After two years, FINMA has already partially revised its circular on video and online identification. The duties in respect of due diligence when onboarding new business relationships through digital channels have thereby been adjusted.

However, the circular was most likely also revised to stay abreast of rapidly evolving technological developments and in consideration of past experience. The structure and topics (video identification, online identification, beneficial ownership, involvement of third parties, technological neutrality) remain largely unchanged. Nevertheless, the following changes are relevant:

Identification documents still have to be authenticated by machine reading and decrypting the information in the machine-readable zone (MRZ). In addition, two selected security features of the identification document (e.g. kinegram) have now also to be considered in the verification process.

The financial intermediary has now to compare the identification document (if not familiar with it) with a reference database with regards to security features, character type/size and layout.

It is no longer necessary to verify the identity of the contracting party by means of a TAN (transaction authentication number) or a similar method. It is assumed that the increased requirements regarding the verification of the identification document (optical security features, database for identification documents) replaced to former TAN verification.

FINMA abolished the requirement to stop the online and video identification process in case of high-risk indicators. In practice, this requirement led to considerable uncertainties in cases where institutions had outsourced the online and video identification process to a third party. Now, the identification process may be continued although high-risk indicators exist. Important to note that the provisions of Art. 18 AMLO-FINMA apply. Accordingly, the business relationship may only be established after having obtained the approval of a superior.

To verify the identity of the contracting party, it was necessary that the contracting party wired money from a domestic bank account (in the name of that contracting party) to the account of the financial intermediary. Now, the contracting party may use any of his/her bank accounts located in a member state of the Financial Action Task Force (FATF), provided that member state complies with certain FATF standards based on the FATF country review.

The explicit requirement that recognised regulatory audit firms have to audit the adherence to the circular (including reporting thereon) was removed from the circular. However, the requirement to audit, depending on the risk assessment and the audit strategy, persists.

The circular entered into force on 1 August 2018. FINMA however provides market participants a transition phase until 1 January 2020 to make the necessary process adjustments. Until then, one can either adhere to the requirements of the overhauled circular or follow the old circular.

• Optical security features have to be checked at the time of the video identification. To this end, institutions need to train staff, amend its processes and controls and ensure that sufficient bandwidth/transmission rate is available for high image resolution during the identification process. The capabilities of last generation smartphones (bandwidth, picture/camera resolution) have obviously a positive impact on the use of technological solutions and processes.
• The comparison of the identification document with a reference database requires appropriate precautions. A reference database for identification documents needs to be either developed by the financial intermediary or procured from a third-party provider. Staff needs to be trained in order to access and work with the database in compliance with the rules.
• Online and video identification does not discharge financial intermediaries from the anti-money laundering obligations. In fact, the revised circular explicitly states that higher risk relationships are subject to respective approvals – idle to say that corresponding due diligence procedures need to be performed as well.
• In case the video and online identification is outsourced, the financial intermediary needs to ensure that processes, controls and trainings are initiated and implemented in good time by the service provider. The amendments to the circular should be discussed with service providers at an early stage, also to timely initiate potential amendments to existing assurance reports with respect to processes and controls at the service provider (e.g. ISAE 3000).