A conversation on identity verification best practices with ID-Pal at Money20/20

The Paypers sat down with Colum Lyons, Founder and CEO of ID-Pal, at Money20/20 Europe to explore digital identity trends, fraud challenges, regulatory updates, and how ID-Pal helps financial institutions balance UX, efficiency, and compliance.

First, tell us a bit about yourself. What’s your background, and what did you want to be when you were a child?

Probably like every kid, I wanted to be a football star. I was obsessed with football growing up, that was the dream. But eventually, I went the business route and studied finance and economics at university. I ended up spending most of my career in the trading world, first trading stocks and shares for companies, then later as a proprietary trader for myself. After that, I moved into stockbroking, managing funds for high-net-worth clients. And that’s where the idea for ID-Pal started to take shape, from a very real and very frustrating experience.

When did you found ID‑Pal, and what problem were you trying to solve?

We launched ID‑Pal in 2016. The idea came straight from my stockbroking days. Onboarding wealthy clients was painful: collecting and verifying identity documents was slow, manual, and error‑prone. A quick Google search showed no satisfactory solution, so I set out to build one.

I knew where my strengths were and where I needed support, so I started putting a team together. From the beginning, we focused on solving three core issues:

• First, the user experience, which at the time was archaic.
• Second, operational efficiency, businesses were wasting time and resources on manual work.
• And third, compliance, not just ticking boxes, but building a solution that would actually stand up to regulatory scrutiny across multiple jurisdictions.

Many startups pivot along the way. How has your vision evolved over the years?

One thing I’m genuinely proud of is that we never had to pivot. That clarity of purpose has kept us focused. From the start, we’ve been committed to helping highly regulated industries solve identity verification. A lot of people view KYC as just part of AML or as an onboarding formality. But at the core, it’s about something very simple: verifying that a person is who they say they are. That applies whether someone’s opening a bank account, applying for a mortgage, renting a car, or managing a fund. It doesn’t matter if the transaction is small or massive; if it involves a person, their identity needs to be verified. And our job is to make that process as seamless, secure, and compliant as possible.

What’s challenging about verifying an identity? And once you solve that, how do you think about it in terms of user experience, operational efficiency, and compliance?

From a user experience point of view, people expect to be able to verify their identity anytime, anywhere, and without any friction. The challenge is delivering on that: enabling remote verification that’s seamless, fast, and feels effortless.

Another big challenge is the expectation of instant results, especially among younger generations. We live in a world of instant everything. You tap your card, and your coffee’s paid for. That’s why we’ve built real-time verification. A user can capture their ID document, scan their face, and run the biometric checks, and our platform delivers a decision instantly. We call that real-time decision-making. It works 24/7, in any jurisdiction, for any nationality, and in any language.

With this instant verification, do you also handle the fraud management side?

Yes, and that really ties into the third pillar, compliance. If user experience is about instant verification, then fraud detection sits squarely under compliance.

A lot has changed in the last ten years. Operational efficiency has improved dramatically. Back then, people were willing to wait, or they were happy to walk into a bank or an office. Today, that’s no longer acceptable. Everything is remote, and that shift has opened new doors for fraudsters.

Fraudsters now see opportunity in the fact that we no longer verify identities in person. Everything is digital, and that creates risk. People often talk about things like AI, deepfakes, or injection attacks as buzzwords, but in our world, these are very real threats.

At ID-Pal, we’ve built advanced detection for exactly these kinds of fraud. We have deepfake detection, injection attack protection, and everything needed to confirm that someone is physically present and real. Not a video, not a mask, not a manipulated identity. That gives businesses confidence that the person on the other side is genuinely who they claim to be.

What’s really striking is that around 90% of document fraud today is being generated by AI. Years ago, pulling off document fraud required access to underground networks. Now? Anyone with USD 5 or USD 10 can visit a public website and generate a fake ID that looks convincing enough to pass basic remote checks. It’s no longer sophisticated crime rings; it could be a teenager in their bedroom with access to the right tools.

Some say ‘KYC is broken’. But the truth is, KYC isn’t broken - the technology to stop this already exists. The real issue is that many businesses aren’t using it. They’re still relying on outdated systems or some providers even outsource document checks to third-party teams overseas, relying on manual review. But today, it’s nearly impossible for a human to tell if a document was AI-generated. 

On the compliance side, what regulatory updates should banks and financial institutions be aware of?

There are quite a few to keep track of, such as AMLD6, PSD2, the new AI regulations, GDPR, and now eIDAS 2.0. But I think what often happens is that people get bogged down in that complexity. From my conversations with regulators, what they really want is simple: they want to see that you're running your business in a legal and transparent way.

In my view, you could almost set aside the legislation for a moment and just focus on building your business in a way that protects your company, your customer, and the integrity of transactions. If you do that well, then when you go back and map the regulations to your operations, they tend to align naturally.
The problem is that too many people get stuck in the fine print. They’re trying to retroactively fit regulatory requirements onto a business that may not have been structured with compliance in mind from the start. That’s where things become messy.

What else can businesses do to overcome some of the challenges of navigating the financial space?
There are a few layers to this. You’ve got the initial identity verification, but what's become more of a challenge in the last two or three years is reverification. It’s now a major topic in the industry, and something more businesses are trying to solve.

That’s why, at this show, we announced a new product called ID-Pal Once, our reusable identity solution. The idea is simple: once you've verified your identity through our platform, you shouldn’t have to repeat the full process every time you need to verify again.

Since you mentioned verifiable credentials and compliance, is ID-Pal involved in the European digital identity wallet initiative in any way?

There’s a lot happening in this space: you’ve got the European wallet initiative, the UK announcing a digital ID framework earlier this year, and in the US, we’re seeing mobile driver’s licenses (MDLs) being introduced.

But to date, we haven’t seen many heavily regulated financial institutions willing to accept these credentials. The EU wallet isn’t live yet, and the digital driver’s license in the US is mostly being used in less regulated contexts like renting an apartment, working as an Uber driver, not really within the financial services sector yet.

That said, I think that over the next 24 months, as these wallets go live, we will witness a shift in how identity is verified, how quickly it can be done, and, more importantly, how identities are consumed.

Our role at ID-Pal won’t fundamentally change, as we’ll still be the bridge between the consumer and the business. That interaction will still flow through us. But what will change is how we connect with the new digital wallets and digital driver's licenses. We’ll have tighter integrations, more direct links.

At the end of the day, it still comes back to our three core pillars:

• improving user experience,
• boosting operational efficiency, and
• ensuring compliance.

That framework hasn’t changed, and it continues to guide everything we build. Of course, there’s always going to be a cost to implementing new technology, but as long as we keep improving those three areas, we believe we’ll stay at the forefront of the industry.

About author

Colum Lyons is a recognised authority in digital identity and the founder of ID-Pal, the original AI-driven identity verification platform. He serves as Vice-Chair of the UK ADVP, sits on the US Forbes Technology Council, and advises the Irish Government’s Industry Advisory Council. A trusted voice on AI, deepfakes, and fraud, Colum is a regular panellist and moderator at events across the EU and US. His insights feature in major global publications.