Biometric verification
Also called biometric authentication, facial verification
Biometric verification confirms a person's identity by comparing a physical trait, such as a face, fingerprint or voice, with a trusted reference. In financial services it most often matches a live selfie to the photo on an identity document. It is a one-to-one check: it confirms that a person is who they claim to be.
How it works
At onboarding, the customer takes a selfie or short video. The system converts the face into a mathematical template and compares it with the document photo, producing a match score. A liveness check confirms a real person is present rather than a photo, mask or deepfake. Firms set a match threshold and send borderline cases to manual review. The same template can later authenticate log-ins or payments.
Biometric data is tightly regulated. Under the EU and UK GDPR, biometric data used to uniquely identify a person is special category data and needs a specific legal condition. In the US, state laws such as Illinois' Biometric Information Privacy Act require notice and written consent. Firms also test match accuracy across demographic groups to manage bias.
The rules
Treats biometric data used to uniquely identify a person as special category data, allowed only under a listed condition such as explicit consent.
Organisations processing personal data of people in the EUExplains how reliable, independent digital identity systems can support customer identification and verification under FATF Recommendation 10, using assurance levels.
Regulated entities and supervisors in FATF member jurisdictionsRequires written notice, written consent, a public retention and destruction policy, and bans selling or profiting from biometric identifiers.
Private entities collecting biometric identifiers of Illinois residentsCommon questions
What is the difference between biometric verification and identification?
Verification is one-to-one: it checks whether a person matches one claimed identity. Identification is one-to-many: it searches a database to find who a person is. Most KYC processes use verification.
Is biometric verification high-risk under the EU AI Act?
The EU AI Act excludes from its high-risk biometric category AI systems whose sole purpose is to confirm that a person is who they claim to be. Remote biometric identification systems are treated as high-risk.
Is biometric data special category data?
Under the EU and UK GDPR, biometric data is special category data when it is processed to uniquely identify a person. Processing needs both a lawful basis and an Article 9 condition, such as explicit consent.
How do firms detect deepfakes in biometric checks?
Firms use liveness detection, which looks for signs that the image is a real, present person. Methods include passive analysis of texture and depth, active prompts such as head movement, and checks for injected camera feeds.
Our coverage
News and analysis on KYC and identity from RegTech Post.
Read the coverage →RegTech PostBiometric KYC Comes of Age: The Next Frontier in Digital IdentityRead the article →RegTech PostHow AI and Deepfakes Are Reshaping KYC in Financial ServicesRead the article →
