On 16 November 2020, the Swiss financial markets regulator FINMA published details of the partial revision of circular 2016/7 on video and online identification. The notable changes relate to the use of biometric passport data and a clarification regarding the engagement of specialized third party service providers for remote client identification. The consultation period for the proposed changes has ended on 1 February 2021. The revised circular is expected to enter into force in mid-2021.
By Aline Anthenien / Katrin Ivell (Reference: CapLaw-2021-04)
1) Background
With ever growing digitalization, communication between financial intermediaries and their clients is increasingly taking place electronically via the internet and mobile devices. Recognizing this development, in 2016, the Swiss financial markets regulator FINMA responded to the demand for a technology-neutral design of its rules on client identification and issued a circular on video and online identification (the Circular). FINMA’s stated aim was the interpretation of the due diligence requirements under the Swiss Anti-Money Laundering Act and its implementing provisions in the context of the digital provision of financial services. Subject to compliance with certain conditions, financial intermediaries were permitted to establish business relationships with customers by means of video transmission, which was thereby put on an equal footing with a personal meeting. In addition, various avenues were presented to facilitate the establishment of a business relationship via the Internet.
Almost two years after the Circular first came into force, FINMA issued a revised version. This was prompted by further technological developments and feedback from various financial intermediaries. For example, for online identification, requiring a transfer of funds from an account in the name of the customer at a bank in Switzerland was felt to be too restrictive. Therefore, under certain conditions, money transfers from countries with equivalent rules on the prevention of money laundering compared to Switzerland were also permitted, specifically from Liechtenstein and member states of the Financial Action Task Force (FATF), whose core tasks include the drafting of international standards to combat money laundering and the financing of terrorism and proliferation.
Another point of criticism of the original Circular was that the requirement to abort the online and video identification process in the event of indications of increased risks. Therefore, in the course of the first revision, the continuation of the identification process was generally permitted even in the presence of increased risks. In addition, it was no longer required to verify the contracting party by means of a Transaction Authentication Number (TAN) or similar methods. This circumstance was compensated by increased requirements regarding the verification of the identification document.
2) New Rules
As a result of yet further technological advances and renewed proposals for amendments and clarifications from the financial industry, FINMA felt compelled to revise the Circular again in 2020. The revised Circular is designed to address two aspects in particular: On the one hand, fully automated online identification using a biometric passport is to be made possible. On the other hand, the Circular contains a helpful clarification regarding the involvement of specialized service providers.
With regard to fully automated online identification, the financial intermediary should now be able to waive the requirement to have money transferred from an existing bank account in order to verify the customer’s identity if relevant data can be read from the chip of the biometric passport. The data contained on the chip is to be scanned by the customer using a smartphone app, and personal details and a photo (but no other biometric data) are to be transmitted to the financial intermediary. In addition to obtaining the data, its authenticity and integrity must also be checked. For this purpose, certificates required for checking Swiss passports can be obtained from the website of the Federal Office of Information Technology, Systems and Telecommunication. For international biometric passports, FINMA refers e.g. to the master lists of the International Civil Aviation Organization (ICAO).
In FINMA’s view, dispensing entirely with additional security measures for online identification (such as using biometric passport data or a bank transfer) would reduce the security level of digital onboarding and facilitate abuse, especially since automatic facial recognition is still heavily dependent on external influences and attempts at abuse are higher in the digital environment compared to face-to-face customer meetings. In support of this argument, FINMA refers to various Suspicious Activity Reports submitted to the Swiss Money Laundering Reporting Office MROS as a result of suspected use of forged or false IDs in the area of digital onboarding.
With regard to the involvement of service providers, the revised Circular contains the following clarification: According to FINMA, financial intermediaries often do not carry out video and online identification themselves, but commission specialized service providers to do so. However, if a financial intermediary has already engaged another financial intermediary to fulfill the identification obligations (e.g. in the constellation of a custodian bank and an external asset manager, where the external asset manager often performs the identification obligations for the custodian bank), the financial service provider so engaged was previously prohibited from engaging additional third parties to fulfill its obligations. The Circular now specifies that if a financial intermediary commissions another financial intermediary with client identification and if this financial intermediary in turn engages a specialized service provider, the involvement of the latter is permitted.
However, FINMA has not included in the revised version of the Circular the request for an explicit rule that the signature of the contracting party on the form that declares the beneficial owner does not have to be handwritten when the beneficial owner is identified digitally. In FINMA’s opinion, its practice on the digital identification of the beneficial owner is already sufficiently clearly stated elsewhere. It states that the declaration of beneficial ownership can be completed electronically by the contracting party using an online form provided by the financial intermediary and signed with a qualified electronic signature issued by a Swiss provider of certification services. Alternatively, under certain conditions, the signature can also be made via other electronic procedures. (Prior to the introduction of this practice, the beneficial ownership statement generally had to be signed by hand and physically delivered to the financial intermediary.)
3) Comment
The biometric passport was introduced in Switzerland in 2010 and has also been in use in large parts of the EU for some time. Identification by means of a biometric passport introduced with the revision of the Circular is thus based on proven technologies and uses the experience gained in handling biometric data. FINMA’s insistence on some form of additional safeguards for online identification is understandable, particularly with regard to the uncertainties that still exist in the use of automatic facial recognition. However, while offering an additional means to safeguarding security by allowing financial intermediaries to use biometric passport data is generally to be welcome, time will tell whether this type of identification is in fact more practicable and efficient compared to the verification of identity by other means.
The current pandemic situation shows that rapid technological advances are possible and, above all, that the digitization of work is accelerating. Since the majority of communication in all areas takes place via the Internet, the possibility of electronic identification of customers by financial intermediaries has gained additional importance. Against this background, the partial revision of the Circular is to be welcomed overall.
Interested parties were invited to comment on the revised Circular until 1 February 2021. The results of the consultation will be published thereafter, and the revised Circular is expected to enter into force in mid-2021.
Aline Anthenien (aline.anthenien@homburger.ch)
Katrin Ivell (Katrin.ivell@homburger.ch)