Video Identification

Video identification works as a guided call between a person and a trained agent. The person joins from a phone or a computer with a camera. They need their passport or identity card to hand, a steady connection, enough light. The agent works from a script that the provider has set.

The call follows a fixed order. The agent first confirms that the person agrees to the call being recorded. The person then holds the document up to the camera, tilting it so that holograms or other features that change with the angle become visible. The agent reads the data on the document, takes still images of both sides, then checks them against the details the person entered beforehand. Next the agent compares the face on screen with the photo in the document. They may ask the person to pass a hand in front of their face or across the document, to show that neither is a flat image or an overlay. Many procedures end with a one-time code sent to the person's phone, which the person reads out or types in. The recording is stored with the images as evidence.

The agent makes the decision. They can ask a further question, request a second document or end the call if something looks wrong. Software often supports them, for example by reading the machine-readable lines of a passport, but a human gives the result.

In agent-led video identification a person decides during the call. In automated video identification software decides, from a recording the person makes alone. The second kind is sometimes sold under the same name, which causes confusion. The person films their document, then their face, by following prompts on the screen. Nobody is on the line. Software checks the document, runs liveness detection, then compares the face with the photo. A human reviewer may look at unclear cases afterwards.

The two kinds are often called attended and unattended. The table sets out how they differ in practice.

EU law does not rank one above the other. Each is judged on whether the whole method gives enough confidence for its purpose.

It can be. The eIDAS Regulation does not mention video. Article 24(1a) lists the ways in which a qualified trust service provider may verify identity before it issues a qualified certificate. Three are specific: the European Digital Identity Wallet or a notified electronic identification means at assurance level high, an existing qualified certificate, physical presence. The other is open: any other identification method which ensures the identification of the person with a high level of confidence, where a conformity assessment body confirms that it does. Video identification belongs to that open group.

A provider therefore cannot simply start to offer video calls. Its procedure, the training of its agents, its software, its record-keeping are assessed together. Qualified providers are audited by a conformity assessment body at least every 24 months, with the report sent to the supervisory body (Article 20(1)). Article 24(1c) required the European Commission to establish, by 21 May 2025, a list of reference standards for the verification of identity. Identity proofing by trust service providers also has a technical specification of its own, ETSI TS 119 461, from the European Telecommunications Standards Institute.

The Anti-Money Laundering Regulation does not name video identification, so the answer depends on how its two means of verification are applied. Article 22(6), which applies from 10 July 2027, gives two means of verifying a customer's identity. One is the submission of an identity document, passport or equivalent. The other is the use of electronic identification means at assurance level substantial or high and relevant qualified trust services under eIDAS. The regulation does not say how a document is to be submitted at a distance. A video call is one way firms do it today. Recital 66 shows where the regulation leans. Electronic identification under eIDAS should be accepted by obliged entities. Where a customer has none, verification should take place through relevant qualified trust services.

The detail has so far come from national rules. Several national supervisors have published their own conditions for video identification. These conditions differ from one member state to the next, so a procedure accepted by one supervisor is not automatically accepted by another. A firm should check what its own supervisor has said. Banks and other financial institutions also follow the European Banking Authority's guidelines on remote customer onboarding.

A video call does not turn a remote relationship into a meeting. Annex I lists the extent to which a business relationship is conducted on a non-face-to-face basis among the risk variables a firm weighs. The safeguards around the call are what the firm records in its risk assessment.

Video identification can be attacked through the document, through the video stream or through the person. The document is the oldest route. An agent sees a forged passport as a compressed video image. They cannot touch it, feel the paper or put it under ultraviolet light. Tilting reveals some security features. Others stay hidden.

The stream is the newer route. Virtual camera software works with video call tools as it does with any other app. A face swap running in real time lets an attacker appear as the person in a stolen document. This is an injection attack. The agent can judge only the picture that arrives, so technical checks on the device are needed alongside the agent's eye.

The third route uses a genuine person. A fraudster persuades somebody to complete the call with their own real document, under a pretext such as a job application. Everything in front of the camera is real, so the check passes. The account or the certificate then ends up in the fraudster's hands. Here a live agent has an advantage over an automated process. They can ask the person what they believe the call is for.

The main limits of video identification are practical. An agent must be free at that moment. They must speak a language the person understands. The person may have to wait, then needs a quiet place with a good connection for the length of the call. Some people are uncomfortable on camera with a stranger. People with a hearing or speech impairment may not be able to complete a spoken call at all. Each call takes an agent's time, so cost rises in step with volume.

Consistency is the second limit. Human judgement varies with training, tiredness or workload. Providers answer with scripts, second reviews, sample checks of recordings.

These limits are the reason other methods exist beside it. A person who holds a notified electronic identification means at assurance level high, or a European Digital Identity Wallet, needs no call for a qualified certificate (Article 24(1a)(a)). Automated methods remove the wait, though they bring weak points of their own.

The GDPR treats a recording of a video identification call as personal data, with a great deal in one file: a face, a voice, an identity document, sometimes the room behind the person. The data must be limited to what the purpose needs, kept no longer than necessary and secured in proportion to the risk (Article 5(1) and Article 32). The general rules for identity evidence are set out under remote identity verification. Three points are specific to a recorded call.

The first is whether the call involves biometric data. The definition turns on specific technical processing of a person's characteristics that allows or confirms their unique identification (Article 4(14)). A comparison that an agent makes by eye is not, on the wording of the definition, specific technical processing. A recording that software later analyses can be. Where software compares the two faces, the prohibition in Article 9(1) applies unless an exception such as explicit consent is met.

The second is information. The person must be told at the time the data are obtained, which means before recording starts, what the purposes are (Article 13(1)). They must also be told how long the data will be stored (Article 13(2)).

The third is the recording itself. A firm subject to anti-money laundering law keeps the evidence for the period that law sets. A firm with no such duty has to justify keeping a full recording when the result of the check would do.