Remote Identity Verification

Remote identity verification works by collecting evidence of a person's identity, checking that the evidence is genuine, then checking that it belongs to the person who presents it. The person does this on a phone or a computer. Nobody meets them. Methods differ in detail, but most follow the same order.

1. The person states who they are, usually by entering a name with a date of birth or by opening an invitation sent to them.
2. They present evidence. Most often this is a passport or a national identity card, photographed with the phone camera or read from the chip inside the document.
3. The evidence is checked. The system examines the security features, the expiry date and the machine-readable data to decide whether the document is authentic and still valid.
4. The person is tied to the evidence. They capture a live image or a short video of their face, which is compared with the photo in the document. A liveness check tests that a real person is in front of the camera.
5. The result is recorded. The verifier keeps the outcome with the evidence behind it, then issues whatever the check was for: an account, a certificate or a completed client file.

The fourth step separates identity verification from a document check. A genuine passport shows that a person exists. It does not show that the person holding the phone is that person. Some methods use a trained agent on a video call for this step. Others are automated, with a human reviewing the unclear cases. ZealiD's method, for example, uses a trusted device, a liveness selfie and a document scan, and is assessed against ETSI TS 119 461.

That standard comes from the European Telecommunications Standards Institute. It sets requirements for how trust service providers prove the identity of the people they issue certificates to, and it is widely used as the reference for remote methods in the EU.

EU law accepts a remote check for a qualified certificate when the check follows one of three routes named in Article 24(1a) of the eIDAS Regulation. A qualified trust service provider must verify the identity of a person before it issues a qualified certificate to them (Article 24(1)). Since the 2024 amendment, the regulation lists four ways to do that. Three of them need no meeting.

The first is a European Digital Identity Wallet or a notified electronic identification means at assurance level high. The second is the certificate of a qualified electronic signature or seal that the person already holds, provided that certificate was itself issued after one of the other three checks. The third is any other identification method that ensures the identification of the person with a high level of confidence. A conformity assessment body must confirm that it does. The fourth is physical presence, under national law.

A check built on a passport and a face comparison falls under the third route. The provider cannot simply declare its own method good enough. An accredited auditor has to confirm it, and the report goes to the supervisory body. The provider may run the check itself or use a third party. The regulation places the obligation on the provider either way.

The technical detail sits below the regulation. Article 24(1c) required the European Commission to establish, by 21 May 2025, a list of reference standards for the verification of identity, with specifications and procedures where necessary. Whether a method meets them is tested in the provider's conformity assessment.

For a firm that receives a signed document, the point is simple. A qualified signature has an audited identity check behind it, whether that check took place in an office or on a phone.

Yes. The Anti-Money Laundering Regulation, which applies from 10 July 2027, lets a firm verify a customer's identity without meeting them. Article 22(6) gives two means. One is an identity document, passport or equivalent, supported where relevant by information from reliable and independent sources. The other is electronic identification that meets the eIDAS assurance levels substantial or high, together with relevant qualified trust services under that regulation.

The recitals show the intention. Recital 66 says that electronic identification under eIDAS should be taken into account and accepted by obliged entities. It adds that such identification can reduce the risk level to standard or even low where appropriate risk mitigation is in place. Where a customer has no electronic identity of that kind, for example because they live in a third country, verification should take place through relevant qualified trust services.

Distance still counts in the risk assessment. Annex I lists the extent to which a business relationship is conducted on a non-face-to-face basis among the delivery channel variables a firm weighs. So the method matters. A scanned passport sent by email is a non-face-to-face relationship with nothing to offset the risk. A verified electronic identity is one too, with a safeguard the regulation names.

Timing does not change. Identity must be verified before the business relationship is established or the occasional transaction is carried out (Article 23(1)). Banks and other financial institutions also follow the European Banking Authority's guidelines on remote customer onboarding, which describe the policies and controls expected around a remote check.

EU law does not rank a remote check below a meeting. Article 24(1a) of eIDAS lists physical presence beside the remote routes as alternatives. What it demands of a remote method outside the wallet and the notified national schemes is a high level of confidence, confirmed by an independent auditor.

The assurance levels in Article 8(2) express the same idea in degrees. Level low gives a limited degree of confidence in a claimed identity. Level substantial gives a substantial degree, with controls meant to decrease substantially the risk of misuse or alteration of the identity. Level high gives a higher degree still, with controls meant to prevent that misuse.

Each setting has its own weak point. In person, the check depends on whether a member of staff can tell a forged document from a real one. Remotely, the attacks are different. A presentation attack holds a photo, a screen or a mask up to the camera. An injection attack bypasses the camera and feeds prepared images or video straight into the system, with deepfakes as a common payload. Liveness detection answers the first. Controls on the device and on the capture channel answer the second.

A firm that is choosing a remote method can ask three questions. Has an accredited body assessed the method, and against which standard? Does it test for injected video as well as for photos and masks? What evidence does it keep, and can that evidence be produced years later?

Remote identity verification establishes who a person is. Electronic identification reuses an identity that was established earlier. eIDAS defines electronic identification as the process of using person identification data in electronic form that uniquely represents a person (Article 3(1)). That data sits in an electronic identification means, which the person uses to authenticate to a service (Article 3(2)). A national identity card with a chip is one example. A national identity app is another.

Somebody verified the person once, when the means was issued. Every later use relies on that first check. This is why a notified electronic identification means at level high can stand in for a fresh check when a qualified certificate is issued.

The European Digital Identity Wallet extends the idea. It is an electronic identification means that lets a user store and present identity data and attestations, and sign with qualified electronic signatures (Article 3(42)). Each member state must provide at least one wallet within 24 months of the entry into force of the implementing acts (Article 5a(1)). Private services that are required by law or by contract to use strong user authentication, banks among them, will have to accept the wallet when a user asks to use it. Microenterprises and small enterprises are exempt (Article 5f(2)).

Checks based on a document and a face will not disappear. A wallet must itself be issued at assurance level high, which requires an identity check of its own. People who live outside the EU may never hold one.

The GDPR treats the face comparison as the sensitive part of the check. A facial image that is processed by technical means to confirm who someone is counts as biometric data (Article 4(14)). Processing biometric data for the purpose of uniquely identifying a person is prohibited unless one of the exceptions in Article 9(2) applies (Article 9(1)). Explicit consent is one exception. Others depend on Union or member state law.

The image of the document is ordinary personal data, though there is a lot of it in one place. The principles in Article 5(1) apply. The data must be limited to what is necessary for the purpose. It must be kept no longer than necessary. Security must be appropriate to the risk (Article 32), which is high for a file that holds a passport image next to a face.

How long to keep the evidence depends on why the check was made. A firm subject to the Anti-Money Laundering Regulation must keep a copy of the documents and information obtained in customer due diligence, including information obtained through electronic identification means. The period is five years from the end of the business relationship, after which the personal data must be deleted (Article 77(1) and (3)). A firm with no such duty has to justify each item it keeps. Often the result of the check is enough.

When an outside provider runs the check, the firm should know in which role the provider acts. A processor acts on the firm's behalf under a contract that meets Article 28. A provider that carries out the check under legal obligations of its own may be a controller in its own right.