I. Concept of FINMA circular letter
Some criticisms were raised, not least that there would be increased control requirements in the digital channel and that the requirements were not worded sufficiently so as to be technologically neutral. Entry into force is scheduled for March 2016. FINMA endeavours to make the adopted anti-money laundering and terrorist financing rules technology-neutral. The circular enables financial service providers to carry out seamless online and video-identification in the future subject to certain accompanying measures.
II. Video-identification
1. Requirements
For the first time real-time audiovisual communication (i.e live video transmission) will be treated as a personal interview, provided that:
- In terms of data protection, both the provisions of the Swiss Data Protection Act (DSG, SR 235.1, in particular Articles 4 and 7 DSG) and the data protection requirements of the country of domicile of the contracting party must be complied with, i.e. it requires the express consent of the contracting party both for the implementation of video identification and audio recording.
- The financial intermediary shall ensure the encrypted and secure transmission and confidentiality of the data. ! The verification of the identification documents must take place (system-supported decryption of the coding line or the holographic elements of the identity card).
- The technical means used must, in addition to checking the holographic elements, allow at least one of the following elements to be checked: 3D images, kinematic motion structures, macro and micro-fonts or watermarks.
- Accordingly, only official identity documents with the elements just described may be used as proof of identification.
- In general, therefore, a suitable picture and sound quality must be ensured.
- The previously registered contracting party must be checked by technical means or manually for compliance with the presented identification documents. The conversation, which de facto also includes a behavioural psychological assessment to be undoubtedly further defined, must be recorded by means of audio recording; at the same time, the respective employee must produce photographs (e.g. HDR1Images) of the contracting party and the identification documents during the conversation. On conclusion of the 1 High Dynamic Range identification procedure, the contracting party is to be sent a TAN2 which it must confirm. All documentation must be stored and kept secure and be accessible at all times. If the documents are filed electronically, the relevant provisions of the Business Records Ordinance (GeBüV, SR 221.431) must be observed.
- Following this, it is clear that the financial intermediary has to issue corresponding guidelines for its employees and to train the employees accordingly.
2. Termination of the identification process
In the following cases, the financial intermediary must terminate the identification process: If it i) due to a lack of image and/or sound quality, is unable to undertake a faultless identification, ii) obtains evidence of heightened risks or iii) doubts the authenticity of the identity card or identity of the contracting party. There is also possibly a duty to report (Article 9 of the Money Laundering Act).
3. Plurality of persons
If several contracting parties exist, the procedure described can be carried out individually for each party/person.This applies to circumstances, which do not correspond to a personal interview, but are equivalent to the simple or certified copy of an identification document.
III. Other forms of online-identification
1. Documents equivalent to a simple copy of ID
The photography is equivalent to the simple copy of ID and it can also be transmitted electronically.
2. Documents equivalent to the certified copy of the identity document
In lieu of a certified copy of ID, the three procedures discussed below may be considered.
a) Electronic copy of ID with authentication by the financial intermediary
The contracting party shall provide the financial intermediary with an image (photograph, scan, etc.) of their identity document and a photograph of their own person (passport photo, selfie, etc.) electronically or by uploading to the system. By means of suitable technologies, the employee checks the authenticity of the identity document and allocates it to the contracting party (profiling) – a sufficiently high probability of the matching of both images is required. Thereafter, the contracting party transfers a freely agreed amount of money to a bank account in Switzerland to prove its existence. Then it is sent a TAN for confirmation. Finally, the residence address is checked by means of a digital copy of an invoice (e.g. electricity, telephone, utility bill), which is transmitted electronically, or by means of a public register.
b) Electronic copy of ID with qualified electronic signature
The contracting party shall provide the financial intermediary with a photograph of the ID by electronic means including a qualified electronic signature (in conformity with ZertES, SR 943.033). The financial intermediary checks the compliance of the information thereby provided. For transfer by bank account, the TAN and the residence check, reference is made to paragraph a).
c) Digital confirmation of authenticity
The issuer4 of confirmations of authenticity pursuant to Article 49 (1) of the MLA-FINMA (SR 955.033.0) provides the financial intermediary with an electronic copy of the identification document, which is inextricably supplemented by a confirmation of a match between the image and the ID and a digital time stamp and the employee visa.If such a declaration is necessary in accordance with Article 59 et seq. MLA-FINMA, the following two options are sufficient for online or video identification:
a) In the application to open an account, the declaration will be submitted by means of an online form and with a qualified electronic signature (in conformity with ZertES) or by means of mTAN5pushTAN6 or TAN generator. Under certain circumstances, the Web log, log files or the like should be kept as proof of confirmation.
b) However, a physically signed, scanned / photographed form sent by e-mail already printed by the contracting party is sufficient. Also, the e-mail must be added to the files. Any evidentiary problems regarding the authenticity of the signature remain with the financial intermediary.For all process steps, the engagement of third parties is permitted; however, the financial intermediary remains responsible for the due performance. Since the draft does not state anything to the contrary, the engagement of foreign third parties will be possible. However, such engagement may give rise to additional data protection problems (in particular, Article 6 DSG).
The documentation produced by the third party can be transmitted electronically to the client / financial intermediary.
In addition, the financial intermediary must commission its audit firm with monitoring compliance with the prescribed processes.