NIST identity assurance levels are three grades of confidence in identity proofing, defined in NIST Special Publication 800-63A-4, the final version published in July 2025: IAL1 limits automated, scalable attacks; IAL2 adds stronger evidence and checks that the applicant is its rightful owner, and is designed to resist "basic evidence falsification, evidence theft, and social engineering"; IAL3 adds a trained proofing agent, on site, and at least one biometric (NIST SP 800-63A-4). For a bank opening deposit accounts remotely, IAL2 is the natural reference point. The standard is binding on federal agencies, not banks, but it matters more since April 2026, when the agencies' new model risk guidance left generative and agentic AI to each bank's own governance: a second line asked to oversee AI agents verifying identity needs a measurable standard, and this is the most specific one there is. Botminds' Deposit Account Opening runs identity proofing as one of its agents' checks, with thresholds, versions and evidence a second line can test against it.
The standards and test data are quoted from NIST, DHS and the agencies, linked where they appear. The sample screens come from a fictional bank, Corvane National Bank.
What the public evidence says about automated identity proofing
25%
the most a demographic group’s biometric error rate may exceed the overall rate under SP 800-63A-4
10–100×
how much face recognition false positive rates often vary across demographics, NIST found in 2019
<0.88% to <76.68%
worst-case false accept rates for fraudulent documents across seven systems in DHS’s 2025 rally
78%
of presentation attacks caught by the median liveness subsystem in DHS testing
What are the NIST identity assurance levels?
The identity assurance levels are NIST's three tiers for how strongly an identity is proven before an account is created, from IAL1, the lightest, to IAL3, the strongest. Each level states which threats it is designed to resist, what evidence it collects and how that evidence is validated, and whether the process may be remote. The table summarises SP 800-63A-4's own descriptions.
The three NIST identity assurance levels, and where account opening sits
| Level | What it is designed to resist | How it is done | In deposit account opening |
|---|---|---|---|
| IAL1 | Highly scalable attacks such as automated enrollment, synthetic identities and attacks using compromised personal information | Remote or on site, with or without a person attending | Resists automated attacks, but is not designed against forged or stolen evidence |
| IAL2 | Scaled and targeted attacks, plus basic evidence falsification, evidence theft and social engineering | Additional evidence, more rigorous validation, and checks that the applicant is the rightful owner of the evidence; remote or on site | The reference point for a remote opening: ID document, selfie with liveness, data matched to independent sources |
| IAL3 | The above, with a trained proofing agent in the loop | On-site attended session with a trained proofing agent and at least one biometric | Comparable to a branch opening where an employee examines the ID, plus a biometric |
Is NIST 800-63 required for banks?
No. NIST SP 800-63 is written for federal agencies and their identity providers, and the publication says it "may be used by nongovernmental organizations on a voluntary basis". The rule a bank must meet is the CIP rule, which asks for procedures that let the bank form a reasonable belief that it knows each customer's true identity, and leaves the methods to the bank (31 CFR 1020.220).
It is nonetheless the standard banks are pointed to. FATF's guidance on digital identity measures the reliability of a digital ID system by assurance levels and says it "primarily refers to the US National Institute of Standards and Technology (NIST) digital ID assurance framework and standards" and the EU's eIDAS regulation (FATF, 2020). The FFIEC's 2021 guidance on authentication, which applies to banks, warns against relying on knowledge-based questions alone to verify identity, a principle IAL2 builds in (FFIEC, 2021). A bank that says "our remote proofing targets IAL2" gives its examiner and its board a definition they can check.
Why identity proofing is now a second-line question
Identity proofing has become a second-line question because the agencies' model risk guidance no longer reaches the AI that increasingly does it. SR 26-2, issued on April 17, 2026 by the Federal Reserve, OCC and FDIC, supersedes SR 11-7 and the 2021 statement on BSA models, and excludes the newest systems from its scope.
"However, the principles described in this guidance apply to traditional statistical and quantitative models and non-generative, non-agentic AI models."
SR 26-2, Revised Guidance on Model Risk Management (April 17, 2026)
So a classical document-scoring model may sit inside model risk management, while an agent that reads the results, weighs them and proposes a resolution sits outside it, under whatever governance the bank designs. Treasury's 2024 report on AI found it already in use for identity verification under the Bank Secrecy Act, and found criminals defeating identification programs with doctored or generated documents and images (Treasury, December 2024). The second line therefore needs questions it can answer with evidence, and NIST's levels, together with public test data, supply them.
NIST identity assurance level 2: what a remote opening must show
To claim IAL2 for remote account opening, a bank's process must collect strong enough evidence, validate it, and confirm that the person presenting it is its rightful owner, which in practice means a document check, a selfie with presentation attack detection, a match between them, and a match of the claimed data to independent sources. The standard adds specific duties for the biometric parts.
Two of those duties shape how automated proofing may decide. A provider that uses one-to-many biometric searches "SHALL NOT decline a user's enrollment without a manual review to confirm the automated search results and confirm that the results are not a false positive identification". And biometric technologies "SHALL provide performance for applicants of different demographic types that is no more than 25% worse than the performance for the overall population": if the overall false non-match rate is 0.006, no group's may exceed 0.0075, with sex, age and skin tone among the categories tested (SP 800-63A-4).
The revision also names the new threat. Its section on injection and forged media describes generative AI used "to create or modify media that contain images or videos of applicants and evidence", and notes that live document capture and presentation attack detection "do provide some protection" against it. A second line should ask which of those the process uses, and how they were tested.
How much automated identity checks vary: the DHS test data
Commercial remote identity tools vary enormously, which is why a vendor's claim of "99% accuracy" says little until it names the test. DHS's Science and Technology Directorate ran a Remote Identity Validation Rally at the Maryland Test Facility, photographing genuine documents and fraudulent ones gathered with DHS Homeland Security Investigations on three smartphones, and reported each system's worst case.
Fraudulent documents accepted, worst case, by document validation system
The spread is the finding. In the same program's earlier demonstration, 56% of systems matched documents to selfies better than 99% of the time, the median liveness subsystem detected 78% of presentation attacks, and DHS recommended "selecting systems with error rates below 10%" (DHS RIVTD). For a bank, the lesson is that the identity vendor's test results are part of the control, and that a process which leans on one check without a second source or a person is only as good as that check's worst case.
Demographic differentials: the fairness test in the standard
Face matching does not err evenly, and NIST measured how unevenly. In its 2019 study of face recognition algorithms, "false positives rates often vary by factors of 10 to beyond 100 times" across demographic groups, were "higher in women than men", and elevated "in the elderly and in children" (NIST IR 8280). False negatives, the errors that wrongly reject a genuine applicant, were more specific to each algorithm.
In account opening, a false negative on a selfie match is a referral, or worse a refusal, for a genuine applicant. That is why the 25% cap in SP 800-63A-4 matters to a bank even though the standard is voluntary: it is a fair-access test with a number on it. A second line can ask the identity vendor for its demographic results, and ask the bank's own data whether selfie referrals fall evenly across its applicants.
The manual review rule, and why a person plus a machine wins
NIST's rule that no enrollment is declined on an automated biometric hit without a manual review is not only caution; the research supports it. In a 2018 study published in PNAS, NIST and university researchers found that one facial examiner working with one of the best algorithms outperformed every other arrangement, and that combining two human examiners, while better than one, "it's not as good as combining one examiner and the best algorithm" (NIST, 2018).
That is the design a bank should look for: the machine proposes, a trained person decides the cases the machine cannot settle, and neither works alone on a refusal. People alone are not a safe fallback; digital account opening after FATF's 2025 change sets out the research on human error with ID photos and AI-generated faces.
Identity referrals, each with the reason and the proposed request
NIST 800-63-4 and the second-line checklist
A second line reviewing remote identity proofing can turn SP 800-63A-4 and the public test data into a short list of questions, each answerable with a document or a number. The list below is ours, written for a bank that uses agents or other automation to run CIP verification at account opening.
Second-line questions for automated identity proofing at account opening
- Which assurance level does the remote process target, and where is that written?
IAL2 for remote opening, stated in the CIP procedures.
- What evidence is collected, and how is each piece validated?
Document authenticity, selfie liveness, the match between them, and data matched to independent sources.
- What are the document and biometric vendors’ independent test results?
DHS RIVR or comparable, with worst-case false accept and false reject rates, not a single accuracy figure.
- Do demographic error rates stay within 25% of the overall rate?
SP 800-63A-4’s test; ask the vendor and check the bank’s own referral data.
- Can any automated result decline an applicant without a person?
It should not; NIST requires manual review before a biometric hit declines an enrollment.
- What protects against injected or AI-generated media?
Live capture, presentation attack detection, device signals; the deepfake red flags in FinCEN’s 2024 alert.
- Where are the thresholds set, and who may change them?
Fixed thresholds, changed only with a new, approved version.
- How is each agent or model versioned, measured and approved?
SR 26-2 leaves agentic AI to the bank’s own governance; the evidence should exist anyway.
- Can every sampled file show its evidence, result, time and decider?
What an examiner will ask for when sampling accounts opened with incomplete verification.
How Deposit Account Opening can be tested against the levels
Deposit Account Opening's Identity agent checks the ID document's authenticity and the selfie match, verifies name, date of birth, address and identification number on two sources, and proposes how a discrepancy is resolved under the bank's procedure; it never resolves one on its own. At the fictional sample bank, a selfie match under 0.95 refers to a person, and the agent's thresholds change only with a new version the bank's own reviewers approve.
The evidence a second line needs is kept as the checks run. Each agent has a version, an owner and a confidence threshold, and is measured against a golden set of 400 applications; each check on each application carries its result, time, confidence and the source it rests on. In the sample application, the Identity agent's document check returned "Verified" at 7:04:31 PM with a confidence of 0.98 and its data check at 7:05:44 PM with 0.99, both visible in the trace below.
The trace a second line can sample: each check, its version, time and confidence
What the solution does not do is certify itself. The identity vendor's document and biometric results are inputs the bank chooses; the solution records them, applies the bank's thresholds and puts a person on every exception. Account opening automation, agent by agent sets out the full limits; to test the Identity agent on your own past applications, start from Deposit Account Opening.
Questions people ask
What is the difference between IAL2 and IAL3?
IAL2 can be done remotely: it requires stronger evidence, more rigorous validation and checks that the applicant owns the evidence. IAL3 requires an on-site session with a trained proofing agent and the collection of at least one biometric. For deposit account opening, IAL2 is the usual target for remote applications, and an attended branch opening comes closer to IAL3.
What is NIST 800-63A?
NIST SP 800-63A is the identity proofing and enrollment volume of NIST's Digital Identity Guidelines. Its fourth revision, SP 800-63A-4, was approved in May 2025 and published in July 2025, superseding the 2017 version updated in 2020. It defines IAL1 to IAL3 and sets requirements for evidence, validation, biometrics and fraud controls.
Does the CIP rule require a specific identity assurance level?
No. The CIP rule requires risk-based procedures that let the bank form a reasonable belief that it knows each customer's true identity, using documents, non-documentary methods or both. It names no assurance level; a bank can adopt NIST's levels as its own standard, which makes its procedures easier to test.
What is presentation attack detection?
Presentation attack detection, often called liveness, checks that a selfie or video comes from a live person present at capture rather than a photo, a mask, a screen replay or an injected image. In DHS testing the median subsystem detected 78% of presentation attacks, and a few stopped all of them, which is why a bank should ask for its vendor's results.
How often should a bank re-test its identity proofing?
No US rule sets a schedule. A sensible trigger is any change of vendor, model version or threshold, plus a periodic review of referral and fraud outcomes by applicant group. In Deposit Account Opening a new agent version or threshold is approved before it runs, and the golden set of 400 applications gives each version the same test.