Scope
Electronic onboarding means using automated or semi-automated technology for all or part of collecting, checking and keeping a customer's identification data. The circular covers the identification of customers and beneficial owners. For companies, paper copies of identification documents are still required.
Identification requirements
- Prior consent of the customer to the processing of personal data.
- Authentication factors proportionate to the assessed risk.
- Authenticity and integrity checks of identity documents, through the issuing authority's systems where a connection exists, otherwise by manual review. Without access to the required information, the relationship cannot be validated.
- Proof of life and presence through audiovisual communication, facial recognition or any other reliable technology. Video is one option, not an obligation.
- A match between the identification data and the customer's biometrics.
- Screening and profiling under Circular 2017-08, and a KYC sheet generated automatically and updated within a month of any change.
- Consent to the relationship by electronic or handwritten signature, the electronic one relying on reliable identification.
- Secure retention of KYC sheets, personal data and copies of documents, with integrity protected by a reliable cryptographic process.
Governance, testing and reporting
The board approves the procedures, which cover the end-to-end process, a risk map (identity theft, cyber and AML/CFT risks), mitigation measures and incident management. Before production, test results are logged monthly in a performance register and the bank works to bring the false acceptance rate down; deployment depends on the process being able to eliminate false acceptances. Penetration tests are carried out by an auditor accredited by the National Cybersecurity Agency, and the process is audited every two years.
Before go-live the bank sends the BCT a file with the process description, the risk report, the penetration test report, the pre-production evaluation and the mitigation plans. Major incidents are reported promptly.
Working with a provider
Outsourcing must follow Circular 2017-08 and Article 81 of Law 2016-48. The provider goes through the same tests and annual audits, the contract covers confidentiality, forbids subcontracting and gives the BCT access, and the bank keeps full responsibility. Running the provider's software on your own infrastructure, as the Konnect ID self-hosted edition allows, keeps data and operations under your control.
Where Konnect ID fits
- An information screen before capture; the consent itself is recorded in your onboarding, before the session starts.
- Document checks: screens, prints, edits, reused images and data consistency.
- Guided liveness challenge and face match with a threshold per flow.
- Watchlist screening and PEP declarations, with matches sent to review.
- A case report and an audit log for every decision, to build the KYC sheet and your BCT file.
- Thresholds and decision rules you can tune during pre-production testing.