4.3 Document authenticity & integrity

Where credit and financial institutions accept reproductions of an original document and do not examine the original document, they should take steps to ascertain that the reproduction is reliable. Credit and financial institutions should establish at least the following:

• a) if the reproduction includes security features embedded in the original document and if the specifications of the original document that are being reproduced are valid and acceptable, in particular, type, size of characters and structure of the document, by comparing them with official databases, such as PRADO¹⁵ ;
• b) whether personal data has been altered or otherwise tampered with or, where applicable, whether the picture of the customer embedded in the document was not replaced;
• c) whether the integrity of the algorithm used to generate the unique identification number of the original document, in case the official document has been issued with machine-readable zone (MRZ);
• d) whether the provided reproduction is of sufficient quality and definition so as to ensure that relevant information is unambiguous;
• e) that the provided reproduction has not been displayed on a screen based on a photograph or scan of the original identity document.

¹⁵ https://www.consilium.europa.eu/prado/en/prado-start-page.html

Where credit and financial institutions use features to automatically read information from documents, such as Optical Character Recognition (OCR) algorithms or Machine Readable Zone (MRZ) verifications, they should take the steps necessary to ensure that that these tools capture information in an accurate and consistent manner.

In situations where the device the customers use to prove their identity allows the collection of relevant data, for example because the data is contained in the chip of a national identity card, and it is technically feasible for the credit and financial institutions to access this data, credit and financial institutions should consider using this information to verify its consistency with the information obtained through other sources, such as the submitted data or other documents submitted by the customer.

Where available, during the verification process, credit and financial institutions should verify the security features embedded in the official document, if any, such as holograms, as a proof of their authenticity.

Credit and financial institutions should set out in their policies and procedures how they will adjust their documentation requests for the purposes of financial inclusion. Where weaker or non-traditional forms of documentation are accepted as a result, credit and financial institutions should carry out in addition to measures as set out in paragraph 4.10 of the EBA Risk Factors Guidelines, controls or increased human intervention to satisfy themselves that they understand the ML/TF risk associated with the business relationship.