A Face Is Not an Address: The eKYC Gap Inside R16

On 24 June 2026 the Financial Action Task Force (FATF) put a question to the payments industry, and it sounds like housekeeping. Recommendation 16 (R16) requires ordering financial institutions to verify originator information for accuracy above the de minimis threshold, so how feasible, the consultation asked, is it to verify an originator's address using reliable and independent sources? The consultation closed on 21 August. Yet the question is not the striking part. It is that a global standard-setter still has to ask. The onboarding revolution quietly stopped answering that question a decade ago.

Electronic know your customer (eKYC) was sold as an operational improvement: faster, cheaper and better at catching a forged document than a clerk with a photocopier. On the identity question it delivered. On the location question it did something else. The revised R16 makes that distinction expensive. It turns the onboarding file into evidence for every payment that customer will ever send.

Accuracy is a verified word

R16 does not use accuracy loosely. The glossary to the revised Interpretive Note states that accurate describes information verified for accuracy, and paragraph 9 requires the originator's name, account number and address to accompany a qualifying cross-border transfer, with full postal address the default and country and town name the fallback. The FATF's explanatory note confirms the division of labour: ordering institutions must send originator information that has been verified, but need not verify beneficiary information, which they pass on as received. Below the de minimis threshold no verification is required, unless money laundering or terrorist financing is suspected. Above it, accuracy is not a description. It is a duty.

The consequence is easy to miss. Verification does not happen when the payment is made; it happened once, at onboarding, often years earlier, under whatever standard the firm then applied, and UK law says so expressly. Article 4(5) of the assimilated wire transfer regulation deems the test met where the payer's identity was verified under regulation 28 of the money laundering regulations and the record stored under regulation 40. Every subsequent transfer inherits that judgement. R16 therefore does not measure the quality of a payment record. It measures the quality of an account opening, years after the fact.

The selfie displaced the address

eKYC is built on two operations: authenticating an identity document, and binding a living person to it through biometric capture. Both have improved, and both answer one question: is the applicant the person the document describes? Neither answers where that person lives. A proof of address document photographs as readily as a passport and validates no more strongly; what remote onboarding cannot do is observe that the applicant lives there. Address is where eKYC is structurally weakest, and firms have known it for years.

The Financial Conduct Authority (FCA) set out the consequences in its Final Notice against Monzo Bank Limited of 7 July 2025, imposing a penalty of £21,091,300. Monzo's procedure compared a customer's selfie video and date of birth with a government-issued photo identification, alongside a separate check of name, date of birth and residential address against credit reference agency data. For almost all of the period examined, applicants had to pass only the selfie. Address verification had been withdrawn in early 2019 after the firm concluded it was not a reliable indicator of criminal propensity. Around 20 per cent of current account customers had failed it. Among those treated as higher risk, the failure rate was 47 per cent.

The results are well known: accounts registered to famous London landmarks, PO boxes, foreign addresses carrying UK postcodes, and a bank that could not confirm all its customers were UK-based. The quieter detail matters more. The FCA recorded that the absence of address verification as an onboarding prerequisite was not contrary to prevailing guidance on the money laundering regulations. It counted against the firm anyway. Having no process for verifying addresses sits among the failings making up the breach of Principle 3, because it left Monzo unable to tell whether its customer base matched its risk appetite. The rule did not compel the check; defensibility did.

But that reading no longer holds. Under the revised R16 the originator's address is required information, and required information must be verified. UK Finance's voluntary guidance already tells firms to populate a wire transfer with the address identified and verified during customer due diligence. A control the FCA could treat as optional in 2020 is now what an assessor will test.

Assurance stops at onboarding

The FATF is not naive about this. Its Guidance on Digital Identity, published in March 2020, is built on the language of assurance. Assurance levels measure confidence in the reliability and independence of a digital identity system, and regulated entities are expected to understand the levels applying to whatever system they use. The guidance asks identity providers to state those levels plainly. That transparency is designed to reach the firm doing the onboarding. It goes no further.

R16 has no such language. It has one word, and the word is binary. A payment message built to ISO 20022 carries the originator's name, address and identifiers; it records nothing about how those values were established, by whom, or when. A beneficiary institution in another jurisdiction sees identical fields whether the originator was verified against a chip-read passport in a branch or matched to a selfie on a handset with no address check. The message cannot tell them apart.

That institution must decide whether to execute, reject or suspend the transfer, and hold a risk-based rationale for doing so, on data whose provenance is invisible to it. The problem is not a data gap, because the required fields are present. It is a provenance gap. The revised standard leaves it open.

Alignment checks inherit the flaw

The same weakness runs through the standard's headline fraud control. Paragraph 30 of the Interpretive Note gives beneficiary institutions three routes to mitigate the risk of a transfer reaching an unintended recipient. They may check, transaction by transaction, how far the name and account number align with the information they hold; they may monitor accounts, transactions and activity as a whole; or they may use a pre-validation mechanism such as confirmation of payee. All three compare an inbound instruction with the institution's own customer records.

Consider what sits on each side of that comparison. The beneficiary details in the message were supplied by the originator, and the explanatory note is explicit that the ordering institution need not verify them. The record they are matched with came from the beneficiary institution's own onboarding. Alignment therefore tests an unverified assertion against a record whose provenance is itself unexamined. It establishes consistency, not truth.

Yet alignment is the control the FATF is relying on to blunt cross-border fraud. Where a beneficiary account was opened by a synthetic identity, a fraudulent payment aligns perfectly, because both sides describe the same person who does not exist. It is a strong defence against error and misdirection, which is what it was built for. It is a weaker defence against an account that should never have been opened.

The failure travels downstream

The sequencing adds a further tension. In February 2025 the FATF amended paragraph 15 of the Interpretive Note to Recommendation 10, so that non-face-to-face relationships count as potentially higher risk only where appropriate mitigating measures have not been implemented. The change was defensible; remote interaction is standard practice and digital identity technology has reduced some risks. Four months later the same body revised R16 to require verified originator information on cross-border payments. The Standards now assume both that remote verification can be trusted, and that its output is solid enough to travel.

The second assumption is the fragile one. How onboarding controls fail is by now well catalogued, and the FATF's own digital identity guidance names synthetic identities as the greatest risk at identity proofing and enrolment. What happens after they fail is examined far less. An attacker who defeats onboarding need not defeat R16.

The payment data will be accurate in the standard's own terms, because verification has already happened. The transfers will be complete, structured and fully traceable to a customer record that answers to nobody. Transparency will have worked exactly as designed, and it will have illuminated nothing.

eKYC identity regimes are not payment regimes

Two identity frameworks are arriving on either side of the Channel. Part 2 of the Data (Use and Access) Act 2025 came into force on 1 December 2025, putting UK digital verification services on a statutory footing. The Office for Digital Identities and Attributes published version 1.0 of the trust framework in June 2026, to take effect that September. In the European Union, Regulation (EU) 2024/1183 requires member states to make at least one digital identity wallet available by the end of 2026, with the Anti-Money Laundering Regulation applying from 10 July 2027. Neither reaches the payment message.

Both regimes do serious work on assurance. Yet both attach it to the verifier, not to the transaction. A certified provider, a trust mark and a graded wallet credential establish how well an identity was proved; none of it reaches a field a correspondent bank in a third country can read. R16 is expected to be fully implemented by the end of 2030. On present course the identity frameworks will be mature years earlier. They will still be invisible where a payment is screened.

Firms should date their evidence

The practical response is not another verification tool. It is provenance, and the FATF has already sketched what that looks like. Its digital identity guidance observes that records specifying the types of identity evidence used, the data source, and the date, time and means of access could satisfy the record-keeping requirement in Recommendation 11. Written for customer due diligence, it is now a payment transparency requirement in all but name. A verification performed in 2018 under a lighter standard is not equivalent to one performed in 2026. A framework that cannot separate them cannot evidence accuracy to a supervisor.

Three tests follow. Address verification should be measured separately from identity proofing, not folded into a single onboarding pass rate, because only one of them is now a payment field. The reference data behind alignment checks should be treated as controlled data with its own quality standard. And the back book should be dated, because customers verified under superseded methods will carry unexamined originator information across borders for the rest of the decade. That population is already onboarded.

The record begins before the message

Payment transparency has always been described as a property of the message: did the information travel, was it complete, was it structured. The revised R16 quietly relocated the question. What determines whether a payment record means anything is a decision taken years earlier by an onboarding team optimising for conversion, in a channel where the one thing provable beyond doubt is a face. A face is not an address, and an address that was never checked does not become accurate by being carried faithfully along a payment chain. Until the assurance behind a verification travels with its output, R16 will keep producing records that are complete, accurate by definition and quietly unreliable.

Can you show, for a payment your firm sent yesterday, how the originator's address was verified and when?

If the honest answer is that the field was populated rather than proved, we can help you build the trail before an assessor comes looking for it; contact us.

At OpusDatum, our wire transfer regulation work starts at the account, not at the message. We examine whether the originator information a firm transmits traces back to a verification method, a date and an assurance level, and whether that trail would answer a supervisor asking why the data was treated as accurate.