Tiered verification exists because the alternative is worse in both directions. Apply the heaviest checks to everybody and you lose most of the clients who were never a risk. Apply the lightest checks to everybody and you eventually onboard someone whose money has a history, and then you explain that to a supervisor.
The risk-based approach written into European and most other modern AML frameworks tells firms to match the depth of due diligence to the assessed risk of the relationship. What clients experience as levels is that principle turned into a product.
The three regulatory tiers
Simplified due diligence applies where risk is demonstrably low, which in retail trading is rare. It reduces the evidence required, and it must be justified by a documented assessment rather than assumed because the client seems ordinary.
Standard customer due diligence is the baseline: identify the client, verify identity from reliable independent sources, understand the purpose of the relationship, and monitor it over time. For a retail trading account this is an identity document, a liveness check, address evidence and a set of profile questions.
Enhanced due diligence adds depth. More evidence, more senior sign-off, and questions about where the money originates. It is mandatory in defined circumstances and discretionary whenever the firm's own assessment puts the relationship above its normal risk band. The framework behind all three is set out in the EU AML rulebook and its equivalents elsewhere.
A point worth stating plainly: the tiers describe evidence, not trust. A client asked for a bank statement has not been accused of anything. The firm has been told by its own procedure that a particular combination of facts requires a particular depth of file, and the agent handling the case has no discretion to skip it.
How that becomes account levels
| Level | Evidence collected | What it permits |
|---|---|---|
| Registered | Email and phone confirmed | Demo access, platform tour |
| Identity verified | Government ID plus liveness selfie | Funding and trading, often capped |
| Fully verified | Address evidence, profile questions | Full deposits and withdrawals |
| Enhanced | Source of funds or wealth, sign-off | Large balances, higher-risk profiles |
The identity step is largely automated now. Document capture reads the machine-readable zone or the passport chip, a liveness check confirms a live person rather than a photograph of a photograph, and the result is scored in seconds. Address evidence is slower because it is usually a document a human has to look at, typically a utility bill or bank statement recent enough to be meaningful.
Address matters more than clients expect. It decides which group entity can serve them, which leverage caps apply and whether the firm is permitted to offer the product at all. A client with a passport from one country and residence in another is not suspicious, but they are a classification decision that has to be made deliberately.
Corporate onboarding sits on a separate track with the same logic. Instead of one person, the firm has to establish the legal entity, its ownership chain up to the natural persons who control it, and the authority of whoever is signing. That takes days rather than minutes, and it is the reason a business account and a retail account should never share one onboarding flow.
What pushes an account up a tier
Some triggers are set by rule. Politically exposed persons and their close associates require enhanced measures. Residence or funding connected to a jurisdiction flagged as higher risk does too. A confirmed screening hit changes the file's status immediately.
Others come from behaviour. A client who declared a modest income and then funds a six-figure balance in a week has produced a mismatch between the stated profile and the observed activity, and the profile has to be re-established. Deposits from an account in a different name, rapid deposit and withdrawal with little trading in between, or a sudden change in the funding country all raise the same question. Those are the moments a source of funds request is supposed to appear.
The worst possible design is letting a client deposit, trade for two months and then discover at withdrawal that documents are required. It generates complaints, it looks like a stalling tactic even when it is not, and in several jurisdictions it is itself a conduct failure. Ask early or state the requirement plainly at deposit.
Where onboarding actually breaks
Drop-off in verification is rarely caused by the rules. It is caused by the implementation. Uploading from a desktop when the document is a photograph on a phone. A rejection message that says "document unclear" without saying which document or what was unclear. A four-day wait with no status visible in the client portal. Requesting the same file twice because the first attempt landed in a support mailbox rather than on the client record.
Fixing those is a systems exercise rather than a compliance one. The verification result, the screening hits, the risk rating and the documents should sit on one client record where an agent can see the whole picture, which is the argument for running a verification provider integrated into the back office rather than as a separate portal someone logs into. Firms that get this right measure time-to-verified in minutes and know exactly which step loses people.
Verification is not a one-time event
Files go stale. Documents expire, people move, and a client whose risk rating was set at signup may look different two years later. Periodic review is an obligation in most frameworks, with the frequency driven by the risk rating: higher-risk relationships reviewed more often, standard ones on a longer cycle.
Ongoing monitoring runs alongside it. The point is not to re-collect a passport every year, it is to notice when activity stops matching the file. A firm that can show a supervisor when each review happened, what changed and who approved it is in a very different position from one that produces a folder of documents dated at account opening and nothing since. The same evidence discipline applies to corporate clients, where business verification adds ownership structure and control persons to the file.
"Clients do not resent the documents. They resent not knowing which document, why it was rejected, or how long they are waiting. Say those three things clearly and most of your verification complaints disappear."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- Levels are the risk-based approach turned into product: evidence depth follows assessed risk, not client preference.
- Address evidence decides entity, leverage caps and eligibility, which is why identity documents alone are not enough.
- Profile mismatches, third-party funding and PEP or sanctions hits are what move an account to enhanced due diligence.
- Most verification drop-off comes from unclear rejection messages and invisible status, not from the requirements themselves.
Frequently Asked Questions
Why does a broker ask for proof of address as well as ID?
Identity documents prove who you are. Address evidence establishes where you are resident, which decides which rulebook applies to your account, which entity can serve you and what leverage you are allowed. Both answers are needed before the firm can classify you correctly.
What triggers enhanced due diligence?
Common triggers are politically exposed person status, residence in a jurisdiction flagged as higher risk, unusually large or complex funding, a mismatch between the stated profile and the actual activity, and any negative media or sanctions screening hit that survives review.
Can I trade before verification is complete?
Policies differ by firm and licence. Some allow limited activity while checks run, many require verification before the first deposit, and almost all block withdrawals until the file is complete. Check the funding and withdrawal terms before depositing rather than after.