Digital account opening, opening a checking or savings account online or in an app with no visit to a branch, is no longer treated as higher risk by itself. On February 25, 2025, FATF, the international standard setter for anti-money-laundering rules, amended its standards so that non-face-to-face business relationships count as an example of potentially higher risk "only where appropriate risk mitigation measures have not been implemented" (FATF, 2025). The change follows practice: 70.5% of banked US households already use an off-site channel as their main way of banking. The risk of a remote application now depends on the controls behind it: identity proofing to a known standard, liveness and deepfake checks, a person on every automated refusal, and a record of each. Botminds' Deposit Account Opening runs those checks while the applicant types and keeps the evidence for each one, which is what a bank shows when someone asks how its digital channel is controlled.
The standards and data quoted here come from FATF, US regulators, NIST and peer-reviewed research, linked where they appear. The sample screens come from a fictional bank, Corvane National Bank.
Most banked households now reach their bank without a branch
Primary way banked households accessed their account, 2023
- Mobile banking · 48.3%
- Online or telephone · 22.2%
- Teller or ATM · 28.9%
- Other · 0.6%
What is digital account opening?
Digital account opening is the process of applying for and opening a deposit account entirely through a website or a mobile app: entering identifying information, proving identity remotely, accepting disclosures electronically and funding the account by card or transfer. In the US it runs under the same rules as a branch opening, the Customer Identification Program rule above all, with one difference the rule names outright.
When a customer opens an account without ever coming into a branch, the bank's procedures must use non-documentary verification methods (31 CFR 1020.220). The rule's examples are getting in touch with the customer, matching the details against a credit bureau, a public database or another independent source, asking other banks for references and requesting a financial statement (how banks verify identity compares them). Digital opening is therefore not a lighter process; it is a different set of checks, and the rule expects the bank to choose them deliberately.
Is non-face-to-face onboarding high risk? What FATF changed
Not in itself, under FATF's standards since February 2025. FATF's interpretive note to its customer due diligence recommendation used to list non-face-to-face relationships among its examples of potentially higher-risk situations without qualification. The amendment added the qualifier, and FATF gave its reasons in the same publication.
FATF's example of higher risk, before and after February 2025
Before: Non-face-to-face business relationships or transactions listed among examples of potentially higher-risk situations.
Since February 25, 2025: Listed as potentially higher risk "only where appropriate risk mitigation measures have not been implemented."
Before: Remote onboarding treated as a risk factor in its own right.
Since February 25, 2025: Non-face-to-face interaction "has become standard business practice," and digital identity systems "may reduce the risks associated."
Before: Measures "commensurate" with risk.
Since February 25, 2025: Measures "proportionate" to risk, with more room for simplified measures, to reach some 1.4 billion people without a bank account.
The amendment did not appear from nowhere. FATF's 2020 guidance on digital identity already said that remote onboarding relying on "reliable, independent digital ID systems with appropriate risk mitigation measures in place, may present a standard level of risk, and may even be lower-risk", and it measured reliability by assurance levels drawn from the US NIST framework and the EU's eIDAS regulation (FATF, 2020). The Wolfsberg Group's 2022 guidance for banks took the same line: "with the appropriate controls in place, non-face-to-face customer engagement may be a standard, or even lower-risk engagement channel" (Wolfsberg Group, 2022).
Non-face-to-face business relationships are an example of potentially higher-risk situations "only where appropriate risk mitigation measures have not been implemented."
FATF, Interpretive Note to Recommendation 10, as amended February 25, 2025
Is online account opening safe? The threat is real
Online account opening is as safe as the controls behind it, and the threat those controls face is documented. FinCEN's analysis of 2021 filings found that about 1.6 million reports, 42% of all Bank Secrecy Act reports that year, involving $212 billion of suspicious activity, related to identity, and that 13%, about 323,000, described criminals "exploiting insufficient verification processes" (FinCEN, 2024).
Generative AI raised the stakes. FinCEN's November 2024 alert reported that criminals were using generative AI to fake documents, photos and video in order to get past banks' identification and due diligence controls (FIN-2024-Alert004; deepfake identity verification reads the alert in detail). NIST's 2025 identity proofing standard says such fakes are built to fool automated document checks, biometric matching and the human reviewers who compare images (NIST SP 800-63A-4): the machines and the people both.
Neither people nor a single check can carry remote identity alone
A face-to-face meeting is not the fallback it seems. In a peer-reviewed study, passport officers comparing photos with the person in front of them accepted 14% of fraudulent photos, and did no better than students (White et al., 2014). Treasury's 2024 report on AI risks went further for remote channels: even a live video call with a client the bank knows may no longer be enough to verify identity, because AI can now generate convincing video (Treasury, 2024). The answer is layered controls, not a return to the branch.
Remote identity verification: the controls that answer the question
Remote identity verification is credible when it combines evidence checks, a check that the person is present and real, a match between the two, and independent data, with people on the cases that do not resolve. Each element below has a public standard or a regulator's statement behind it, which is what makes it useful when a board, an auditor or an examiner asks how the digital channel is controlled.
Remote onboarding controls a bank can show, and where each comes from
- Identity proofed to a stated assurance level, such as NIST IAL2
IAL2 is built to withstand forged or stolen evidence and social engineering (NIST SP 800-63A-4).
- Document authenticity checked, not just read
Security features and data on the ID validated; FATF measures digital ID reliability by assurance level.
- Liveness detection on the selfie
Required by the EBA’s remote onboarding guidelines in the EU; a FinCEN red flag is a third-party webcam plugin during live verification.
- Data matched to at least two independent sources
The CIP rule names checks against a credit bureau, a public database or another independent source.
- Not knowledge-based questions alone
FFIEC 2021: dependable verification rarely rests on knowledge-based questions by themselves.
- Device, location and funding signals
FinCEN red flag: device or geographic data inconsistent with the identity documents.
- A person reviews before any automated refusal
NIST’s 2025 standard: no enrollment is declined on an automated biometric hit until a person has reviewed it.
- A written statement of which steps are automated
EBA guidelines ask firms to say which steps run without a person and which need one.
The NIST standard is the reference most banks will want for the first item. It is binding on federal agencies, not on banks, but FATF's guidance borrows its assurance levels, and it is the most specific public answer to "how sure is sure enough". NIST identity assurance levels for account opening sets out what IAL2 and IAL3 require and how the second line can test a vendor against them.
Open a checking account online instantly: what "instant" can honestly mean
An online checking account can honestly open in seconds when every check has run and every result falls inside limits the bank wrote down in advance. It cannot honestly open in seconds when one check is still pending, when a result needs judgement, or when the funding looks wrong; those cases need a person, and an "instant" promise that skips them moves the risk rather than removing it.
Take a sample application at the fictional bank. The applicant spent 7 minutes 40 seconds on the form. While he typed, the sanctions lists came back clear, his license and selfie were verified with a match of 0.98, his data were verified on two sources and his $150 debit card deposit was verified and held. Four seconds after he submitted, the decision arrived. His was referred, because his checking account report showed an old unpaid overdraft; an applicant whose results all fall inside the bank's limits opens at that moment, and the bank's target is that 89% of completed applications do.
The checks behind one decision, each with its version, time and confidence
Where the remaining risk sits: funding and the first days
Once identity is controlled, the remaining exposure of a digital account sits in how it is funded and used in its first days. A card in another person's name, several applications from one device, a transfer split across cards to stay under a limit: these are signals that show up at funding, before money moves, if the bank looks for them then.
In Deposit Account Opening, the Funding agent verifies the card's name and authorization, validates an ACH account the first time it is debited, and checks device and velocity while the applicant types. The deposit is held, not captured, until the account is approved, and any fraud signal over the bank's threshold goes to its fraud team with the evidence. On one sample day, 1,598 opening deposits were verified and 9 of 24 funding signals were handed to the fraud team; across the previous 30 days, 31 funding frauds were stopped and $38,900 never moved.
Opening deposits held until approval, and signals handed over before money moves
What an examiner will ask about a digital channel
An examiner testing a bank's identity program samples accounts, not policies, and the FFIEC's procedures name the digital channel directly: the sample should be a cross-section that includes mail and online accounts, and, on a risk basis, accounts opened before their verification was complete (FFIEC BSA/AML Manual). For each one, the examiner checks that the information was obtained before opening, that identity was verified, that discrepancies were resolved and described, and that the name was compared against the lists.
A remote file answers those questions only if the evidence was kept as the checks ran: which document was examined, which sources the data matched, what the liveness check returned, who resolved a mismatch and why. Rebuilding that from three vendors' logs after the fact is where digital programs lose time in an exam. In Deposit Account Opening every check is on one audit trail with its result, time and source, and an examiner pack masks Social Security numbers to the last four digits and leaves out restricted 314(a) items.
Digital account opening and financial inclusion
FATF made its 2025 change for inclusion as much as for efficiency: about 1.4 billion people worldwide have no bank account, and treating every remote applicant as higher risk pushes them to cash or to costlier services. The same logic holds in the US, where 16.4% of unbanked households interested in an account say they lack the required ID, and 70.5% of banked households already bank off-site.
Remote onboarding is where access is won or lost
1.4B
people worldwide without a bank account, in FATF’s 2025 estimate
70.5%
of banked US households use an off-site channel as their main access
16.4%
of unbanked US households interested in an account lack the required ID
A remote channel that refers every unusual applicant to a slow back office serves the easy cases and loses the rest. One that runs the checks once and writes each referral as a sentence can afford to look at the unusual ones, including applicants with a foreign passport or an old overdraft. Account opening software, priced by what applicants gain puts numbers on that, and the account opening process run in parallel shows the sequence. The solution is Deposit Account Opening.
Questions people ask
Is online account opening safe for customers?
It is as safe as the bank's controls. For the applicant, the main risks are someone else opening an account in their name and phishing sites imitating banks. Banks that proof identity to a stated standard, check liveness and verify funding sources in the applicant's own name make both harder, which protects the customer as well as the bank.
Do US rules treat online account opening as higher risk?
The CIP rule does not label it higher risk, but it does require non-documentary verification methods when the customer does not appear in person. FATF's February 2025 amendment to the international standard, which the US helps set as a FATF member, now treats non-face-to-face onboarding as potentially higher risk only where mitigating measures are missing.
Can I open a bank account online without video verification?
Yes. No US rule requires a video call to open a deposit account; a digital opening can rely on a document check and a selfie with liveness instead. Treasury has warned that even live video may no longer be sufficient on its own because of AI-generated video, so a video step is one control among several, not a guarantee.
What is the difference between digital and online account opening?
In practice the terms are used interchangeably for applying and opening without a branch visit. Digital account opening usually refers to the whole process, including remote identity proofing and electronic signatures, and often to the software platform that runs it; online account opening is how customers tend to describe the same thing.
Does a digital account opening need a different CIP program?
Not a different program, but the program must cover it: the rule requires procedures for customers who do not appear in person, including the non-documentary methods the bank will use. Examiners also sample accounts opened online, and the FFIEC procedures list mail and online accounts among the cross-section they expect to see.