When may a firm verify a customer’s identity after onboarding?

Customer due diligence is normally a gate, not a back-office task to postpone indefinitely. The SFC’s AML/CFT Guideline describes a narrow exception for delayed verification during the establishment of a business relationship. The exception is designed for situations where completing every check first would interrupt normal business, while the firm can still manage the risk during the short delay.

The default: verify before or during setup

A licensed corporation should verify the identity of the customer and any beneficial owner before or during establishment of the relationship. For occasional customers, the relevant checks are tied to the transaction. The firm also identifies and takes reasonable measures to verify beneficial owners, understands the purpose and intended nature of the relationship, and keeps the required records. A salesperson’s familiarity with a client is not a substitute for the required evidence.

The exception has three safeguards

1. The delay is essential so that normal business is not interrupted; convenience or workload alone is not the test.
2. The firm has effective systems and controls to manage the money-laundering and terrorist-financing risk during the delay.
3. Identity verification is completed as soon as reasonably practicable after the relationship is established.

The guideline gives practical context: the customer may be present in person, and the firm may need to allow a transaction to proceed without undue delay. The exception does not erase the verification obligation. A firm should document why the exception applied, what interim safeguards were used, who owns the follow-up, and when the verification was completed.

What if verification cannot be completed?

If the firm cannot complete the required customer due diligence, it should not simply leave the account open as normal. The AML/CFT Guideline describes restrictions on carrying out transactions and requires the institution to consider whether to terminate the relationship and whether a suspicious transaction report is warranted. The exact response depends on the circumstances and the applicable rules; escalation to compliance is essential.

Exam distinction

The test is not “verify later whenever the firm chooses.” Remember the sequence: verification is the norm before or during setup; delayed verification is exceptional; risk controls must operate during the gap; completion must follow promptly. If those conditions are missing, the exception is unavailable.

Key takeaway

Treat delayed verification as a controlled, documented exception with a short endpoint. It is not permission to defer customer identification indefinitely or to proceed without managing the interim risk.

The narrow exception

The AML/CFT framework generally requires customer identification and verification before establishing a business relationship or carrying out an occasional transaction. Delayed verification is a limited exception where the conditions in the applicable requirements are met; it is not a routine convenience for busy onboarding. The institution must be able to show why completing verification before the relationship began was necessary to avoid interrupting normal business, while the risk of money laundering or terrorist financing is effectively managed. The exception cannot be used to proceed where suspicion or unacceptable risk makes onboarding inappropriate.

Controls while verification is pending

A firm relying on delayed completion should have risk-based procedures that cap the delay, identify who may approve it and specify what transactions or access are restricted in the interim. The customer must be subject to monitoring from the outset. Staff should escalate inconsistencies, inability to complete the checks, unusual transaction patterns and any suspicion to the MLRO. If verification is not completed within the firm’s permitted timeframe, the relationship or transaction should be restricted or ended under the applicable procedure, and consideration given to reporting obligations.

Example and decision steps

Imagine a business customer must place a time-sensitive order while an authorized representative’s identity document is being retrieved. The firm should not simply switch on full access. It should first determine whether the legal conditions for delayed completion are met, assess the customer and transaction risk, obtain documented approval, apply proportionate restrictions and monitor activity. It should then complete and record verification promptly. If the identity information cannot be validated or the facts become suspicious, the exception no longer justifies continuing as normal; the firm must take the steps required by law and its controls.

Exam distinctions

Delayed verification concerns timing of verification, not whether identification is required. It does not waive beneficial-owner identification, ongoing monitoring, record keeping or suspicious-transaction duties. A risk-based approach can determine the intensity of checks but cannot be used to ignore a mandatory legal requirement. Be careful not to import the narrow exception into every customer relationship or to suggest that a customer’s urgency overrides controls. The answer should mention the conditions, effective risk management, prompt completion, monitoring and action if verification fails.

Implementation and review

The firm should record the reason the exception was used, the risk assessment, restrictions imposed, approval, outstanding documents, due date and completion evidence. This creates an auditable link between the legal condition and the actual onboarding decision. Staff incentives should not reward opening accounts before checks are complete without regard to risk. If an account is restricted or exited because verification fails, the customer communication should be accurate and should not reveal a suspicious transaction report or confidential regulatory contact. Escalation should follow the firm’s AML procedures and applicable secrecy rules.

A practical review checklist

A useful review question is: if the customer’s identity cannot be verified tomorrow, can the firm stop meaningful activity without losing control of funds or assets? If not, its interim controls may not effectively manage risk. The firm should tailor limits to the customer, product, channel and transaction, and ensure front-line staff can recognize the expiry of an exception. Repeated use of delayed verification for the same business line may indicate that ordinary onboarding is poorly designed rather than that many cases independently qualify.