Switzerland's Revised Circular on Video and Online Identification

You lead compliance or product at a firm that onboards customers in Switzerland, and the Swiss financial supervisor has just revised its circular on video and online identification. The questions are specific: what did the supervisor announce, when does it take effect, and where does liveness detection enter an online identification flow? This article reports the supervisor's own press release and then explains, from other primary sources, what liveness detection is and how it is evaluated.

For information; not legal advice.

What was announced

On 8 October 2026 the Swiss Financial Market Supervisory Authority FINMA published a press release titled "FINMA adopts partially revised Circular 2016/7 'Video and online identification'". The release says the authority has partially revised its practice in the circular and has taken into account the latest technological developments, particularly with regard to the Federal Act on Electronic Identity Credentials and Other Electronic Credentials, the E-ID Act, which is due to come into force.

The circular, according to the release, sets out the authority's practice regarding due diligence obligations for client onboarding via digital channels. The partial revision takes particular account of the new E-ID Act and the associated introduction of electronic identity credentials.

The changes the release lists

The release names several changes.

The electronic identity credential, the e-ID, can be used for identification purposes when onboarding clients via digital channels under the Anti-Money Laundering Act.
Identification documents bearing a QR code, for example the Swiss driving licence, will be treated as equivalent to those with a machine readable zone, in addition to other selective adjustments.
Liveness detection is now to be introduced as an additional security measure for online identification, in order to address the growing risks associated with new technologies, particularly artificial intelligence.
Digital processes that reliably link the contracting party and its infrastructure to a place of residence are permitted for the purposes of place of residence verification as part of the online identification process.

The release also records that a public consultation was held and that the authority took into account several concerns raised during the consultation and implemented them in the circular. The changes enter into force on 1 November 2026.

The release page lists the circular itself, marked as valid from 1 November 2026 and available in German, French, Italian and English, together with the consultation report and explanatory notes, which are listed in German and French only. The circular's text could not be retrieved in a readable form for this review, so this article reports only what the press release says and does not describe how the circular requires liveness detection to be implemented. Read the circular itself before designing to it.

What liveness detection is

The US identity proofing guideline, Special Publication 800-63A-4, gives a definition that is useful as a reference point, though it is not a Swiss rule. Presentation attack detection is the automated determination of a presentation attack, meaning a presentation to the biometric data capture subsystem with the goal of interfering with the operation of the biometric system. A subset of those methods, liveness detection, involves the measurement and analysis of anatomical characteristics or voluntary or involuntary reactions to determine whether a biometric sample is being captured from a living subject that is present at the point of capture.

Two features of the definition matter for a design review. First, liveness is about the sample being captured from a living person who is present at the point of capture. It does not by itself say who the person is. Second, the methods can rely on voluntary reactions, which the person produces on request, such as movement, or on involuntary ones. The testing laboratory whose method is described in the companion article on presentation attack detection testing refers to an active liveness detector as one that elicits a voluntary response from the user.

Why the supervisor names the risk

The release ties liveness detection to the growing risks of new technologies, particularly artificial intelligence. Research gives a concrete picture of one such risk. A paper posted in October 2026 begins from the premise that remote identity verification assumes a camera stream shows a live person, yet public face-swap tools can replace that person before the stream reaches the verifier. Its authors evaluated randomized gesture challenges in 108 live sessions with six subjects, 24 impersonated identities and two face-swap tools injected through a virtual camera, and they conclude that challenge sets should be tested against current attack configurations.

The US guideline, for its part, notes that live document capture and presentation attack detection make the injection of viable forged media more challenging, but that even these mechanisms are not sufficient to address all possible cases of such attacks. See the companion article on presentation attacks, deepfakes and injection attacks for the control layers.

What testing evidence to ask a vendor for

The release does not say how liveness detection is to be evidenced, and the circular should be read for that. As reference points for the questions you put to a vendor, two other sources offer a vocabulary. The US guideline requires, for remote biometric collection, presentation attack detection that meets an impostor attack presentation accept rate below 0.07, with tests that conform to the 2023 edition of part 3 of the 30107 series, and periodic testing by independent entities such as laboratories or research institutions. The testing laboratory defines three levels, with allowed penetration or match rates of 0%, 1% and 5% for Levels 1, 2 and 3, and it caps the error rate for genuine users at 15%, or 10% for Level 3. A result is tied to one product version and one recorded device configuration, so a letter is a statement about what was tested and not about every release that follows. None of this is a Swiss requirement. It is a way to turn "we have liveness detection" into questions with answers: which attacks, which level, which version, which device, which error rates on genuine users.

Questions for a Swiss onboarding flow

Does the flow already include a liveness step, and what does it ask the person to do?
How is the step tested, against which attacks, and when was it last tested?
How do you handle documents that carry a QR code instead of, or as well as, a machine readable zone?
If the e-ID becomes an identification route, how will it sit beside the document route in your scenarios?
Who tracks the circular and the effective date of 1 November 2026 in your change process?

How NeuroVision fits

The liveness step of a NeuroVision verification session is active: the person moves the face closer through two ovals. The document step reads printed and handwritten text and the machine readable zone with its checksum. Deepfake and face-swap detection works inside the selfie and liveness steps.

To discuss your Swiss onboarding scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

FINMA adopts partially revised Circular 2016/7 "Video and online identification", press release of 8 October 2026, Swiss Financial Market Supervisory Authority FINMA.
Digital Identity Guidelines, Special Publication 800-63A-4, Identity Proofing and Enrollment, US National Institute of Standards and Technology.
Not All Challenges Are Equal: Evaluating Interactive Liveness Detection Against Real-Time Face Swaps, arXiv:2610.16417v1, Firc, Drtil, Perešíni, Šalko, Staněk and Malinka.
Presentation attack detection test methodology and confirmation letters, explanation page of the testing laboratory.