Myth Busting: Guidance Confirms Digital ID Verification for Account Opening is Legal in Canada

Regulatory compliance is a notoriously complex subject. Canadian financial institutions rely on experienced legal teams to decipher the requirements of relevant legislation and ensure the institution remains compliant. It’s a tough job, and regulations are always changing.

Recently, we encountered some financial institutions who have received conflicting reports about the legality of digital identity verification technology in Canada, specifically related to the new account opening and beneficiary signing use cases.

We wanted to take the opportunity to present the facts to help financial institutions with the issue of digital identity verification, which is legal for account opening in Canada.

Identity Verification and Digital Account Opening Legality in Canada

In October 2019, the Financial Transactions and Reports Analysis Center of Canada (FINTRAC) released an update titled “Methods to verify the identity of an individual and confirm the existence of a corporation or an entity other than a corporation.” The update details the relevant rules related to digital account opening and identity verification.

Section 2.A states:

“If an individual is not physically present, the authenticity of a government-issued photo identification document must be determined by using a technology capable of assessing the document's authenticity.

For example:

• An individual could be asked to scan their government-issued photo identification document using the camera on their mobile phone or electronic device; and

• A technology would then be used by you, as the RE, to compare the features of the government-issued photo identification document against known characteristics (for example, size, texture, character spacing, raised lettering, format, design), security features (for example, holograms, barcodes, magnetic strips, watermarks, embedded electronic chips) or markers (for example, logos, symbols) to be satisfied that it is an authentic document as issued by the competent authority (federal, provincial, territorial government).”

“When an individual is not physically present, you must still determine if the individual presenting the government-issued photo identification document matches the name and photo of the person in the authenticated document provided. For example:

• An individual could participate in a live video chat session and you, as the RE, would then be able to compare the name and the features of the live video image to the name and photo on the authentic government-issued photo identification document; or

• An individual could be asked to take a "selfie" photo using the camera on their mobile phone or electronic device, and an application used by you, as the RE, would apply facial recognition technology to compare the features of that "selfie" to the photo on the authentic government-issued photo identification document. A process would have to exist to also compare the name on the government-issued photo identification document with the name provided to you, as the RE, by the individual.”

It is clear from this guidance that when an individual is not physically present, financial institutions can use digital account opening and identity verification functionality to enable that individual to open a bank account, providing they use a solution that can assess the authenticity of the applicant’s ID document and verify that the individual attempting to open the account is the person on the ID document. 

The guidance then describes the type of technology that would be acceptable in an identity verification process, such as ID document verification (when the applicant scans their Canadian passport, permanent resident card, driver's license, photo ID, or other government issued ID using the camera on their phone and technology analyzes the image verifying its authenticity) and facial comparison (when a selfie image is used to validate that the person attempting to open the account is the person pictured on the ID document).

Explore How Automated ID Verification and Facial Comparison Technology Work Together

The legal pronouncement by FINTRAC is based on the understanding that ID verification and facial comparison technology can:

• First, determine whether a government-issued identity document is authentic and not fraudulent.
• Second, credibly verify that the applicant (the person who is not physically present but who is opening the account online or on their mobile) is the same person as the person pictured/named on the ID document just authenticated.

Not all ID document verification and facial comparison technologies are alike, but financial institutions and financial services organizations should look for a platform-based solution which combines ID document verification and facial comparison. These technologies generally work as follows:

FAQs: How Does Automated ID Verification Work?

• Step 1: Document Capture

With the camera enabled on their mobile phone, the customer is asked to take a picture of their government-issued ID document through a secure app or secure web browser. The image needs to be of optimal quality to ensure accurate verification.

• Step 2: Document Categorization

The identification card or document is categorized into document type and country of issue using computer algorithms.

• Step 3: Document Analysis

The document is analyzed in real-time to determine whether it is authentic and government-issued. Many data points can be analyzed, such as the rounding of the corners, the image coloring, font size and type, as well as security features such as holograms and barcodes. These data points are collated to determine an authenticity score. Depending on this score, the document is either deemed fraudulent or authentic.

FAQs: How Does Facial Comparison Work?

• Step 1: Face Detection
  With the camera enabled on their mobile phone, the customer is asked to take a selfie image through a secure app or secure web browser. The camera detects a facial image.

• Step 2: Analysis
  The technology performs a detailed analysis on the facial image. Some algorithms explicitly map the face, measuring the location and arrangement of nodal points which are unique to the individual and represent facial characteristics such as the distance between a person’s eyes, the bridge of their nose, and the curvature of their cheekbones. Other algorithms map the face using more abstract features.

• Step 3: Converting an Image to Data
  The unique arrangement of nodal points or features is then converted into a string of numbers. The resulting numerical code is referred to as a faceprint or feature vector. This data is usable by facial comparison systems.

• Step 4: Making a Match
  Once the feature vector is established, it can be compared against the image on the authenticated government-issued ID document. If the system discovers a match, it can notify whatever application is making use of the technology

If you have further questions about facial comparison or ID verification technology, schedule a solution demo with our team and see our Secure Agreement Automation solution in action. Learn how these solutions can help prevent identity theft, credit card theft, and more types of fraud and money laundering while ensuring compliance for financial service providers.

Webinar

FINTRAC Regulatory Update and Q&A

Learn how financial institutions can meet compliance requirements for consumer security while promoting innovation.

Register Now

The information contained in this document is for information purposes only, provided as is as of the date of publication and should not be relied upon as legal advice or to determine how the law applies to your business or organization. It is recommended that you seek guidance from your legal counsel with regard to law applying specifically to your business or organization and how to ensure compliance.