The standard solution for local online-only fintech services would involve piggybacking off of the existing secure electronic ID i.e. digitally signing the agreements (and the request for credential change) with the electronic signature key on your gov't ID chipcard.
I mean, no matter what you do, you have to have some root of trust / root of identity, and it needs to be backed by (and verified in) the physical world - so you either have to do it yourself or delegate it to someone whom you'd trust a lot (i.e. not a random email provider). If a trustworthy universal government ID is available (which is a problem in some places, like USA) then that is a natural solution to that.
Alternatively, an institution is free to trust people remotely, putting effort into fraud monitoring, and taking on whatever risk their trust and processes enable - e.g. we've had some financial institutions verifying passports over videochat in such cases; I have no strong opinion on how safe or risky that is, but presumably the institution has considered the risks very carefully and found them both acceptable and necessary (in that case, sending a scan/photo/picture of the same document was not allowed, it was specifically about live videochat) - which is the key part of the whole thing, the alignment of incentives and responsibility for that risk.
If the consequences of these security risks fall on the users, then the users have to worry about security while financial institutions just wiggle their ears and blame "identity theft". If the consequences fall on the institutions, then the users can stop worrying about the things they mostly can't influence, and the institutions magically design their processes and workflows carefully so that they actually prevent fraud (since it's their own money at stake) and they're forced to implement decent solutions to any tradeoff between usability and security, since their profits depend on both.