When identity must be verified — the three timings

“Verify before you onboard” is the rule, and Regulation (EU) 2024/1624 provides two structured exits from it. Article 23 sets the default — verification of the customer, the beneficial owner and certain other persons must take place before the establishment of a business relationship or the carrying out of an occasional transaction — and then allows completion during establishment in defined circumstances, plus a narrower account-opening derogation for credit and financial institutions.

1. The default, and where it does not apply

The before-the-relationship rule does not apply to situations of lower risk under the simplified due diligence section, provided that the lower risk justifies postponement. Two conditions, not one: the situation must be lower risk, and the lower risk must justify postponing verification specifically.

The distinction matters because postponement is the exception a modern onboarding funnel is built on, and an exception used at scale has to be justified at the level it is used — per relationship, or per clearly defined low-risk population with the reasoning recorded once and applied consistently.

Article 23(1) also carries a sector-specific timing rule: for real estate agents, verification is carried out after an offer is accepted by the seller or lessor, and in all cases before any funds or property are transferred.

2. Completion during establishment

Article 23(2) permits verification of the customer and the beneficial owner to be completed during the establishment of a business relationship where two conditions hold together:

• it is necessary so as not to interrupt the normal conduct of business; and
• there is little risk of money laundering or terrorist financing.

Where the derogation is used, the procedures must be completed as soon as practicable after initial contact. That is a standard rather than a deadline, which means a firm relying on it should set its own internal limit and be able to show performance against it — because “as soon as practicable” is assessed after the fact, on the facts.

3. The account-opening derogation

Article 23(3) allows a credit institution or financial institution to open an account — including accounts permitting transactions in transferable securities — before verification is complete, subject to the conditions the article sets. This is the provision that makes a modern onboarding funnel possible at all, and the practical consequence is that the control has to move from account creation to account capability.

Building this as an account state machine rather than as a flag is what makes the derogation safe to rely on. A pending-verification flag that no downstream system consults is the standard failure mode, and it typically surfaces the first time an unverified account receives and forwards funds.

4. How it links to the rest of the chapter

Timing sits between two other obligations. Article 22 governs the identification and verification of customers and beneficial owners themselves; Article 21 governs what happens when the entity is unable to comply with the Article 20(1) measures at all — refrain, terminate, and consider reporting. The derogations in Article 23 buy time; they do not change the outcome if verification ultimately fails.

That is the point most often lost in product design. A postponement route without a defined failure path produces accounts that sit unverified indefinitely, because nothing in the process forces the Article 21 decision.

FAQ

Related: When due diligence cannot be completed · Simplified due diligence · EBA remote onboarding guidelines