The rise of digitization is leading to greater demand for fast, secure identification processes. As such, businesses need appropriate procedures for reliably verifying customer identities. An established method in Germany is video identification, or video ID.

In this article, we’ll explore what video ID is, how it works, and why businesses in Germany must verify customer identities. We’ll also explain what compliance aspects businesses need to be aware of, and what alternatives there are to video ID.

Key takeaways

• Video ID is an efficient way for businesses to verify customer identities digitally, remotely, and securely.
  
• The process involves screening identification (ID) documents and comparing them to the person to prove their identity.
  
• Data protection, technical security, and legal regulations are key requirements that must be fulfilled when deploying video ID.
  
• Alternatives to video ID include post identification (POSTIDENT), bank identification (bank ID), and electronic identification (eID).
  

What is video ID?

Video ID is a digital identification method that allows businesses to verify customer identities remotely. Identification is performed via an encrypted video link between the customer and a trained agent. The agent verifies that the ID document is genuine and that the customer matches the photo on their ID. This is a reliable way of confirming a customer’s identity without the need for a face-to-face appointment.

Video ID was developed as a way of implementing legally mandated identity verification securely and efficiently in the digital sphere. Initially, the method was most commonplace in online banking as an alternative to presenting identification in-person at a branch. Now, however, many businesses from the worlds of finance, insurance, telecommunications, and other regulated sectors use video ID to fulfill their legal customer identity verification requirements.

There are numerous benefits to video ID for businesses in Germany. Verifying customer identities digitally speeds up the onboarding process and allows customers to sign contracts quickly. At the same time, verifying ID documents and physical characteristics makes it harder for bad actors to commit fraud—including identity theft—and helps businesses comply with regulations. There are also benefits for customers, as they can verify their identity remotely and outside of the business’s operating hours. Thanks to its scalability, video ID is suitable for both small businesses and larger organizations that have lots of customers to verify.

Why is identity verification necessary in Germany?

The purpose of identity verification is to establish the identities of contract partners with certainty and to prevent fraud. It is a legal requirement in many industries—for example, when companies initiate business relationships or perform transactions that are at a greater risk of money laundering, financing of terrorism, or identity fraud. The regulations are intended to protect the integrity of the economic and financial system, and to ensure that business is conducted transparently.

Key regulation: German Anti-Money Laundering Act

The most important regulation governing customer identification in Germany is the Anti-Money Laundering Act (GwG). As part of the due diligence requirements under Section 10 of the GwG, so-called “obliged entities” must verify the identities of their customers before initiating a business relationship or when performing certain transactions. Obliged entities include credit institutes, financial service providers, insurance companies, and other regulated businesses.

Identity verification is one of the most important parts of Know Your Customer (KYC) checks. The purpose of KYC checks is to clearly establish the identities of a business’s customers, to assess risks, and to fulfill statutory requirements to prevent money laundering and the financing of terrorism. Section 11 of the GwG defines what information must be collected in order to verify customer identities.

The German Federal Financial Supervisory Authority (BaFin) has also issued a circular, detailing the specific requirements that video ID processes must satisfy. These include technical, organizational, and security-related minimum standards for video ID.

EU regulations on electronic identification

Businesses in Germany must observe both national laws and EU regulations. The Electronic Identification, Authentication, and Trust Services (eIDAS) Regulation establishes a unified legal framework for digital identification means and trust services within the EU. It governs the cross-border recognition of electronic IDs and the use of qualified electronic signatures. This means that businesses that use video ID must design their identity verification processes in such a way that they fulfill the requirements of both the GwG and relevant EU provisions. This reduces compliance risks and guarantees that digital business processes comply with the law.

How does video ID work?

Video ID follows a standardized process that verifies a person’s identity digitally, while fully complying with the law. While the exact steps can vary slightly from one provider to another, the process typically involves the following:

• Starting identification: The customer begins the identification process via a link or directly in an app provided by the business. This requires an internet-capable end device with a camera and microphone, as well as a stable internet connection.

• Establishing a video link: Next, an encrypted video link is established with a trained agent. Often, this agent must obtain consent from the customer to process their data and confirm that the technical requirements have been met before they can begin verification.

• Presenting an ID document: The customer then holds up a valid ID document, such as a government-issued ID or passport, to the camera. The agent captures the necessary identity data and verifies whether the document satisfies the formal requirements.

• Verifying authenticity: The ID document is checked for security features and signs of tampering. This might require viewing the document from multiple angles so that holograms, images that change when tilted, or other security features are visible.

• Conducting a facial comparison: The agent compares the customer’s face to the photograph on the ID document. They might also have to ask a few short questions or ask for specific movements in order to ensure that the person on the document matches the person on the video call.

• Confirming the identity: Once verification is complete, the customer’s identity is confirmed and the identification process is documented. The customer is then able to access their customer account, conclude a contract, or continue with their respective transaction.

What alternatives are there to video ID in Germany?

In Germany, businesses can choose from a wide range of identity verification methods, not just video ID. Different methods are suitable for different businesses, depending on the legal requirements, the desired level of security, and what the customer expects from the digital onboarding process.

POSTIDENT

POSTIDENT from Deutsche Post, the German postal service, is one of the most well-known identification methods in Germany. Customers can verify their identities either digitally or at a branch of Deutsche Post. With traditional in-branch identification, Deutsche Post employees verify customer identities using a valid ID document and then send the identification data to the relevant company.

Bank ID

Bank ID is where a customer’s identity is verified via an existing online banking account. Customers log in to their bank and consent to provide certain identity data to the requesting business. Since the customer’s bank has already verified their identity as part of their legally mandated KYC checks, this type of identification can in some cases be used for other business processes.

Electronic ID (eID)

German government-issued IDs have an electronic identification function that allows holders to verify their identity digitally. Users authenticate themselves by activating the eID function on their ID and confirming their personal identification number (PIN) via a suitable end device or smartphone enabled with near-field communication (NFC). This method provides a high level of security and is based on the provisions of the German Identification Document Act (Personalausweisgesetz) and the eIDAS Regulation. However, it only works if eID capabilities have been activated.

In-person ID

Some industries still verify customer identities in-person, such as at a branch or an office. Employees physically check the customer’s ID document and compare the photo to the customer. This method provides a high degree of control, but it also entails a higher organizational workload.

What security and compliance aspects do businesses need to be aware of when implementing video ID?

Security and compliance requirements play a key role in video ID. Businesses in Germany must take into account not only the provisions of the GwG and the minimum standards for video ID processes as defined by the BaFin, but also technical and organizational regulations. The aim is to guarantee the integrity of the identification process and to protect sensitive data.

Data protection and the General Data Protection Regulation (GDPR)

Businesses in Germany are required to process personally identifiable information in accordance with the GDPR. They can only collect information which is absolutely necessary for identity verification. Data subjects must also be provided with transparent information on the processing of their data, in particular with regard to the purpose of the processing, the retention period, and their data subject rights.

Data security

It is equally important that the process is technically secure. Communication between the customer and the identification service needs to be conducted via encrypted connections. This guarantees that sensitive data is protected against unauthorized access during transfer. If data is to be stored, appropriate security measures must be taken, such as protected servers, access restrictions, and a role-based rights concept. This reduces the risk of data loss, manipulation, or unauthorized disclosure.

Continuous security measures

Businesses also need to review their security measures regularly and adapt to new developments in technology and regulations. Continuous employee trainings, regular security audits, and documented compliance processes help ensure that the quality of the identification process doesn’t fluctuate. Implementing these measures consistently doesn’t just strengthen compliance, it also improves the customer’s trust in a business’s identification processes.

How Stripe Identity can help with digital identity verification

Stripe Identity enables businesses to verify identity documents from numerous countries. Businesses can collect and process different types of identity data, including images of ID documents and selfies for biometric matching. Relevant information, such as a user’s name or date of birth, can also be automatically extracted from documents and used for identity verification. Step-by-step guidance supports users during document capture and helps make the verification process as straightforward as possible.

Identity uses machine learning (ML) to detect forgeries and tampering. This allows ID documents to be automatically checked for authenticity and potential fraud attempts to be identified early. This helps businesses provide a secure and user-friendly identity verification process.

FAQs about video ID