Customers should be able to choose ID procedures for online financial transactions
Mr Bauer, what is your assessment of the draft bill and the market conditions it creates?
We see the draft bill as a positive signal from Berlin. Video identification procedures are now finally to be regulated by ordinance instead of by the BaFin circular from 2017, as was previously the case. Additional procedures, such as partially and fully automated procedures, which we have been positioning in Berlin since 2020 as alternatives to the classic VideoIdent, as well as the eID function, should also be possible in the area of the Money Laundering Act in future. This would significantly advance modernisation in this sector in Germany, and put it on a par with other EU countries where these procedures are also commonplace in the financial sector, thus making a positive contribution to intra-European competition.
What pros and cons have crystallised?
A major advantage of authorising several procedures would be the possibility of allowing end users to decide which procedure they want to use for identification – entirely according to their personal wishes and capabilities. In addition to personal identification in the branch, video identification and procedures using eID have become indispensable. It is therefore all the more important for banks and financial service providers to rely on providers that maintain high levels of security, and can offer all processes from a single source.
And what are the shortcomings?
The draft does indeed have some weaknesses: In our view, the detailed requirements contained in Articles 10 and 11 of the draft bill still need to be amended in the consultation process. We are in favour of the adoption of the BaFin Circular 2017, as these requirements have proven themselves over many years, and ensure that a large number of identification documents continue to be approved for identification procedures. This is important in order to continue to enable this procedure for all people living in Germany, and to minimise the group of people who cannot identify themselves online with their foreign ID document, thereby preventing discrimination.
Would it be advisable to allow the KYC processes to be fully automated and solely AI-controlled, without a „human hand“?
The newly proposed processes are intended to modernise onboarding, and would be more cost-effective for banks and service providers than traditional VideoIdent, but do not offer as much protection against deepfakes and social engineering attacks. Social fraud, such as social engineering and financial agents, remains one of the biggest fraud risks. In our experience, this form of attack can only be recognised in a video chat. With fully automated processes, there are no starting points for identifying such attacks. Our identification experts use an easy-to-understand video call to ensure that the user really is who they claim to be, and is not acting under pressure or on the instructions of a third party.
Would the increased use of semi-automated processes mean a loss of revenue for IDNow?
With our portfolio, which includes all solutions from automated to semi-automated to eID in addition to the classic VideoIdent, and our many years of experience in the market, we are very well positioned. Our partially or fully automated solutions have been used successfully for years in other European countries and in Germany in non-MLA-relevant applications. The possibility of being able to use more (partially) automated processes here in Germany would therefore be a positive development for our business.
What other factors will influence the market? So far, the eID has been more of a flop.
The eID is a secure, reliable and fast identification procedure. It will serve as the basis for the German implementation of the EU Digital Identity (EUDI) Wallet (in accordance with the eIDAS 2 Regulation) and should therefore enjoy broad acceptance among the population. In our view, however, the obligation to use eID, as set out in the current draft regulation, will not be sufficient for user acceptance of the solution. The use case of opening a bank account is too rare in the everyday lives of citizens. An eID boom is therefore not to be expected.
But there is still accompanying regulation, isn't there?
The second major factor influencing the market over the next few years will be the eIDAS 2 Regulation. The planned EU Digital Identity Wallets will revolutionise the market, moving away from disposable KYC processes towards reusable identities. Instead of having to identify end customers again and again, they can use the digital identity wallet to store their verified identities, and simply reuse them the next time. This will significantly streamline and speed up existing onboarding processes.
Does the draft bill have any chance of becoming a regulation? Or are there likely to be minor or major changes?
The draft is currently in the comment phase. A number of associations and companies have submitted comments calling for minor and major changes, or requesting clarification of terminology. Changes are therefore still to be expected before the regulation is adopted. In addition, the European Union is currently working on a Europe-wide Anti Money Laundering regulation. Accordingly, the draft also contains a clause on the expiry of the regulation. It states: „This regulation shall cease to apply from the date on which directly applicable European rules on the implementation of due diligence obligations under anti-money laundering law, and on details of the identification procedures required for this purpose, including the area of remote identification procedures, are applicable“.
What transitional phases are planned in the draft bill and are they sufficient?
According to the draft, the regulation would „enter into force on the first day of the quarter following its promulgation and shall apply to video identification procedures from the first day of the quarter following its entry into force“. The transition period would therefore only be two quarters. We are in favour of a longer transition period in order to be able to implement all technical requirements.
