4.2 Acquisition of information

In addition to the points set out in paragraph 9, credit and financial institutions should set out in their policies and procedures the information needed to identify the customer, the types of documents, data, or information the institution will use to verify the customer’s identity and the manner in which this information will be verified.

Credit and financial institutions should ensure that:

• a) the information obtained through the remote customer onboarding solution is up-to-date and adequate to meet the applicable legal and regulatory standards for initial customer due diligence;
• b) any images, video, sound and data are captured in a readable format and with sufficient quality so that the customer is unambiguously recognisable;
• c) the identification process does not continue if technical shortcomings or unexpected connection interruptions are detected.

Credit or financial institutions should consider the criteria in paragraph 24 to be met where the solution uses one of the following:

• a) electronic identification schemes notified in accordance with Article 9 of Regulation (EU) No 910/2014 and meeting the requirements of assurance levels ‘substantial’ or ‘high’ in accordance with Article 8 of that Regulation;
• b) relevant qualified trust services that meet the requirements of Regulation (EU) No 910/2014, in particular Chapter III, Section 3 and Article 24 (1), subparagraph 2, point
• (b) of that Regulation.

The documents and information collected during the remote identification process, which are required to be retained in accordance with Article 40(1) point (a) of Directive (EU) 2015/849, should be time-stamped and stored securely by the credit and financial institution. The content of stored records, including images, videos, sound and data should be available in a readable format and allow for ex-post verifications.

4.2.2 Identifying natural persons

Credit and financial institutions should determine in their policies, as set out in Section 4.1.1 paragraph 9, the information they need to obtain to identify customers remotely in accordance with Article 13(1) (a) and (c) of Directive (EU) 2015/849. In addition, credit and financial institutions should define what information:

• a) is manually entered by the customer;
• b) is automatically captured from the documentation provided by the customer;
• c) is gathered using other internal or external sources.

Credit and financial institutions should put in place and maintain appropriate mechanisms to ensure that the information they capture automatically in line with paragraph 27 is reliable. They should apply controls to address associated risks, including risks associated with automatic capture of data such as the obfuscation of the location of the customer’s device spoofed Internet Protocol (IP) addresses or services such as Virtual Private Networks (VPNs).

4.2.3 Identifying Legal Entities

Where credit and financial institutions remotely onboard customers that are legal entities, they should define in their policies and procedures, as set out in Section 4.1.1 paragraph 9, which category of legal entities they will onboard remotely, taking into account the level of ML/TF risk associated with each category, and the level of human intervention required to validate the identification information.

Credit and financial institutions should ensure that the remote customer onboarding solution has features to collect:

• a) all relevant data and documentation to identify and verify the legal person
• b) all relevant data and documentation to verify that the natural person acting on behalf of the legal person is legally entitled to act as such;
• c) the information regarding the beneficial owners in accordance with provision 4.12 of the EBA Risk Factors Guidelines¹⁴ .

¹⁴ EBA/GL/2021/02

For the natural person acting on behalf of a legal person, credit and financial institutions should apply the identification process described in the Section 4.2.2.

4.2.4 Nature and purpose of the business relationship

When credit and financial institutions assess and, as appropriate, obtain information on the purpose and intended nature of the business relationship in accordance with Article 13(1) point (c) of Directive (EU) 2015/849, as further specified in Section 4.38 of the EBA Risk Factors Guidelines, they should, for the purposes of these guidelines, have completed the relevant actions before the end of the remote customer onboarding process.