Initial identity verification establishes the first trusted relationship between a person, their identity evidence, and a new account. Reverification occurs later, when a digital platform needs to confirm that the current user still corresponds to that trusted identity.
The technologies may overlap, but the two processes have different objectives, evidence sources, triggers, and risk decisions.
1. What Is Initial Identity Verification?
Initial identity verification takes place during onboarding, before the platform has an established identity profile or account history for the applicant.
A typical workflow may include:
- Capturing an identity document
- Extracting identity fields with OCR
- Checking document quality, validity, and consistency
- Comparing the applicant with the document portrait
- Performing liveness detection
- Screening the customer where required
- Evaluating device, session, and application risk
- Creating a trusted customer profile
NIST describes identity proofing and enrollment as collecting identity evidence and attributes, resolving them to an identity, validating the evidence, and verifying that the applicant owns the claimed identity.
The onboarding decision asks:
Should this person be trusted as the owner of this new account?
2. What Is Identity Reverification?
Identity reverification confirms an existing user’s identity again after onboarding.
The platform already has trusted references, such as:
- An enrolled facial image
- Verified identity attributes
- Previous documents
- Trusted devices
- Authenticator history
- Normal account behavior
- Earlier verification results
Reverification can therefore compare the current user and session against existing evidence rather than creating an identity profile from nothing.
Face++ describes reverification as a risk-based process that may involve face comparison, liveness detection, updated document capture, or broader customer-risk review. It does not always require repeating the entire KYC journey.
3. Initial Verification vs Reverification
| Initial Identity Verification | Identity Reverification |
|---|---|
| Establishes a new identity | Reconfirms an existing identity |
| Uses newly submitted evidence | Uses trusted historical references |
| Usually follows a defined onboarding flow | Triggered by time, events, or risk |
| Creates the customer baseline | Compares activity with the baseline |
| Often includes full document checks | May use only the controls required |
| Determines whether to open an account | Determines whether to continue or step up |
Initial verification is primarily an identity-establishment process. Reverification is an identity-maintenance and account-protection process.
4. What Triggers Reverification?
Reverification can be periodic, event-driven, or risk-driven.
Common triggers include:
- Identity-document expiry
- A scheduled ongoing KYC review
- Login from a new or unusual device
- Changes to a phone number, email, or security settings
- Addition of a new beneficiary
- A high-value or unusual transaction
- Account recovery
- Material changes to customer information
- New fraud, sanctions, PEP, or adverse-media signals
- Face, device, or behavioral inconsistencies
- Extended account inactivity
FATF requires ongoing due diligence and transaction scrutiny throughout the customer relationship. Its recommendations also apply due diligence to existing customers at appropriate times based on materiality and risk.
5. Why Reverification Should Be Risk-Based
Sending every returning customer through full document and biometric verification would create unnecessary friction.
The appropriate response depends on what changed:
- New device: Face verification and liveness may be sufficient.
- Expired document: Capture and validate a renewed document.
- Profile change: Verify the user before updating trusted information.
- Account recovery: Combine identity, device, channel, and history evidence.
- High-risk transaction: Apply step-up verification with transaction context.
- Material KYC change: Refresh identity, ownership, screening, or source information.
A low-risk event may require no visible interruption. A higher-risk event may require multiple controls or manual review.
FATF notes that digital identity can support both onboarding verification and ongoing due diligence, rather than functioning only as a one-time account-opening tool.
6. How Face++ Supports Reverification
Face++ can provide the biometric identity layer within a lifecycle-based workflow.
1:1 Face Comparison
A current facial capture can be compared with the trusted enrollment portrait. This checks whether the person returning to the account resembles the identity established during onboarding.
Liveness Detection
A strong facial match does not prove that the media comes from a genuine live person. Liveness detection helps identify printed photos, screen replays, masks, deepfakes, and manipulated streams.
OCR and Updated Evidence
When a document expires or customer information changes, OCR can extract structured information from refreshed identity evidence for additional validation.
1:N Face Search
Where legally permitted and appropriately governed, face search can help investigate whether the current face is associated with duplicate, restricted, or previously identified accounts.
Face verification and liveness are particularly relevant to account recovery, sensitive profile changes, new-device activation, and high-risk transactions.
7. Reverification Requires More Than Biometrics
A face match should not independently approve a sensitive action.
A mature decision process may combine:
- Historical identity confidence
- Document status
- Face comparison and liveness
- Device reputation
- Session integrity
- Authenticator history
- Behavioral change
- Transaction risk
- Compliance alerts
- Linked-account evidence
The value of reverification comes from comparing new evidence with the trusted customer baseline and the context of the current event.
FATF has noted that ongoing monitoring can help manage risks associated with the continuing trustworthiness of customer identity data, reducing excessive reliance on onboarding evidence alone.
8. Possible Reverification Outcomes
A risk engine may produce several outcomes:
- Continue: Existing confidence remains sufficient.
- Step up: Request face, liveness, or additional evidence.
- Refresh: Capture updated identity or KYC information.
- Review: Escalate inconsistencies to a trained reviewer.
- Restrict: Temporarily limit sensitive account activity.
- Reject: Block confirmed unauthorized or fraudulent activity.
The platform should log the trigger, evidence used, model versions, thresholds, decision, and reviewer actions. This supports auditability and future investigations.
9. Frequently Asked Questions
Q1. Is reverification the same as repeating KYC?
Not necessarily. Identity reverification should use the controls appropriate to the event. Full KYC may be required only when identity evidence or compliance information must be refreshed.
Q2. Can Face++ verify a returning customer without requesting another document?
Yes, when policy and risk permit. Face++ 1:1 face comparison can compare the current user with a trusted enrollment portrait, while liveness detection assesses genuine presence.
Q3. When should a document be requested again?
A refreshed document may be necessary when the original has expired, identity attributes have changed, the existing evidence is inadequate, or the risk event requires stronger assurance.
Q4. Can a successful biometric match override other risk signals?
No. A high face-comparison score should not override failed liveness, suspicious device activity, inconsistent documents, or significant transaction risk.
10. Maintain Identity Confidence After Onboarding
Initial verification establishes identity confidence. Reverification tests whether that confidence still applies to the current person, session, and event.
By combining Face++ face comparison, liveness detection, OCR, and face search with trusted account history and contextual risk signals, digital platforms can protect the customer lifecycle without repeatedly imposing a full onboarding journey on every user.
