Regula has published its 2027 identity verification outlook, setting out ten changes businesses should prepare for across the customer journey.
The report Identity Verification Trends and Predictions 2027 covers changing attack methods, new buyer expectations of verification providers, and emerging approaches to checking the authority of AI agents and explaining identity decisions. Its main argument is that identity assurance should be assessed throughout the customer lifecycle, not only through a single check at onboarding. The forecasts draw on Regula’s technical expertise and its global research conducted in 2026.
Attack surfaces extend beyond onboarding
According to Regula, the integration documentation that helps developers connect a service can also show attackers where to probe it, and AI may speed up that analysis. The company cites the PHP2Shell research, which showed how AI can help turn complex software flaws into working exploits. Regula expects similar capabilities to be used to study how identity systems handle failed checks, retries, and recovery.
This links to a second forecast about how buyers evaluate providers. Attackers do not need to defeat every control. One route that avoids a required safeguard is enough, such as a weaker recovery flow, an exception, or a step that can be skipped. Regula therefore expects businesses to scrutinise the full verification process and to ask for evidence that onboarding, retries, exceptions, and recovery each enforce appropriate controls. Strong individual components remain necessary, but testing must also confirm that the way they are integrated leaves no unprotected path to the same outcome.
Agent permissions and delegated authority
The outlook notes that verifying a customer does not establish what that customer’s AI agent is permitted to do. Reports of banks in the US blocking third-party AI agents show that controlling agent access is already a practical issue. The problem grows when a task passes between services, because the receiving service needs evidence of the customer’s permission that it can check independently.
Regula illustrates this with a customer who authorises an agent to book a flight for up to USD 1,000, and the travel platform hands the payment step to a separate agent. The payment provider must confirm the customer’s approval, the spending limit, and whether the second agent’s entitlement to act. If the price climbs up to USD 1,200, the original permission no longer applies, and new customer approval is required. Regula predicts growing demand for permission records that receiving platforms can validate, showing who authorised an action, what limits apply, and whether the approval remains valid after a handoff.
Auditability and reverification
Regula’s research found that 82% of organisations surveyed had faced an external request to justify an identity-related decision. In response to a different question, 50% said they could rebuild a verification decision. The company expects greater demand for records that connect evidence, checks, and decision rules, so that teams can explain an earlier result even after a workflow has changed.
Ihar Kliashchou, Chief Technology Officer at Regula, noted that a customer who passes onboarding may return months later through account recovery, customer support, or an AI agent, pointing out that at that stage, the business must understand what the original check established and whether that evidence is still sufficient.
Regula also expects businesses to define more accurately which events trigger which kind of proof. A lost device or a request for a sensitive account change may call for different responses. In some cases, confirming control of a password or security key may be enough, while others may require a new identity check. The aim is to link new checks to existing identity records without making returning customers repeat full onboarding.
The research also examines what a match in an official database proves, how age verification will change digital products, and whether data rules could determine where identity verification happens. Regula’s report ends with five questions for businesses to ask verification providers, covering workflow security, reverification, auditability, data control, and adaptability to new requirements.
