4.4 Matching customer identity as part of the verification process

Remote customer onboarding solutions implemented by a credit and financial institutions should, as a minimum, allow for the following, as part of their verification process:

• a) there is a match between the visible information of the natural person and the documentation provided;
• b) where the customer is a legal entity, it is publicly registered, where applicable;
• c) where the customer is a legal entity, the natural person that represents it is entitled to act on its behalf.

Where the remote customer onboarding solution involves the use of biometric data to verify the customer’s identity, credit and financial institutions should make sure that the biometric data is sufficiently unique to be unequivocally linked to a single natural person. Credit and financial institutions should use strong and reliable algorithms to verify the match between the biometric data provided on the submitted identity document and the customer being onboarded. In situations where the solution does not provide the required level of confidence, additional controls should be applied.

In situations where the evidence provided is of insufficient quality resulting in ambiguity or uncertainty so that the performance of remote checks is affected, the individual remote customer onboarding process should be interrupted and restarted or redirected to a face-to-face verification.

Where credit and financial institutions use unattended remote onboarding solutions, in which the customer does not interact with an employee to perform the verification process, they should:

• a) ensure that any photograph(s) or video is taken under adequate lighting conditions and that the required properties are captured with necessary clarity to allow the proper verification of the customer’s identity;
• b) ensure that any photograph(s) or video is taken at the time the customer is performing the verification process;
• c) perform liveness detection verifications, which may include procedures where a specific action from the customer is required to verify that he/she is present in the communication session or which can be based on the analysis of the received data and does not require a specific action by the customer;
• d) use strong and reliable algorithms to verify if the photograph(s) or video taken matches the picture(s) retrieved from the official document(s) belonging to the customer.

Where credit and financial institutions use attended remote customer onboarding solutions in which the customer interacts with an employee to perform the verification process, they should:

• a) ensure that the quality of the image and audio is sufficient to allow the proper verification of the customer’s identity and that reliable technological systems are used;
• b) foresee the participation of an employee that has sufficient knowledge of the applicable AML/CFT regulation and security aspects of remote verification and who is sufficiently trained to anticipate and prevent the intentional or deliberate use of deception techniques related to remote verification, and to detect and react in case of their occurrence;
• c) develop an interview guide defining the subsequent steps of the remote verification process as well as the actions required from the employee. The interview guide should include guidance on observing and identifying psychological factors or other features that might characterise suspicious behaviour during remote verification.

Where possible, credit and financial institutions should use remote customer onboarding solutions that include randomness in the sequence of actions to be performed by the customer for verification purposes to guard against risks such as the use of synthetic identities or coercion. Where possible, credit and financial institutions should also provide random assignments to the employee responsible for the remote verification process to avoid collusion between the customer and the responsible employee.

In addition to the above, and where commensurate with the ML/TF risk associated with the business relationship, credit and financial institutions should use of one or more of the following controls or a similar measure to increase the reliability of the verification process. These controls or measures may include, but are not limited to, the following:

• a) the first payment is drawn on an account in the sole or joint name of the customer with an EEA-regulated credit or financial institution or in a third country that has AML/CFT requirements that are not less robust than those required by Directive (EU) 2015/849;
• b) send a randomly generated passcode to the customer to confirm the presence during the remote verification process. The passcode should be a single-use and time-limited code;
• c) capture biometric data to compare them with data collected through other independent and reliable sources;
• d) telephone contacts with the customer;
• e) direct mailing (both electronic and postal) to the customer.

Credit and financial institutions should consider the criteria in paragraphs 38 to 43 to be met where the solution uses one of the following:

• a) electronic identification schemes notified in accordance with Article 9 of Regulation (EU) No 910/2014 and meeting the requirements of assurance levels ‘substantial’ or ‘high’ in accordance with Article 8 of that Regulation;
• b) relevant qualified trust services that meet the requirements of Regulation (EU) No 910/2014, in particular Chapter III, Section 3 and Article 24 (1), subparagraph 2, point
• (b) of that Regulation.