financial institutions; and obtaining a financial statement.

The same docless provision appears in the parallel CIP rules for broker-dealers, mutual funds, and futures firms. The rule even names the exact situation remote onboarding creates: the customer who opens the account without appearing in person.

Canada’s governing statute is the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, and two of FINTRAC’s prescribed methods are docless by design.

FINTRAC’s own guidance sets out these routes FINTRAC methods guidance. The credit-file method turns on a live search: a stored copy, or one supplied by the customer, does not qualify. The dual-process method can use a Canadian credit file that has existed for at least six months as one of its two sources.

Neither country treats docless verification as an exception to be justified. Both describe it as a standard route, specify what sources qualify, and expect the same record-keeping either way. The question a North American compliance team faces is not if the regulator permits a database check. It is if their current onboarding flow reflects what the regulator already wrote.

Passive checks should carry the low-risk majority.

Shufti’s eIDV runs three verification methods, each built for a different assurance level and user journey. In North America they do not carry equal weight, and understanding why is most of the deployment decision: the database match the regulators describe is exactly what the Passive method does.

Biometrically Enriched binds a live selfie to the photo on the authoritative record. It is the direct counter to synthetic identity: the fabricated applicant may hold a real SSN and a plausible file but cannot present the face the record belongs to. It runs as 1+1 (single source) or 2+2 (dual-source cross-reference).

The Mobile Driver’s Licence Is America’s eID Moment, and It Is Live Today

The mobile driver’s licence gives the US its first sovereign digital credential to verify against, and it is already in use. An mDL is issued by a state motor vehicle agency, signed cryptographically by the issuer, and held in a phone wallet. Until now the Active method mapped to Canada and Europe rather than the US, because there was no US credential to present. The mDL changes that.

More than 20 states plus Puerto Rico issue mDLs as of early 2026, a count that still moves quarterly. TSA already accepts them at 250+ airport checkpoints TSA mobile driver’s licences, which normalises the behaviour for millions of travellers.

ISO/IEC 18013-7, published October 2024, is what makes an mDL usable inside a remote onboarding flow.

The piece that matters for onboarding is remote presentation. ISO/IEC 18013-7, published in October 2024, extends mDL presentation over the internet, which is what makes it usable inside a remote flow. Selective disclosure is built in, so a flow can request a date of birth or an age-over threshold without pulling the full licence.

The rulebook is catching up too. In March 2026, NIST released the initial public draft of SP 1800-42A, a reference architecture for financial institutions accepting mDLs in customer identification NIST SP 1800-42A. The CIP rule was always technology-neutral; this is the document that turns mDL acceptance into an examinable practice. NIST SP 800-63-4, the federal Digital Identity Guidelines, was published final in July 2025.

Coverage arrives state by state and wallet by wallet, which is exactly why it needs an orchestration layer. Shufti verifies California and Louisiana mDLs today; the remaining issuing states activate on client demand through configuration, not new integration work.

Route users by risk, not by one default document step.

The practical question for a North American onboarding team is how to route each applicant to the right method, using risk level, data availability, and the fraud typology this region actually produces. The answer is a single decision flow: verify the low-risk majority against the data the regulators already point to, add a biometric bind where synthetic identity is the threat, and reserve the document flow for the cases that need it.

The fallback step is what makes the model safe to deploy. Database coverage is broad in both countries, but no source covers everyone. Recent immigrants, young applicants with no credit history, and anyone with a thin or absent bureau file will not always clear a Passive check. An automatic route to the document flow keeps them onboardable while everyone else skips the step entirely.

A routing model imported from Europe or APAC treats biometric enrichment as a premium tier for high-value accounts. In North America it belongs in the mainstream risk logic, because the signature fraud is a fabricated person with real-looking data. A live face bound to the authoritative record is the one check the synthetic applicant cannot rehearse.

The US and Canada Run Different Rails Under Different Rules, and a Flow Has to Respect Both

Both countries permit docless verification and neither has a national ID, but the rails, the named methods, and the fraud pressure differ in kind. A verification programme that treats North America as one market will misconfigure one side of the border.

Source · US CIP rule and NIST SP 800-63-4; Canada PCMLTFA/PCMLTFR and FINTRAC methods guidance; CAFC 2024.

The US runs on credit-header data from the three nationwide bureaus, backed by government match services: the SSA’s eCBSV confirms an SSN, name, and date-of-birth combination, and AAMVA’s DLDV checks driver’s licence data against the issuing agency. The Active rail is the mDL, now live in early states.

Canada runs on Equifax Canada and TransUnion Canada for the FINTRAC credit-file method, with bank-login verification through Interac and provincial digital IDs (the BC Services Card and Alberta.ca Account are live; Quebec’s programme gained its legal basis in October 2025; Ontario’s remains paused and should not be treated as an available rail).

BANKING

Safwa Bank achieved 175% faster mobile onboarding and a 99% verification success rate with Shufti. Bring the same speed and reliability to your customer onboarding.

Book a Demo

One Shufti integration runs the full North American flow.

Shufti’s advantage in North America is the combination: docless verification and document verification across the US and Canada, through a single integration, with AML screening alongside. Businesses onboarding across both countries usually assemble this from parts, one vendor for bureau checks, another for document capture, a third for watchlist screening, and internal engineering to hold the seams together. Shufti runs the full routing model through one API.

Passive checks draw on 230+ authoritative databases, including the US and Canadian bureau and government rails. Active verification connects to 40+ national eID schemes through the same hub that runs BankID, Singpass, and the European schemes, and in North America that now includes the US mDL rail alongside Interac and the provincial digital IDs. Shufti verifies California and Louisiana mDLs today, with the remaining issuing states activating on client demand through configuration.

Biometrically Enriched verification binds a live selfie to the source record with liveness detection certified to iBeta PAD Level 3. Where the record is an mDL, the match runs against the licence portrait the issuer returns, which answers the case where the phone in the flow is not held by the person the licence belongs to.

When a case needs a document, the fallback is already in the same flow. Shufti’s document verification supports 10,000+ document types from 240+ countries and territories, combining OCR, NFC chip reading where the document supports it, and biometric face matching. That matters in a region defined by cross-border movement, a US fintech onboarding a new arrival with a foreign passport, or a Canadian platform verifying a customer whose credit file is six months too young for the credit-file method.

AML screening runs in the same flow, so a user verified through either route is screened against sanctions and watchlists without a second integration. Routing logic lives in Journey Builder configuration, not code, so compliance teams can adjust risk tiers or fallback conditions without an engineering release. Teams that prefer to configure and price a full stack without a sales call can start there at any tier.