If you work in financial services, you've probably been hearing a lot about eIDAS: the EU regulation that makes it possible for citizens, businesses and public-sector entities to perform secure, cross-border digital transactions. At its core, eIDAS allows you to validate your identity online in a way that’s recognised across all 27 EU member states. 

In order to do this, eIDAS introduced levels of assurance (LoAs). This is a tiered standard that explains how reliable a given identity credential is, and how much trust institutions can place in it. With eIDAS 2.0 now in force and the EUDI Wallet rolling out across Europe, understanding these levels is becoming a compliance requirement. 

In this article, we'll break down what the three levels of assurance actually mean, how they impact your AML obligations, and what they should mean for how you think about onboarding in 2027 and beyond. 

What is a level of assurance in eIDAS? 

A level of assurance (LoA) in eIDAS is a confidence rating for a given credential. (Multi-Factor Authentication) Simply put, it’s a measurement of how certain you can be that the person presenting a digital identity credential is actually who they say they are. Defined in Article 8 of the eIDAS Regulation, it is determined by three factors: how rigorously the person’s identity was verified during sign-up, how securely their credentials are managed, and how strong the authentication process is. 

Before we move on to discuss how the levels of assurance work, it’s worth taking a moment to explain what a digital identity credential is. These are any type of proof of identity, including physical documents, digital tokens, login credentials, or biometrics. 

• Passports  

• eID 

• Smart cards 

• An app or certificate stored on your mobile device 

• PINs or passwords 

• Fingerprints or facial scans 

The higher the assurance level, the more rigorous the standard applied to each of these credential types. And, as we'll see, that distinction matters for AML compliance. 

The three levels: low, substantial, and high 

eIDAS defines three official levels of assurance, laid out in the following table: 

Now, let’s look at the three levels individually. 

Low 

The lowest eIDAS-approved tier provides the most basic degree of confidence. Verification is minimal, such as email confirmation or an OTP sent to a phone number. Employing a low-assurance level technology may be appropriate for non-sensitive services where the impact of misidentifying someone is negligible. For financial services institutions, however, a low LoA doesn't meet the criteria necessary to keep institutions (or their customers) safe.  

Substantial 

“Substantial” indicates that adequate safeguards are in place to reduce the risk of tampering or spoofing. In practice, this means employing one or more of the following: 

• Verification of a government-issued identity document (passport, national ID) 

• A biometric check, typically a selfie with liveness detection to confirm the person is physically present 

• Multi-factor authentication 

It’s worth noting that this is the level that most KYC processes today aim for. In Fourthline's standard IDV flow, for example, a substantial LoA is achieved through optical and/or NFC-based document verification, combined with biometric verification (guided selfie + active liveness detection), facial recognition against the document portrait, and AI/ML-based liveness checks to detect presentation and injection attacks. 

High 

High LoA is by far the most stringent tier. It goes beyond the “substantial” level by requiring that the authentication mechanism itself is cryptographically tied to the individual and resistant to being compromised. In practice, this means using: 

• NFC chip reading of the document (passive, active, and chip authentication) 

• Cryptographic verification of the document's authenticity 

• Stricter thresholds and, in many cases, mandatory human review 

This is the level required for Qualified Electronic Signatures (QES) and for Enhanced Due Diligence (EDD) scenarios. It is also the level at which the German eID is formally notified under eIDAS.  

How levels of assurance are assessed 

As we noted above, in order to assign a level of assurance a means of identification, three basic "elements" need to be evaluated. 

Enrolment: This refers to how rigorously a user’s identity was verified when the ID was issued. For example, did the user need to present a biometric passport to the authorities, or did they just need to submit a paper ID? 

Credential management: Another factor is how securely the credential is managed. Passwords used to access a service with the credential (such as logging on to a website) are not as secure as a physical token or some other more secure means.  

Authentication: Finally, assessment depends on how robust the authentication process is; or, to be exact, how do they confirm they are the owner of the credential. 

Here's where things get tricky: the overall level assigned is determined by the weakest of these elements.  

Let's say that a user needs to verify their identity in person at a government office by presenting a biometric passport. This is, on its face, a strong enrolment process. However, if each time they return to use the credential (by logging onto a bank account, for example), they only need to enter a username and password. This means that the authentication step is weaker than the enrolment one, and so the level of assurance can’t be issued as “high.”  

In terms of who actually issues the levels of assurance, it’s a two-stage process. First, an independent, accredited Conformity Assessment Body audits the identity scheme against the requirements set out in Commission Implementing Regulation (EU) 2015/1502. Then, a national supervisory authority reviews that assessment and makes the final certification decision.  

Once certified, the scheme is notified to the European Commission and recognised across all EU member states at its assigned level. 

Why all of this matters for AML compliance 

Understanding LoA levels is one thing. Perhaps more important is what they mean for your business, especially with AMLR coming into effect on July 10, 2027.  

Article 22(6) of the regulation requires obliged entities that verify customer identity remotely to use either government-issued documents or an eID that meets eIDAS requirements. Here’s the thing: low assurance is off the table for AML-compliant onboarding. The minimum for standard Customer Due Diligence is substantial. For Enhanced Due Diligence (high-risk customers, large transactions, PEPs), the level is set to “high.” 

The Anti-Money Laundering Authority (AMLA) is currently drafting their regulatory technical standards (RTS), which will tighten this further. Though still in progress, the draft of article 28(1) states that remote identification will need to rely on notified national eIDs, Qualified Electronic Signatures, or the EUDI Wallet — all at substantial or high assurance levels. 

For financial institutions, this means it’s now essential to evaluate which identity methods your current stack accepts, and at which assurance level. And LoA doesn't stop at identity verification. It also determines which electronic signatures are legally valid. This is a connection that has direct implications for how contracts, consent, and onboarding documents are executed in a compliant way. 

The LoA–signature connection: Low, Substantial, High applied to QES 

LoA doesn't only govern identity verification. It also underpins electronic signature levels: 

Under AMLR Article 22(6)(b), QES is one of the three explicitly recognised methods for compliant remote customer identification. 

To issue a QES, the identity of the signer must first be verified at high LoA. This is why QES-based onboarding (the dominant compliance model in markets like Germany, France, and Austria) inherently requires a High-assurance IDV process. 

To learn more about how QES is transforming customer onboarding, read our guide here.  

What LoA means for your organisation 

The scenarios below translate the LoA framework into practical terms. Whether you're opening a standard account, onboarding a high-risk customer, or issuing a Qualified Electronic Signature, the table below sets out the minimum assurance level your process needs to meet: 

Get compliant with Fourthline 

As AMLR raises the bar on identity verification across the EU, Fourthline is built to meet it. Certified at ETSI TS 119 461 level “high," Fourthline's platform is designed for institutions that can't afford gaps between their identity stack and their compliance obligations. With QES operational today, German eID live, and EUDI Wallet orchestration on its way, Fourthline's roadmap is aligned with all three permitted methods under AMLR. Get in touch to learn more.