Verification vs. Decisioning: Balancing Automation and Control

In July 2025, the UK’s Financial Conduct Authority fined Monzo £21.1 million for failings in its financial crime controls: customers had been able to open accounts using implausible addresses, including Buckingham Palace and 10 Downing Street. 

Monzo was comparing applicants’ selfie videos with photo ID, but passing a separate address check was not required for onboarding during much of the period examined. Identity checks provide findings about an applicant, while the surrounding rules determine whether the evidence is sufficient, whether further checks are needed, and whether the application can proceed.

In this article, we will explore where verification ends and decisioning begins, how automated workflows and human review work together, and which metrics help assess their results.

Verification checks the evidence supporting a person’s identity. 

Decisioning uses the findings from verification to choose what happens next.

In document-plus-selfie onboarding, identity verification assesses the document’s authenticity and validity and whether the applicant is its genuine holder. It returns the extracted identity details and the results of each check, including any failures or inconclusive findings.

Sanctions screening and checks for politically exposed persons (PEPs) may also run alongside identity verification as part of the business’s wider customer due diligence and anti-money laundering (AML) controls.

Workflow rules use those findings to choose the next step: poor image quality may prompt another capture, while a mismatch may lead to further checks or human review.

These rules also define when the verification requirements have been met and the application can move on.

A business (e.g., a bank) uses the findings alongside its other requirements to decide whether to approve the customer and allow a certain action (e.g., open an account). It's worth noting that a customer may pass identity verification but still fail to meet the account’s residency requirements, for instance; so the verification result and account-opening decision can differ.

The workflow below shows how checks and decisions fit together once a business has defined its evidence requirements and acceptance rules.

Straightforward applications can often be handled automatically because the evidence is clear and the business has already defined the response.

Human review is more fitting when someone can investigate a mismatch, gather more information, or approve an exception allowed by the policy.

Automation applies the rules it’s given consistently, so a poorly chosen document requirement or threshold can affect every application it touches. Testing changes against cases that reflect the business’s customers helps show their likely effect before the rules go live.

The response can also reflect what’s at stake and how easily an error can be corrected. A payment that would be difficult to recover may justify stronger verification, a temporary hold, or a second approval. Manual review can also be slow or inconsistent, so it benefits from the same monitoring as automated decisions.

People can control an automated process by defining its rules and thresholds, approving changes, and deciding how exceptions are handled. This often helps to reduce repetitive work, while there is still total control over who gets accepted and who is responsible for each decision.

A record of the evidence, relevant external data, and the versions of rules or models used helps explain why a case received a particular outcome. It also makes it easier to investigate changes in results after a threshold or screening source is updated.

Important process controls include:

• Clear permissions for changing rules, thresholds, and accepted evidence

• Required checks that must be completed or handled through an approved alternative before a case proceeds

• Clear responsibility for review and escalation, including who can approve exceptions

• A history of policy changes, reviewer actions, and reasons for overrides

These controls help keep required steps in place when several systems and people contribute to a case. An application can remain on hold until an investigation is complete, with the reason recorded when an alert is cleared.

The rules also need to account for checks that use the same source data, because their findings may overlap. In that case, another passing result may add little new evidence.

Conflicting information, signs of fraud, or unresolved screening alerts may need investigation. Case management brings the evidence together and helps people keep track of who handles the case and what happens next.

Different review arrangements serve different purposes:

• Case ownership gives someone responsibility for investigating the issue, requesting evidence, and resolving the case or passing it to an authorized colleague

• Maker/checker, or the four-eyes approach, requires a second authorized person to independently review and approve a specified action, such as a policy exception or a sensitive rule change

• Reconsideration allows a reviewer to assess new evidence or a challenge to an earlier decision

Keeping a record of the evidence and reasoning helps the next reviewer understand what happened, including why a decision was upheld or changed.

For example, Regula IDV Platform connects automated verification workflows with case management. Reviewers can access document and biometric check results, related sessions, and fraud indicators together, helping them investigate the issue and choose the next step. Meanwhile, actions and their reasons are recorded for later review.

And while established organizations may already have workflows in place, growing businesses may need help defining them. That’s why Regula’s Professional Services team can also help document the process, configure the workflow, and support launch, followed by an agreed period of closer support called hypercare. 

Product and project managers can work with operations, compliance, and engineering on the setup, even without a dedicated fraud team. The business defines who handles each outcome and how verification findings feed into its acceptance decisions.

Note: The following examples illustrate policy choices. The exact requirements depend on the product, jurisdiction, and level of risk the business accepts.

A bank can use identity findings alongside screening results and the requirements for the selected account. That allows different routes through the same workflow:

• Automatic progression when the required checks are complete, acceptance rules are met, and relevant screening concerns are resolved

• Case review when a possible watchlist match or conflicting information needs investigation

Those identity findings can also be useful if the customer applies for another product, with further checks where needed to keep the information current.

When someone recovers an account and then changes where payouts are sent, the marketplace may need to check who controls the account.

Depending on the policy, the response can include:

• Holding the requested change while fresh verification is completed

• Looking at how the account was recovered, the new payout destination, and relevant account activity alongside the identity findings

• Allowing the change when the policy conditions are satisfied, or referring unresolved concerns to an authorized reviewer

Face matching with Regula Face SDK, for example, could help check whether the person matches the account holder’s reference image. And the wider process will then determine whether the payout change can go ahead, given how the account was recovered and what has happened since.

Verification metrics show how reliably the system checks identity evidence.

To assess decisioning, the business also needs to know whether approved applications turn out to be fraudulent and whether eligible people are turned away.

Lastly, completion and review metrics help connect the two by showing where customers struggle or cases slow down.

All these metrics are interconnected in a way that it's nearly impossible to have each one at its perfect value. When the priority is to improve one set of metrics, another can often suffer; so it's important to balance them well. For example, a stricter face-match threshold may reduce false matches, but at the same time it may cause more genuine customers to fail the check and drop off.

A proof of concept can test these trade-offs using the documents, devices, and capture conditions the business expects to encounter. Recording which checks and test data produced each error rate makes the results easier to interpret.

Monitoring continues after a decision, since fraud may become apparent only after approval. Looking into those cases helps separate identity-check failures from problems in acceptance rules or other controls. Complaints and reviews of declined applications can also reveal eligible customers who were turned away.

Reliable checks and clear rules make it easier to automate routine cases and identify those that need more attention. The aim is to automate where the evidence and policy support a clear response, with further checks or human review where they can help resolve uncertainty. Monitoring the results then helps the business adjust both its verification settings and its acceptance rules over time.

Regula IDV Platform brings identity checks, configurable workflows, risk-based rules, and case management together. Workflows can trigger additional checks and automatically create cases for human investigation. Persistent identity profiles and audit trails keep the findings and review history connected across verification sessions.

With on-premises and cloud deployment options, plus integration with existing business systems and third-party services, Regula supports these processes within the organization’s established acceptance procedures.

Talk to the Regula team about configuring verification workflows around your business’s checks, review procedures, and acceptance rules.