Identity verification for fintech and neobanks

What fintech and neobanks ask of identity checks

A neobank has no branch to fall back on. Every customer arrives through a phone, the check is unattended, and the same flow has to stop forged documents, replayed selfies and people who open many accounts, without making honest users give up.

• Run the whole check in a browser on the customer's phone.
• Catch edited, copied and screen-displayed documents.
• Confirm that a live person took the selfie.
• Find duplicate and blocked people across earlier verifications.

The flow

1. Start. Your backend creates a session through the API. The customer continues in the web widget on a phone, or scans a QR code to move from a desktop to a phone.
2. Document. The customer photographs the document. The anti-fraud checks look for screen photos, photocopies, printouts, glued photos, drawn-on elements, erasures, edited images and logical data errors.
3. Selfie and active liveness. The selfie is matched to the document portrait and the customer moves the face through two ovals. Deepfake and face-swap detection runs inside the selfie and liveness steps.
4. Duplicates and blocklists. Repeat-user search looks for the same face among earlier verified users, and your own person lists and blocklists are checked in the same flow.
5. AML screening. Sanctions, PEP and adverse media screening runs in the same session when your scenario includes it.
6. Result. A webhook tells your backend the session is complete, and your product opens the features that match the result.

Modules used

• Web SDK and widget: your colours and logo on desktop and mobile browsers, in 29 interface languages.
• Document verification and face verification.
• Liveness: active, a movement challenge through two ovals.
• Repeat-user search and person lists, described on the face verification page.
• REST API and webhooks.
• AML screening, billed separately.

Regulatory frame

What the primary texts say about remote onboarding. The first five statements are from the European Banking Authority's guidelines on remote customer onboarding solutions. The last two are from the European Union's AML Regulation, which is forthcoming and applies from 10 July 2027.

• The EBA Guidelines on the use of Remote Customer Onboarding Solutions, EBA/GL/2022/15, are issued under Article 13(1) of Directive (EU) 2015/849 and apply from 2 October 2023.
• Where an institution accepts a reproduction of an original document, paragraph 33 says it should establish whether the reproduction has been displayed on a screen from a photograph or scan of the original, whether personal data or the customer's picture was altered or replaced, and, for a document issued with a machine-readable zone, the integrity of the algorithm used to generate the document's identification number.
• Paragraph 39 says that where biometric data is used, institutions should use strong and reliable algorithms to verify the match between the biometric data on the submitted identity document and the customer being onboarded, and apply additional controls where the solution does not give the required level of confidence.
• Paragraph 40 says that where the evidence is of insufficient quality, the individual remote onboarding process should be interrupted and restarted or redirected to a face-to-face verification.
• For unattended solutions, where the customer does not interact with an employee, paragraph 41 says institutions should ensure that photographs or video are taken at the time of the verification, perform liveness detection, and use strong and reliable algorithms to verify that the photograph or video matches the picture on the official document.
• From 10 July 2027, under Article 22(3) of Regulation (EU) 2024/1624, credit institutions and financial institutions obtain information to identify and verify the identity of the natural or legal persons using any virtual IBAN they issue, and the associated bank or payment account.
• From 10 July 2027, Article 79(1) of the same Regulation prohibits credit institutions, financial institutions and crypto-asset service providers from keeping anonymous bank and payment accounts, anonymous passbooks, anonymous safe-deposit boxes or anonymous crypto-asset accounts, as well as any account otherwise allowing for the anonymisation of the customer account holder or the anonymisation or increased obfuscation of transactions, including through anonymity-enhancing coins.

This block describes the texts, not our service. For information; not legal advice.

Sources

• European Banking Authority, Final Report, Guidelines on the use of Remote Customer Onboarding Solutions under Article 13(1) of Directive (EU) 2015/849 (EBA/GL/2022/15), fetched 27 October 2026.
• Regulation (EU) 2024/1624 of the European Parliament and of the Council, Official Journal text, fetched 26 October 2026.

Next

Try the interactive tour, compare with the bank flow, or read the quick start.