For a decade, digital onboarding in Europe has run on one ritual. Photograph your ID, look into the camera, wait ninety seconds, and an algorithm decides whether you are in. It powers neobanks, crypto exchanges and online casinos alike.
That ritual is about to change. Not because it has been banned, but because two pieces of EU law now pull in the same direction. AMLA’s final draft standards on customer due diligence, submitted to the European Commission on 1 October 2026, make electronic identification the default and demote selfie-and-document checks to a fallback you must justify. And Article 76(5) of the EU Anti-Money Laundering Regulation (AMLR), which applies from 10 July 2027, puts a meaningful human behind every automated decision to accept, refuse or keep a customer.
So, can a machine still onboard your customer in 2027? Yes, but not the way most funnels work today. Here is what changes, where the real uncertainty lies, and how to redesign before your supervisor asks.
What actually changed on 1 October 2026
The AMLR itself is technology-neutral. Article 22(6) gives two ways to verify a customer’s identity: an identity document, supported where relevant by reliable and independent sources, or electronic identification at eIDAS assurance level “substantial” or “high”, with relevant qualified trust services. It says nothing about selfies, liveness or video calls.
The detail sits in AMLA’s regulatory technical standards on customer due diligence, whose final report is dated 30 September 2026. Three provisions matter for every remote onboarding team:
- The default. The standards say electronic identification and qualified trust services should be used wherever possible.
- The gateway. Draft Article 7 allows remote document checks only where the person cannot reasonably be expected to present their document face to face and has no access to qualifying electronic identification.
- The burden of proof. Firms using these alternative solutions must be able to justify why the customer could not be verified by the default means, and show their supervisor that the solution meets five safeguards: confirming the presenter is the document holder, securing the channel, capturing images clear enough to identify the person unambiguously, stopping the process on interruptions or doubts, and keeping secure, time-stamped records.
Existing remote onboarding tools can continue where they meet those requirements. Nothing is banned. But the selfie has moved from the front door to the side entrance, and every customer who walks through it now needs a recorded reason.
The selfie is not dead. It has been demoted, and every customer who uses it now needs a reason on file.
Two cautions. The standards are a final draft: the Commission can still amend them, and they are proposed to apply six months after entry into force. The status of the EBA’s current remote onboarding guidelines after July 2027 has not been confirmed either. Plan on the substance, not the article numbers.
The question nobody has answered yet
Read literally, Article 7 turns on whether the customer “does not have access to” qualifying electronic identification. It says nothing about whether your firm supports it. A firm that offers no eID route at all may struggle to argue that its customers had no access to one, especially once every member state offers a wallet. Supervisors have not yet said how strictly they will read this. Treat it as the biggest open question in EU onboarding, and design so you do not depend on the generous answer.
Why regulators are moving away from the selfie
The policy shift tracks the threat data. Entrust’s 2026 Identity Fraud Report found that deepfakes now feature in one in five biometric fraud attempts, that deepfaked selfies rose 58% in 2025 and that injection attacks rose 40% year on year. iProov’s latest threat intelligence reports a 741% rise in injection attacks on iOS, with virtual cameras now the main attack route.
The distinction matters. Liveness detection was built to catch a fake held up to a camera. An injection attack never goes near the camera: synthetic video is fed straight into the data stream. Electronic identification at “substantial” or “high” assurance relies on credentials issued and bound to a person by a state or qualified provider, which is far harder to fake at scale. That is the logic behind “eID first”.
The wallet clock
The second reason the shift is realistic is timing.
| Date | What happens |
|---|---|
| 24 December 2026 | Every member state must offer at least one EU Digital Identity Wallet |
| 2 January 2027 | Germany’s planned wallet launch |
| 10 July 2027 | The AMLR applies across the EU |
| Six months after entry into force | AMLA’s due diligence standards apply (date not yet fixed) |
| 24 December 2027 | Firms legally required to use strong user authentication must accept the wallet when a customer offers it; micro and small firms are exempt |
Rollouts will be uneven. Some countries have announced 2027 dates, and adoption will take time. But by the time AMLA’s standards bite, “the customer had no access to eID” will be harder to claim in more markets every month.
For crypto-asset service providers and online gambling operators there is a subtlety. The eIDAS acceptance duty targets firms legally required to use strong user authentication, such as banks and payment providers. AMLA’s standards, however, apply to every obliged entity, including CASPs and gambling providers. Even where eIDAS does not force you to accept the wallet, the AML rulebook gives you every reason to.
The second half of the problem: who actually decides
Identity is only half the funnel. The other half is the decision, and here the AMLR is explicit for the first time.
Article 76(5) allows decisions resulting from automated processes, including profiling and AI systems. Among its conditions:
- any decision to enter into, refuse or maintain a business relationship, to carry out or refuse an occasional transaction, or to increase or decrease the extent of due diligence must be subject to meaningful human intervention to ensure its accuracy and appropriateness; and
- the customer can obtain an explanation of the decision and challenge it, except where it concerns a suspicious transaction report.
Article 18(3) closes the escape route. It lists six tasks that can never be outsourced, including the decision on a customer’s risk profile and the decision to enter into a business relationship. Article 18(2) adds that the firm remains fully liable for anything it does outsource, and recital 47 confirms that buying software is not outsourcing at all. Put simply, your AI vendor’s output is your decision.
This matters because the market is moving the other way. Vendors now advertise agents that open every alert, investigate it and recommend or even produce a final disposition, with claims of 40 to 70% faster handling. With industry false-positive rates of 90 to 95%, the appeal is obvious. None of that is unlawful. The question is where the human sits.
The grey zone: alerts
Article 76(5) names onboarding, retention, transactions and due diligence levels. It does not mention closing a monitoring alert. But closing an alert is often, in substance, a decision to maintain a relationship or to leave due diligence unchanged, and decisions on reporting suspicious activity can never be outsourced. Legal scholarship is already divided on whether the provision confines AI to the work that comes before a decision. The defensible design is simple: machines prepare, humans decide, and the record shows both.
The rubber-stamp trap
The most dangerous design is the one that looks compliant. An AI recommends, a human clicks “approve”, and the human agrees 99.9% of the time in under a minute.
EU courts have seen this pattern before. In SCHUFA (C-634/21, December 2023), the Court of Justice held that an automated score is itself a decision when the person deciding draws strongly on it. In Dun & Bradstreet Austria (C-203/22, February 2025), it confirmed that people have a genuine right to an intelligible explanation of the procedure and principles behind an automated decision, and that trade secrets do not simply override it. At least one data protection authority has since said that AI outputs playing a decisive role in a preliminary decision can count as automated decisions.
Apply that logic to Article 76(5). A reviewer who cannot see the evidence, has no time, never overrides and could not explain the outcome is not intervening. A supervisor will look at your numbers, not your policy.
Meaningful intervention has five visible ingredients:
- Competence. Reviewers understand the risk, the typologies and the model’s limits.
- Authority. They can overturn the machine without friction, and no target punishes disagreement.
- Information. They see the underlying evidence, not just a score and a summary.
- Time. Caseloads leave room to think. A decision measured in seconds is not a decision.
- Traceability. Every decision records who decided, on what evidence and why.
What the AI Act does not change
Many teams assume the EU AI Act is the rule to watch. For most AML work, it is not the first one. The Digital Omnibus, in force since 27 July 2026, moved the obligations for stand-alone high-risk systems to 2 December 2027. More importantly, the high-risk list excludes biometric verification whose only purpose is to confirm that a person is who they claim to be, and it excludes AI used to detect financial fraud from the creditworthiness category. A KYC face match or a transaction monitoring model is therefore generally not a high-risk AI system.
The binding constraints on AI in onboarding arrive earlier and from elsewhere: AMLR Article 76(5) in July 2027, and the GDPR today. Lending products that use AI to assess creditworthiness are a different story.
The blueprint: redesigning onboarding for 2027
This is how we would approach it, in order.
1. Map every decision in your funnel
List each step from sign-up to account opening and through periodic review, and mark what decides it: a rule, a model, a vendor or a person. Classify each as preparation (the machine may run it), an Article 76(5) decision (it needs meaningful human intervention) or a reserved decision under Article 18(3) (it must stay with your people). Most firms discover decisions they did not know they were automating.
2. Build two identity lanes
Make eID and the wallet the default lane wherever they are available. Keep a fallback lane for customers without access, with reason codes recorded for each customer, such as “no qualifying eID in the issuing country” or “wallet not yet available”. Then map your tools to the five safeguards: chip reading and liveness for holder control, injection and device-integrity detection for the channel, image-quality thresholds, automatic abort rules and time-stamped storage.
3. Put humans where decisions are made, not everywhere
Meaningful intervention does not mean reviewing every case by hand. Let AI clear the noise, assemble the evidence and draft the rationale. Route the decisions that matter, such as refusals, high-risk acceptances, exits and changes to due diligence, to trained people with the time and authority to disagree. This is the work our AML Operations teams are built for.
4. Prove it with numbers
Track override rates, time per decision, agreement on blind re-reviews and quality assurance findings, and report them to your MLRO and board. An override rate of zero is not the sign of a perfect model. It is a red flag.
5. Prepare the explanation and challenge route
Write plain-language explanations of how decisions are made and which factors matter, without exposing detection logic. Route challenges to a second reviewer. Train staff on the exception: anything touching a suspicious transaction report stays confidential, because tipping off is an offence.
6. Contract your vendors for 2027
Require decision logs, notice of model changes, support for explanations, audit rights and clarity on where data is processed. Your contract should reflect what the law already says: the vendor supplies a tool, and the accountability stays with you.
7. Test it before your supervisor does
Commission an independent review of your onboarding and AI decision flows against the AMLR and the draft standards. Sample real decisions and fix the gaps while the standards are still drafts.
Sector notes
| Sector | Where the pressure lands |
|---|---|
| Fintech and payments | Wallet acceptance becomes mandatory from December 2027 for firms required to use strong user authentication, and high-volume automated onboarding meets the Article 76(5) test first |
| Crypto | CASPs are obliged entities under the AMLR. Fraudsters favour fast, pseudonymous onboarding, so the fallback lane will draw the closest scrutiny |
| iGaming | Gambling providers are obliged entities (member states may exempt some, never casinos). Bonus abuse and multi-accounting make holder controls and recorded fallback reasons essential |
Is this a conversion disaster?
It does not have to be. Where national eID is mature, eID onboarding can be quicker than a selfie flow and far harder to fake. The firms that will struggle are those running a single selfie-only funnel across the EU in late 2027, with an AI making decisions nobody can explain.
The firms that will win treat 2027 as a design brief: technology does the heavy lifting, and accountable people make the decisions that matter. That is not a compromise between growth and compliance. It is the only version of automated onboarding the EU rulebook will accept.
Frequently asked questions
Will selfie and document checks be banned in the EU from 2027?
No. AMLA's final draft standards keep them as an alternative where the customer cannot present a document in person and has no access to qualifying eID. Firms must justify each use and prove the safeguards to their supervisor. The standards are still a draft and could be amended.
Can AI approve or reject customers under the AMLR?
AI can prepare, score and recommend. Under Article 76(5), decisions to accept, refuse or keep a customer, or to change due diligence, need meaningful human intervention, and customers can ask for an explanation and challenge the decision, except where a suspicious transaction report is involved.
Do crypto exchanges and online gambling operators have to accept the EU Digital Identity Wallet?
The eIDAS acceptance duty from December 2027 targets firms legally required to use strong user authentication, such as banks and payment providers. AMLA's standards, however, apply to all obliged entities, including CASPs and gambling providers, so offering an eID route is the practical way to avoid justifying a fallback for every customer.
Discussion 0
No comments yet. Start the discussion.