Country Guide, Germany: Video Identification and Other Remote Identification Under the Money Laundering Act

For information; not legal advice.

A firm that wants to identify a customer in Germany without meeting that person has a short list of lawful ways to do it. They are set out in the Money Laundering Act, the Geldwäschegesetz or GwG, and one of them, video identification, is described in detail not by the Act but by a circular of the financial supervisor BaFin. This guide reads the Act, the circular, BaFin's later statements and a published draft ordinance, and it says plainly which of them is in force on the fetch date and which is not. The German texts are the sources, and the English wording below is this article's own translation or summary.

It is a reading guide and not a compliance opinion. It does not say that any product meets the German rules, and a firm should confirm its approach with its own supervisor. For the European rules that will in time sit above the German ones, see the articles on the EU AML Regulation and remote customer identification and on the European Digital Identity Wallet.

What is in force, in one table

The status of each instrument was read from the primary text or from BaFin's own pages on 28 October 2026.

The table summarises the sections that follow. Nothing here is a statement that a text was withdrawn, except where the section says so.

The Act: three sections that matter

Section 11: collect and verify before the relationship starts

Section 11 of the Act obliges obliged entities to identify the contracting party, any person acting for it, and beneficial owners before a business relationship is established or a transaction is carried out. Identification has two parts: collecting data under paragraphs 4 and 5, and verifying it under section 12. The identification may be completed during the establishment of the relationship, without delay, if that is needed to avoid interrupting normal business and the money laundering risk is low. For a natural person the data to collect are the first name and surname, place of birth, date of birth, nationality and a residential address. For people without a fixed residence who are lawfully resident in the Union and who open a basic payment account, the postal address at which they can be reached takes the place of the residential address. The contracting party must supply the information and documents needed and must report changes without delay.

Section 12: what may be used to verify a natural person

Section 12 lists the evidence on which the verification of a natural person must be based. There are five kinds. The first four are the general routes for remote identification, and the fifth contains one narrow remote route for minors that is described after the list.

1. A valid official photo identity document that satisfies the obligation to hold a passport or identity card in Germany, including documents recognised or admitted under the law on foreign nationals.
2. An electronic proof of identity under section 18 of the Personalausweisgesetz, under section 12 of the eID-Karte-Gesetz or under section 78, paragraph 5, of the Aufenthaltsgesetz.
3. A qualified electronic signature within the meaning of Regulation (EU) No 910/2014.
4. An electronic identification system notified under Article 8, paragraph 2, point (c), in connection with Article 9 of that Regulation.
5. Documents under the Zahlungskonto-Identitätsprüfungsverordnung, an ordinance that covers certain documents for opening a payment account.

Two conditions attach to the qualified signature route. The obliged entity must validate the signature under Article 32, paragraph 1, of the eIDAS Regulation. It must also make sure that a transaction comes directly from a payment account in the name of the contracting party, held at an obliged entity of a kind the Act names or at a credit institution in another Member State of the Union, in the European Economic Area, or in a third state with equivalent duties. In practice this is the "reference transfer", and the interpretation notes use that word.

The fifth kind holds one remote route that is easy to miss. Where section 1, paragraph 1, point 1, of that ordinance applies, section 12, paragraph 1, point 5, says that an electronically or postally transmitted copy of the birth certificate of the minor person is enough to identify that person. This holds only if the obliged entity has to collect the tax identification number of the person to be identified and the identity of the legal representative has been verified by a document or procedure under points 1 to 4 of section 12, paragraph 1, first sentence. The route is therefore a narrow exception for minors, with the representative verified first, and not a general alternative.

Section 12 also contains, in its last paragraph, a power for the Federal Ministry of Finance to name further documents suitable for verifying identity by ordinance.

Section 13: the verification procedure and the ordinance power

Section 13, paragraph 1, says that obliged entities verify the data collected for identification by one of two procedures. The first is an appropriate examination of a document presented on the spot. The second is any other procedure that is suitable for the money laundering verification of identity and offers a security level equivalent to the first. The interpretation notes name the electronic proof of identity, the qualified electronic signature and the notified electronic identification system as procedures of equivalent security level in this sense, and they list video identification beside them.

Paragraph 2 gives the Ministry of Finance, in agreement with the Ministry of the Interior, a power to issue an ordinance without the consent of the Bundesrat. The ordinance may specify further requirements for the procedures in paragraph 1, determine procedures that are suitable under paragraph 1, point 2, and determine procedures whose suitability is to be tested. For tested procedures the supervisory authorities may be authorised to admit their use for a limited time, subject to revocation and conditions, and an electronic procedure is admitted for testing only if the Federal Office for Information Security has found the necessary security level in a prior review. The interpretation notes of July 2025 state that, until their publication, no ordinance on other suitable procedures had been issued and no procedure had been designated for testing.

Section 17 and section 8: who may do it, and what is kept

Section 17 lets an obliged entity rely on certain third parties for the general due diligence duties, and it lets the entity transfer the measures to other suitable persons and companies by contract. Measures carried out under such a contract count as the obliged entity's own measures, and the entity must satisfy itself of the reliability of the provider before the transfer and by sampling during the cooperation. The transfer must not impair the entity's own compliance with the Act, the steering and control options of its management, or the supervisory authority's oversight. Section 8 requires records of the data collected and, where a document under section 12 was presented, its type, number and issuing authority, with a copy of the document or an optical digital capture of it. Records are kept for five years unless other laws set a longer period, and they must be destroyed after ten years at the latest. Under section 8, paragraph 4, the five years start at the end of the calendar year in which the business relationship ends, in the case of section 10, paragraph 3, first sentence, point 1. In the other cases the period starts at the end of the calendar year in which the respective piece of information was established. A firm that counts from the capture date or from the end of the relationship itself, and not from the end of that calendar year, risks deleting too early.

The BaFin circular on video identification

BaFin published Circular 3/2017 (GW) on 10 April 2017. It entered into force on 15 June 2017. It replaced section III of Circular 1/2014 of 5 March 2014 on video identification and, in the same text, repealed Circular 4/2016 of 10 June 2016, which had only been suspended. It is addressed to credit institutions, financial services institutions, payment institutions, e-money institutions, their agents, certain asset managers and certain insurance undertakings, and other obliged entities under BaFin's supervision. Its requirements are cumulative: every one of them must be met. It also said the procedure was to be evaluated, on good cause and at the latest three years after entry into force.

The circular covers natural persons only. A legal person or partnership cannot be identified by video, but the procedure may be used for the proof of identity of a legal representative or an authorised person. Its reasoning is that during video identification the person and the employee "sit face to face", so that, despite the physical separation, the persons involved and their documents can be perceived.

The requirements, in the order of the circular

Trained staff. The video identification may only be carried out by employees who are suitably trained for it, either of the obliged entity or of a third party to which the identification was outsourced or on which the entity relies. Further outsourcing by that third party is not allowed. The employees must know the security features of the accepted documents that can be checked by video, the test procedures, usual forgery methods, and the relevant money laundering and data protection rules. Training takes place before work starts and at least once a year afterwards, and whenever there is a need, such as a significant number of fraud attempts.

Premises. The employees must be in separate premises with access control while identifying.

Consent. At the start the person must expressly consent to the recording of the whole process and of photos or screenshots of the person and the document, and the consent is itself recorded.

Technical and organisational rules. Cases are allocated to employees by a mechanism that prevents predictable allocation. The identification must run live and without interruption. The audiovisual link must be protected for integrity and confidentiality, and only end-to-end encrypted video chats are permitted, following the recommendations of the BSI technical guideline TR-02102. Image and sound quality must be good enough for an unambiguous identification, and suitable image elements, such as guilloche patterns and microprint, are to be defined to judge the quality of the transmission. The employee takes photos or screenshots in which the person and the front and back of the document are clearly legible.

Which documents. Only documents with sufficiently forgery-proof security features that can be recognised and checked visually in white light over the video link, and with a machine-readable zone, may be used.

Checking the document. The employee compares the optical security features with those that belong to that type of document. The circular groups the features into categories: diffractive features such as holograms, personalisation techniques such as laser tilt images, material features such as windows and security threads, and security printing such as microprint and guilloche. A match is assumed if the criteria are met for at least three security features, chosen at random for that identification, from different categories of the list. The employee also checks formal features such as layout, number of characters, size, spacing and typography. IT support must ensure that the security features recognisable in white light match the individual data on the document, for example by comparing the primary and secondary photographs with references from an identity document database, or, as an alternative, the employee must select still images for the comparison. The person tilts the document horizontally and vertically on request and makes further movements. The interview must vary in the order or type of questions. To counter substitution of parts of the document, the person is asked, at a point chosen at random by the system, to hold a finger in front of security-relevant parts of the document and to move a hand in front of the face, and the employee verifies on enlarged stills that the overlay is complete and the transitions show no artefacts. A validity and plausibility check covers the issue and expiry dates and the validity period for that type of document. An automated calculation of the check digits in the machine-readable zone and a cross comparison with the visual zone are mandatory. The person also reads out the full serial number of the document during the video transmission.

Checking the person. The employee must be satisfied that the photograph and the personal description match the person, and that photograph, issue date and date of birth are coherent. Through questions and observation the employee also judges the plausibility of the statements and of the stated purpose. The person confirms the reason for the identification, and employees are trained to establish that the person buys the product of their own will, with phishing, social engineering and pressure by a second person named as dangers.

Aborting. If the visual check or the spoken communication is not possible, for example because of poor light or poor image quality, or if there are inconsistencies or doubts, the process is aborted. Identification may then be carried out by another procedure the Act permits.

The one-time number. During the video transmission the person must enter online a one-time number generated centrally for this purpose and sent by the employee by email or SMS, and enter it back to the employee. With a successful system match of that number, the identification is complete.

Recording and retention. The whole process must be recorded, visually and acoustically, and kept so that internal and external audit and BaFin can verify every step. The circular states a retention period of five years under the Act's recording provision.

Two points of reading help a modern reader. The circular was written in 2017, and its text, as fetched for this article, does not contain the words liveness or deepfake; the checks it asks for are performed by a human who sees the person and the document live. It also cites the paragraph numbers of the Act as they stood in 2017, so a reader should not take its references to the Act literally; the current Act places the outsourcing and reliance rules in section 17 and the recording rules in section 8.

What BaFin has said since

The evaluation of 9 May 2022

BaFin published the result of the evaluation of the video identification procedure on 9 May 2022. The Federal Ministry of Finance, the Federal Ministry of the Interior, BaFin and the Federal Office for Information Security took part. The result is that video identification continues as a "bridge technology". The procedure is to be reviewed further, including whether the money laundering requirements are still sufficient in the light of technical progress and further findings. The use of artificial intelligence is also to be examined, with evidence of protection against fraud attempts and with transparency, traceability and explainability as criteria. BaFin also said it was being examined whether an ordinance under section 13, paragraph 2, would be sensible or whether the procedure would continue within the circular.

The interpretation notes of July 2025

The interpretation and application notes on the Money Laundering Act, issued under section 51, paragraph 8, of the Act, carry the status July 2025. They list the ways in which the data collected for a natural person may be verified, namely the on-site examination of a document, the document under the payment-account identity verification ordinance, the electronic proof of identity, the qualified electronic signature, the notified electronic identification system, video identification and other procedures determined by ordinance. On video identification they say that the BaFin circular of 10 April 2017 for the technical and other requirements "continues to apply", and that obliged entities under BaFin's supervision may use video identification, with the requirements taken from that circular. They add that, up to publication of the notes, no ordinance on other suitable procedures had been issued and no procedure for testing had been determined.

BaFin's list of administrative practice

BaFin's page of decisions, consultations and administrative practice for money laundering prevention states that withdrawn administrative practice is as a rule removed from the website. On 28 October 2026 the page's latest entry was dated 27 July 2026 and concerned the risks of virtual IBANs. The 2022 evaluation result was still listed. None of the entries read stated a replacement of Circular 3/2017 (GW). The conclusion that fits these sources is that the circular continues to apply on the fetch date. That is an inference from the sources named and not a statement by BaFin of 28 October 2026, and a firm should check BaFin's current pages.

The draft ordinance on video identification

The Federal Ministry of Finance prepared a draft ordinance for identification through video identification, called in German the Geldwäschevideoidentifizierungsverordnung. The copy read for this article is a reference draft with the processing status 20 March 2024, as hosted by the Federal Chamber of Tax Advisers. It is a draft, not a law, and nothing read for this article shows that it was adopted. It is worth reading for the direction it shows.

• Extension. The draft states that, until then, the procedure was available to the entities under BaFin supervision and that the ordinance would extend it to the other obliged entities under the Act, unless their supervisors exclude it in their interpretation notes.
• Duty to offer eID as well. An obliged entity could use video identification only if it also offers, in an equivalent way for the same identification, a procedure for the electronic proof of identity of the German identity card, the eID card or the residence title.
• Content of the circular, with tightening. The draft carries over the circular's requirements and adds figures, among them a transmitted resolution that may never fall below 1280 by 720 pixels at 25 frames per second, a minimum of one trained-staff training per year on digital security and deception, and recording and retention for five years.
• Partial automation. Procedures in which individual steps are carried out by an IT system are allowed if only the recording and the prescribed checks are automated and a trained employee examines the recording and the result in detail before the identification is completed.
• Full automation as a trial. For procedures with a higher degree of automation, suitability could be tested for no more than two years, on the condition that the Federal Office for Information Security has not excluded a security level comparable to that of the non-automated procedure, and that the procedure is not used for persons with indications of a higher money laundering risk.
• Sunset. The draft says it would lapse from the time when directly applicable European rules on due diligence and on identification procedures, including remote identification, become applicable.

The draft's own sunset clause points to the European text. The draft should be read for what the Ministry considered necessary in 2024, and not as a description of the law.

How the European rules will change the picture

Regulation (EU) 2024/1624 applies from 10 July 2027, with a later date of 10 July 2029 for two categories of obliged entities. Under its identification article, verification takes place through an identity document or through electronic identification means at assurance level substantial or high and relevant qualified trust services. The authority AMLA announced on 1 October 2026 that it had finalised standards on customer due diligence, including non-face-to-face verification and electronic identification, and had submitted them to the Commission. Its factsheet says that where an identity document cannot be submitted in a face-to-face context and the person has no access to electronic identification means or qualified trust services, an obliged entity can verify the identity through alternative solutions, provided they use reliable and independent information sources and include the safeguards listed in Article 7 of the standard. The factsheet adds that the standards remain subject to review by the Commission and become definitive only on publication in the Official Journal.

For a German firm the reading is therefore this. Until the European regulation applies, the Act and the circular describe the German position. From its application date the regulation applies directly, and the German draft ordinance says of itself that it would then lapse. The shape of the alternative routes after that date depends on the Commission's adoption of the standard, which this article does not predict. The wallet is a further route: the article on the European Digital Identity Wallet explains why a wallet presentation may become a verification route under the identification article.

Choosing a route today

The table sets out the routes for a natural person who is not present, as the Act and BaFin's notes describe them.

A few consequences follow for design.

• Video identification as described by the circular is a human process. A fully automated selfie-and-document flow is not described in it, and the draft ordinance would have treated full automation as a trial under review by the Federal Office for Information Security.
• A firm outside BaFin's supervision should ask its own supervisor whether it may rely on the circular, because the circular is addressed to the entities under BaFin's supervision.
• An outsourced identification is the firm's own measure, so contracts, sampling and reliability checks belong in the design.
• Records of the evidence behind each identification must be kept for the periods in section 8.

Questions to ask a provider

• Which of the routes in section 12 does the product use, and for each, which evidence does it keep?
• If the product claims to implement video identification, which employees carry out the live session, where are they, and how are they trained and tested?
• How are the recording, consent and retention handled, and in which jurisdiction is the recording stored?
• Does the process abort and switch to another route when quality fails, and how is that recorded?
• What is the position on automated checks, given that the interpretation notes name only the circular as the source of requirements?
• How will the provider adapt when the European regulation applies?

Where this sits in a verification flow

A flow built on NeuroVision KYC places the identity steps in one session: document, selfie, liveness and face match, with the scenario assembled in an editor. The individual steps are described on the document verification page. This article does not state that these steps meet the German requirements or that they replace a video identification session under the circular.

To see how these steps look in your own scenario, contact the team.

Sources

All sources were fetched on 28 October 2026.

• Geldwäschegesetz, sections 8, 11, 12, 13 and 17, Federal Ministry of Justice and Federal Office of Justice, gesetze-im-internet.de.
• Rundschreiben 3/2017 (GW) - Videoidentifizierungsverfahren, Federal Financial Supervisory Authority (BaFin), 10 April 2017.
• Ergebnis der Evaluierung des Videoidentifizierungsverfahrens i. S. d. Rundschreibens 3/2017 (GW), BaFin, 9 May 2022.
• Auslegungs- und Anwendungshinweise gemäß § 51 Abs. 8 Satz 1 GwG, BaFin, status July 2025.
• Verfügungen, Konsultationen & Verwaltungspraxis: Geldwäsche, BaFin.
• Referentenentwurf: Verordnung zur geldwäscherechtlichen Identifizierung durch Videoidentifizierung (GwVideoIdentV), Federal Ministry of Finance, processing status 20 March 2024, as published by the Bundessteuerberaterkammer.
• BSI TR-02102 Kryptographische Verfahren: Empfehlungen und Schlüssellängen, Federal Office for Information Security.
• Regulation (EU) 2024/1624 of 31 May 2024 on the prevention of the use of the financial system for money laundering or terrorist financing, Official Journal, 19 June 2024.
• Press release: AMLA finalises key standards for the private sector, Authority for Anti-Money Laundering and Countering the Financing of Terrorism, 1 October 2026.
• Factsheet on RTS on Customer Due Diligence under Article 28(1) of Regulation (EU) 2024/1624, Authority for Anti-Money Laundering and Countering the Financing of Terrorism.