Online signups work when risk is low to the point of being non-existent. Regulators aren't worried about students buying Ramen noodles.
Online signups don't work when there are credible risks of malfeasance. When you're a merchant making more than X in revenue, vetting becomes necessary. If banks can do this, then so can Amazon.
If a bank were to say "we're trying our best but people are still heavily abusing our online signup", then I'm all but certain that the regulatory response would be "too bad, then you can no longer offer online signup".