Banking & fintech

KYC onboarding for banks and fintechs

Replace document upload with identity attributes signed by the issuing member state.

Use case
KYC
Wallet data
PID
Authbound capability
Identity Verification
Flow
Verify
What changes

Before and after the wallet

Today

  1. Upload passport
  2. OCR
  3. Liveness
  4. Manual review
  5. Your AML, sanctions and PEP screening

With the EUDI Wallet

  1. Approve in wallet
  2. Authbound verifies
  3. Your AML, sanctions and PEP screening

The wallet changes how the evidence is collected. The step at the end stays yours.

The problem

Why this is worth changing

For the business
Every attempt is billed, retries included, and abandoned signups never become customers.
For the user
Photographing a passport under good light and passing liveness is where applicants give up.
For operations
Glare, blur and transliteration mismatches push applications into a manual review queue.

Why the wallet helps

A wallet already holds identity attributes signed by the issuing member state. You ask for the ones your due diligence actually needs and get them back as structured data. No image to grade, no OCR to fail, no transliteration argument.

  • No capture, OCR or liveness retry loop in the signup path
  • Manual review becomes the exception instead of the default
  • A wallet from any member state verifies the same way
User journey

What actually happens

  1. 01

    You request specific attributes

  2. 02

    The user gets the request by QR or deep link

  3. 03

    The wallet shows exactly what is asked

  4. 04

    The user approves on their device

  5. 05

    The wallet presents the signed credential

  6. 06

    Authbound verifies the presentation

  7. 07

    Your backend receives a structured result

  8. 08

    Your existing workflow continues

How it works

Three steps with Authbound

  1. Step 01

    Ask for the attributes

    Your signup calls the Authbound API with the claim set your due diligence requires, and nothing else.

  2. Step 02

    The applicant approves

    QR on desktop, deep link on mobile. They see exactly what is being asked before they consent.

  3. Step 03

    Get a signed result

    We check the issuer against the EU trust list, check revocation, confirm device binding, and hand your backend a verified result with an audit record.

Technical flow

  1. Your application
  2. Authbound API
  3. Wallet request
  4. Presentation
  5. Trust and revocation checks
  6. Your backend
Technical details
const verification = await authbound.verifications.create({
  policyId: 'pol_…',      // the claims this flow requests
  customerUserRef: user.id,
});

// Your webhook then receives verification.completed
// with the verified result and its audit record.
  • Request: an OpenID4VP presentation request built from your policy.
  • Hand-off: QR code on desktop, deep link on mobile.
  • Checks: issuer against the EU trust lists, status list revocation, device binding.
  • Result: structured claims plus an audit record, delivered by webhook.
Who does what

What Authbound handles, what you handle

Authbound handles

  • The wallet request, with QR on desktop and a deep link on mobile
  • Verifying the presentation the wallet returns
  • Checking the issuer against the EU trust lists
  • Revocation and device binding checks
  • A structured result delivered to your backend
  • An audit record of every verification

Your application handles

  • Choosing which attributes the flow requests
  • Your business logic and account creation
  • Your AML, sanctions and PEP screening
  • Risk and fraud decisions
  • How long you keep the result
  • A path for users without a wallet
What's involved

Credentials, standards and rules

Wallet presents

  • PID

Regulatory context

AMLD5 and AMLD6 customer due diligence, eIDAS 2.0

Banks and payment service providers are named relying parties under eIDAS 2.0 Article 5f and must accept the wallet for identification from December 2027. AML customer due diligence still applies in full: the wallet changes how identity is evidenced, not your obligation to assess risk, screen sanctions and PEPs, and monitor the relationship. Before going live you also register as a relying party and declare which attributes you request and why.

Nordhaus demo
Live demo

See the complete flow in Nordhaus

A neobank signup that turns KYC into a 30-second wallet step.

What it asks the wallet for

  • given_name
  • family_name
  • dob
  • nationality
  • address

What the business gets back

IBAN
FI73 1100 4500 1940 6X
KYC status
Approved
Virtual card
Ready
Open the Nordhaus demo

Nordhaus is a fictional company built by Authbound. The wallet integration in it uses the real Authbound SDK.

Questions

What buyers ask

Does this satisfy AML customer due diligence?

eIDAS 2.0 puts wallet presentations at the high assurance level, which is what AML regimes accept for remote onboarding. You still run your own risk scoring, sanctions and PEP screening. The wallet replaces identity proofing, not your AML program.

What about applicants without a wallet?

Keep your current provider as the fallback and route wallet holders to the faster path. We return a clean unsupported result you can branch on rather than failing the session.

Do we still store an identity document?

There is no document to store. You keep the attributes you are required to retain plus the signed verification record, which is a much smaller thing to protect than a passport scan sitting in a bucket for five years.

Can we keep our current KYC provider?

Yes. Authbound adds the wallet path next to it rather than replacing it. Most teams offer the wallet first and keep the document flow for applicants who do not have one yet.

What does our backend receive?

A verification.completed webhook with the attributes your policy requested, such as name, date of birth, nationality and address, plus the verification ID and your own customer reference. A failed check arrives as verification.failed with a failure code.

Is the address always included?

No. Resident address is an optional attribute in the PID, and not every member state includes it. Keep a proof-of-address fallback for applicants whose PID does not carry one.

When do banks have to accept the wallet?

Every member state has to offer a wallet by 24 December 2026. Private services that are legally or contractually required to use strong user authentication have to accept it from December 2027 when the user asks. For banks the trigger is already met, because they require strong authentication today.

Does it work for applicants from other member states?

Yes. Every certified wallet presents over the same protocol and is checked against the same EU trust lists, so a Spanish applicant at a Finnish bank is not a separate integration.

What happens if a credential cannot be verified?

The verification ends as failed with a reason such as an untrusted issuer or a revoked credential. Nothing is half-onboarded. You route the applicant to your existing method.

Do we need to register before accepting wallets?

Yes. Relying parties register in their member state and declare the purpose and the attributes they request, and the wallet shows that registration to the user. Keep your Authbound policy aligned with what you declared.

What do we still build ourselves?

A wallet button or QR step in signup, a webhook handler, and the onboarding logic that runs on the result. The protocol, trust list and revocation work sits with Authbound.

Next step

Have a different wallet use case in mind?

Tell us what you are trying to build. We will map the user journey, the credentials and the wallet interaction to an implementation.