Digital identity verification is leaving businesses exposed to risks that emerge after credentials have been approved, with mobile device changes, account recovery and artificial intelligence agents creating new challenges for organisations relying on electronic identity checks, according to Hopae head of trust Junmin (Eric) Kim.
Hopae head of trust Junmin (Eric) Kim, who contributed to the discussion group behind the Kantara Initiative’s Digital Identity Risk Universe (DIRU), published in May 2026, believes businesses are underestimating the risks that emerge after initial identity verification. He argues that organisations must look beyond onboarding to consider how credentials are managed, updated and recovered throughout their lifecycle.
Changes to a user’s device, updates to credential status and requests for unnecessary personal information can all introduce weaknesses into otherwise functioning identity systems. These issues can expose businesses to security incidents even after an initial verification has been completed successfully.
The DIRU framework identifies 163 digital identity risks, including 98 associated with human digital identities and 65 relating to AI agents. It provides a shared taxonomy covering the different stages of a credential’s lifecycle, from issuance and use to modification, recovery and retirement.
Rather than prescribing specific security controls or risk-scoring methods, the framework gives wallet providers, credential issuers and relying parties a common structure for identifying potential vulnerabilities and assessing their exposure. Discussion group chair John Fiske also publicly acknowledged Kim’s contribution alongside the other participants.
A central concern raised by Kim is that vulnerabilities frequently emerge when different components of an identity system interact. While individual systems may function as intended, weaknesses can develop when information, permissions and responsibilities move between them.
Mobile device migration is one example. When users replace their phones, organisations must establish how their authority to recover digital credentials is verified, what happens to cryptographic keys stored on previous devices and how relying parties are informed when an old credential should no longer be trusted.
Poorly designed recovery processes can leave active credentials accessible on devices that are no longer controlled by their owners. However, overly restrictive procedures can also prevent legitimate users from accessing essential services. Balancing security with accessibility is therefore an important consideration for organisations managing digital identity infrastructure.
The issue is becoming more pressing as European digital identity requirements approach. EU member states must make European Digital Identity (EUDI) Wallets available to citizens by the end of 2026, while obligations affecting many private relying parties are expected to follow in late 2027.
As adoption increases, millions of users are likely to change devices and recover their digital credentials. Businesses will need to ensure their systems can manage these transitions without creating opportunities for unauthorised access or disrupting legitimate users.
Hopae recommends that organisations examine three areas when reviewing their identity risk exposure. The first is understanding precisely what a successful verification result establishes. Businesses should distinguish between an unavailable credential status service and a credential that has been revoked, as treating the two situations identically can undermine security decisions and regulatory reporting.
The second consideration is data minimisation. Organisations should assess whether their identity processes collect more personal information than necessary for a particular transaction. Selective disclosure can reduce the amount of information shared, but its benefits may be lost if complete records are subsequently retained in internal logs, analytics systems or customer support tickets.
Finally, businesses should establish clear responsibility for monitoring changes to identity credentials and acting on emerging risks. This includes determining who is responsible for identifying expired credentials, updating trust information and responding when cryptographic keys are compromised.
AI agents introduce another layer of complexity. With 65 of the 163 risks identified in DIRU relating to artificial intelligence agents, the framework highlights the growing importance of managing digital identities that can act on behalf of individuals.
These agents are increasingly capable of carrying out activities such as booking travel, opening accounts and making purchases using a person’s credentials. Organisations will need to establish how delegated authority is verified, ensure agents operate within permitted boundaries and distinguish between actions performed by individuals and automated systems.
The ability to withdraw permissions quickly will also become important, particularly when an agent’s access has been compromised or its authority is no longer valid. Kim expects delegated authority for AI agents to become one of the defining challenges for digital identity management in the coming years.
For organisations beginning to assess these risks, Hopae recommends starting with a single real-world transaction and mapping its processes against the DIRU framework. Businesses should document each relevant risk alongside the responsible component, control owner, supporting evidence and review date.
This creates an initial risk register that can be expanded as organisations identify additional vulnerabilities and establish accountability for unresolved issues.
As digital identity adoption accelerates across Europe and AI agents become more integrated into everyday transactions, Hopae believes businesses must look beyond initial verification and strengthen how credentials are managed throughout their lifecycle. Ensuring identities remain secure after approval will become increasingly important as digital services and delegated AI activity expand.
Copyright © 2026 FinTech Global
Copyright © 2026 RegTech Analyst
