8.3 Verification Data Sources and How to Judge Their Reliability
Key Takeaways
FATF Recommendation 10 requires verification using reliable, independent source documents, data or information.
Authoritative government sources, such as passport chip data or official registry checks, generally rank above commercial aggregators and documents the customer uploads.
FATF's 2020 Guidance on Digital Identity advises firms to understand the assurance levels of the digital ID systems they rely on.
Open-source research should record the URL, date and capture of each item so that an investigation can be reviewed later.
CAFCA sub-topic 2.3 asks which data sources can verify customer information, such as online searches, open-source data, private and public third-party data providers and fraud databases, and how to determine their reliability. FATF Recommendation 10 requires verification against reliable, independent source documents, data or information. So the question is never just "did it match?". It is also "how much can we trust what it matched against?"
Categories of source
| Source category | Examples | Strengths | Weaknesses |
|---|---|---|---|
| Government and authoritative | Passport or ID chip data (NFC); national digital ID schemes; official company registries; driver-licence data services; SSA eCBSV in the US | High authority; hard to forge; current | Coverage gaps; outages; some registries accept unverified filings |
| Regulated third parties | Bank account ownership checks through open banking; credit bureau header data; telco records | Independent of the customer; data built over time | Thin files for young people and newcomers; synthetic identities can build bureau files |
| Commercial aggregators | Identity-data vendors, phone and email intelligence, business data providers | Broad coverage; fast APIs | Mixed provenance; stale or recycled data; scores hide how a result was reached |
| Consortium and fraud databases | Shared fraud data schemes run by industry bodies or bank-owned consortiums; negative device or email lists | Reveal known bad actors and reused identity elements | Membership limits; data-sharing rules; risk of false matches |
| Open-source information | Internet searches, news, court records, social media, corporate websites, domain registration data | Context, adverse media, links between people and businesses | Accuracy varies; misinformation; privacy and ethics limits |
| Customer-supplied documents | Utility bills, bank statements, payslips, invoices, articles of incorporation | Useful for proof of address and expected activity | Easy to edit or generate; not independent |
Judging reliability
Apply six tests to every source a procedure relies on:
- Authority and provenance. Who created the data? Was it verified when it was collected? A registry that accepts any filing without checks is less reliable than one that verifies filers.
- Independence. Did the data come from someone other than the customer? A bill the customer uploads is not independent. A bureau record is.
- Accuracy and timeliness. How often is it updated? Address data can be years out of date, and death records may lag.
- Coverage. Who is missing? Thin-file young adults, recent immigrants and newly formed companies often return "no hit". That is not the same as fraud.
- Depth of verification. Does the source confirm that the attributes belong together (name plus date of birth plus ID number)? Or does it merely show that each attribute exists somewhere?
- Tamper resistance and auditability. Can the result be faked, for example by an injected document image? Is there a record of the query and the response?
FATF's 2020 Guidance on Digital Identity adds a useful lens. Know the assurance level of any digital ID system you rely on, both for identity proofing and for authentication. In the US, many firms use the NIST digital identity guidelines (SP 800-63) as a reference for assurance levels.
Combining sources
Because no single source is perfect, robust onboarding layers sources:
- Document plus biometric plus database: a passport chip read and a liveness-checked selfie match, confirmed against an independent data source.
- Two independent sources for key attributes where one source is weak or a no-hit.
- Business verification: registry extract, beneficial ownership information, website and domain checks, licence lookups, and bank account ownership confirmation.
Write explicit rules: which combinations are acceptable for which risk levels, what to do on a no-hit, and when to escalate to manual review.
Using fraud and open-source data properly
- Fraud data identifies reused or known-bad elements, such as a phone number tied to 40 applications or a device seen in mule rings. Use it to step up checks or decline. Respect the data-sharing rules and privacy law that govern the scheme.
- Open-source research must be lawful and ethical. Use no pretexting or fake profiles, and do not access private content. Record what you found, where (URL), when (date and time) and a capture (screenshot or archive), so that a reviewer or law enforcement can follow the reasoning. Prefer primary sources, such as court records, regulator notices and reputable media, over anonymous posts.
Realistic exam scenario
A 22-year-old applicant who recently moved from abroad gets a "no hit" from the credit bureau. The applicant's passport chip reads correctly and passes passive authentication. The selfie matches with a passing liveness check. An open-banking check shows that a bank account in the applicant's name has received salary for two months. The no-hit is explained by a thin file. The other sources are authoritative or independent and consistent, so the identity can be verified under a documented alternative-sources rule. If the applicant had instead uploaded only a utility bill with no chip read, reliability would be much weaker.
Common exam traps
- Treating a vendor's single "pass" score as verification without knowing which sources stand behind it.
- Accepting customer-uploaded documents as independent evidence.
- Treating a bureau no-hit as fraud. It may reflect coverage gaps, so use alternative reliable sources.
- Undocumented open-source findings. If it is not recorded, it cannot support a decision.
Which source is generally the most reliable and independent for verifying an applicant's identity data?
Data read from the passport's chip and validated through passive authentication
A social media profile in the applicant's name with several hundred followers
The applicant's self-declared address as entered on the online application form
A utility bill PDF uploaded by the applicant during onboarding
An applicant returns a 'no hit' at the credit bureau. What is the best interpretation?
It means the applicant must be rejected under FATF Recommendation 10, which bans onboarding without a bureau hit
It confirms the applicant is low risk and needs no further checks
It proves the applicant is a synthetic identity and must be reported
Possibly a thin-file coverage gap, so use alternative reliable sources under a documented rule
What should an investigator record when using open-source information to support a decision?
Nothing, because open-source data cannot lawfully be used in AML investigations
The source URL, the date and time accessed, and a capture of the content
Only the conclusion, to keep the case file short and readable
The customer's signed consent form for the search
Sections you finish are checked off in the contents.