4.6 ICT and security risk management

Credit and financial institutions should identify and manage their ICT and security risks related to the use of the remote customer onboarding process, including where credit and financial institutions rely on third parties or where the service is outsourced, including to group entities.

In addition to complying with requirements set out in the EBA Guidelines on ICT and security risk management¹⁸ where applicable, credit and financial institutions should use secure communication channels to interact with the customer during the remote customer onboarding process. The remote customer onboarding solution should use secure protocols and cryptographic algorithms according to the industry best practices to safeguard the confidentiality, authenticity, and integrity of the exchanged data, where applicable.

¹⁸ EBA/GL/2019/04

Credit and financial institutions should provide a secure access point for starting the remote customer onboarding process based on qualified certificates for electronic seals as referred to in Article 3(30) of Regulation (EU) No 910/2014 or for website authentication as referred to in Article 3(39) of that Regulation. The customer should also be informed about the applicable security measures that should be taken to ensure a secure use of the system.

Where a multi-purpose device is used to perform the remote customer onboarding process, a secure environment should be used for the execution of the software code on the customer’s side, where applicable. Additional security measures should be implemented to ensure the security and reliance of the software code and the collected data, according to the security risk assessment as laid down in EBA Guidelines on ICT and security risk management.