Digital Identity, Biometrics and Liveness Checks

1. Why This Topic Matters for the CAMS Exam and for AML Practice

Customer Due Diligence (CDD) begins with one deceptively simple question: is this person who they claim to be? Historically, financial institutions answered that question face to face, by inspecting a physical passport or driving licence across a branch counter. Today the overwhelming majority of account openings, payments onboarding, crypto exchange registrations and fintech sign-ups happen remotely, on a mobile phone, in minutes. This shift created a gap that criminals were quick to exploit: stolen identity documents, synthetic identities built from fragments of real data, deepfake videos and injected images designed to fool remote verification systems.

Digital identity, biometrics and liveness checks are the technological response to that gap. They matter to an AML professional for several reasons:

• They are the foundation of CDD. If identification and verification (ID&V) fails at onboarding, every downstream control (transaction monitoring, sanctions screening, suspicious activity reporting) is built on a false premise. Monitoring a criminal who is operating under a fabricated identity produces alerts about a person who does not exist.
• Regulators expect institutions to understand the technology they rely on. The Financial Action Task Force (FATF) published its Guidance on Digital Identity in March 2020, explicitly recognising that reliable, independent digital ID systems can satisfy Recommendation 10 (Customer Due Diligence). The guidance also made clear that non-face-to-face onboarding is no longer automatically higher risk if a robust digital ID system is used. Examiners test whether candidates understand this nuance.
• Fraud and money laundering converge here. Account takeover, mule recruitment, synthetic identity fraud and money laundering through newly opened accounts all depend on defeating onboarding controls. The CAMS exam increasingly frames questions around the intersection of fraud typologies and AML controls.
• It is a key element of the Data Onboarding and Screening Technology domain. The exam expects you to know not only what these tools do, but their limitations, the risks they introduce (privacy, bias, vendor dependence, spoofing) and how a risk-based approach governs their use.

2. What Is Digital Identity?

A digital identity is a set of electronically captured and stored attributes and credentials that uniquely identify a person and allow that person to be authenticated for online transactions. Following the FATF framework (which draws on the US NIST Special Publication 800-63 model), a digital ID system has three core components:

(a) Identity proofing and enrolment. This answers who are you? It involves collecting identity evidence (for example, a government-issued ID document, biometric data, and data from authoritative sources), validating that the evidence is genuine, verifying that it belongs to the person presenting it, and then enrolling the individual by binding the verified identity to one or more credentials (such as a password, device, or biometric template).

(b) Authentication. This answers are you the same person who enrolled? Each time the customer logs in or transacts, the system checks the credential presented against the one bound at enrolment. Authentication factors fall into three categories: something you know (PIN, password), something you have (phone, hardware token, smart card), and something you are (biometrics). Multi-factor authentication (MFA) combines two or more categories.

(c) Portability and interoperability (identity lifecycle management). This covers how the identity is maintained, updated, suspended, revoked and, in federated systems, reused across different relying parties. Examples include national eID schemes (such as India's Aadhaar, Estonia's e-ID, Singapore's Singpass), the EU's eIDAS framework and emerging bank-led federated identity schemes.

Assurance levels. Not all digital IDs are equally reliable. NIST 800-63 defines Identity Assurance Levels (IAL1 to IAL3) for the rigour of proofing, Authenticator Assurance Levels (AAL1 to AAL3) for the strength of authentication, and Federation Assurance Levels (FAL). eIDAS uses Low, Substantial and High. FATF recommends that institutions assess the assurance level of a digital ID system and match it to the ML/TF risk of the customer and product. A low-assurance self-asserted identity is appropriate only for very low-risk, low-value products; a high-risk customer requires high-assurance proofing.

3. What Are Biometrics?

Biometrics are measurable biological or behavioural characteristics that can be used to recognise an individual. They fall into two broad groups:

Physiological (physical) biometrics:
• Facial recognition (the most common in remote onboarding because it can be compared against the photo on an ID document)
• Fingerprint
• Iris and retina scanning
• Voice recognition (often classified as both physiological and behavioural)
• Palm or finger vein patterns

Behavioural biometrics:
• Typing rhythm and keystroke dynamics
• Mouse movement and touchscreen gestures (swipe pressure, angle, speed)
• Gait
• Device-handling patterns (how a phone is held, orientation)

Physiological biometrics are mainly used at onboarding (matching the live person to the document) and for step-up authentication. Behavioural biometrics are mainly used for continuous or passive authentication after login, detecting account takeover, bots and remote-access-tool sessions where the account is being operated by someone other than the genuine customer, which is a classic indicator of money mule activity.

Key technical concepts examiners expect you to recognise:
• Template: a mathematical representation of a biometric feature. Good systems store templates, not raw images, and encrypt them.
• False Acceptance Rate (FAR) / False Match Rate: how often an impostor is wrongly accepted. Too high a FAR is a security and AML failure.
• False Rejection Rate (FRR) / False Non-Match Rate: how often a genuine customer is wrongly rejected. Too high an FRR damages customer experience and can cause financial exclusion.
• Threshold tuning: there is always a trade-off between FAR and FRR; the risk-based approach determines where the threshold sits for different products.
• Demographic bias: some facial recognition algorithms perform worse for certain skin tones, ages or genders. Regulators (and the exam) treat this as a governance and fairness issue that institutions must test for and mitigate.

4. What Are Liveness Checks?

A biometric match alone proves only that the image presented matches the document photo. It does not prove a real, present human being is in front of the camera. A fraudster can hold up a printed photograph, play a video on a screen, wear a silicone mask or inject a deepfake video stream directly into the application. These are called presentation attacks (or spoofing) and injection attacks.

Liveness detection (formally, Presentation Attack Detection or PAD, governed by the international standard ISO/IEC 30107) is the technology that determines whether the biometric sample comes from a live human present at the point of capture. There are two main approaches:

Active liveness. The user is asked to perform a challenge-response action: blink, smile, turn the head, follow a dot on the screen, read random digits aloud. The system checks that the response is correct and natural. Advantages: intuitive, well understood. Disadvantages: higher friction and abandonment, can be defeated by sophisticated real-time deepfakes that mimic the requested movement, and accessibility challenges for some users.

Passive liveness. The user simply takes a selfie or short video while algorithms analyse texture, skin reflectance, micro-movements, depth cues, light reflection, moiré patterns from screens, and image artefacts, without any instruction to the user. Advantages: frictionless, harder for the attacker to know what is being tested. Disadvantages: relies heavily on algorithm quality and requires rigorous independent testing.

Many providers combine both, and add injection attack detection (checking the integrity of the camera feed, detecting virtual cameras and emulators) and device intelligence (jailbreak detection, device reputation, geolocation consistency) to close the gap that pure liveness cannot.

5. How It Works End to End: A Typical Remote Onboarding Journey

Step 1: Document capture. The customer photographs a government ID. Optical Character Recognition (OCR) extracts the data fields. Where the document has an NFC chip (ePassports, many national ID cards), the app reads the chip and cryptographically verifies the issuing authority's digital signature, which is far stronger than a photograph of the document.

Step 2: Document authentication. Algorithms check security features (holograms, fonts, machine-readable zone checksums, layout against a template library), detect tampering, screenshots or photocopies, and compare the document to known fraudulent document databases.

Step 3: Selfie and liveness. The customer takes a selfie or short video. Liveness detection confirms a live human. The face is converted to a template.

Step 4: Biometric matching. The selfie template is compared to the face image extracted from the document (and from the chip where available). A similarity score is generated and compared to the institution's threshold.

Step 5: Data corroboration. Extracted data (name, date of birth, address, ID number) is checked against authoritative or independent sources: credit bureaus, electoral rolls, government registries, utility and telecom data, bank account verification and, where permitted, the issuing authority. This is where digital ID moves from document verification to true identity verification.

Step 6: Screening. The verified identity is screened against sanctions lists, politically exposed person (PEP) lists and adverse media. Accurate identity data improves screening quality and reduces false positives, which is why this topic sits within the data onboarding and screening domain.

Step 7: Risk scoring and decisioning. Signals from every step (document confidence, match score, liveness score, device risk, data corroboration, screening results, geolocation, email and phone intelligence) feed a risk engine. Low-risk outcomes may be auto-approved; medium-risk cases go to a manual review queue; high-risk cases are declined or escalated for enhanced due diligence (EDD).

Step 8: Record keeping and audit trail. The institution retains the evidence (images or templates, scores, decisions, timestamps, reviewer notes) in line with record-keeping requirements (generally at least five years after the end of the relationship under FATF Recommendation 11). The audit trail must allow the institution to demonstrate to a regulator how and why it concluded the customer was verified.

Step 9: Ongoing authentication and monitoring. The enrolled biometric or device credential is reused for login and step-up authentication on high-risk actions (adding a payee, changing contact details, large transfers). Behavioural biometrics run continuously to flag anomalies that may indicate account takeover or a mule handing over credentials.

6. The Regulatory Framework You Must Know

FATF Recommendation 10 requires identification and verification of customer identity using reliable, independent source documents, data or information. The FATF Digital ID Guidance confirms that digital ID systems can meet this standard, provided the institution understands the system's assurance level and the risk-based approach is applied.

FATF Digital ID Guidance key messages:
• Non-face-to-face business relationships that rely on reliable, independent digital ID systems with appropriate risk mitigation may present a standard or even lower level of risk; they are not automatically higher risk.
• Institutions should take a decoupled approach: assess the reliability and independence of the digital ID system itself (its technology, governance, security and assurance levels), then determine whether it is appropriate for the ML/TF risk of the customer, product and jurisdiction.
• Governments are encouraged to set standards and assurance frameworks; institutions may rely on them where they exist.
• Digital ID can support financial inclusion by enabling lower-cost onboarding and simplified due diligence for low-risk customers.

FATF Recommendation 17 (Reliance on third parties) and Interpretive Note to R.10 are relevant when a bank relies on a third-party identity provider or another regulated institution. The ultimate responsibility for CDD always remains with the relying institution. Outsourcing to a vendor is a form of outsourcing, not a transfer of liability.

Regional examples:
• European Union: the AML Directives permit electronic identification means and trust services under the eIDAS Regulation as acceptable verification; the EU AML package and the European Digital Identity Wallet extend this. GDPR classifies biometric data used for unique identification as a special category of personal data requiring explicit consent or another lawful basis, strict purpose limitation, data minimisation and Data Protection Impact Assessments.
• United States: the Customer Identification Program (CIP) rules under the USA PATRIOT Act Section 326 allow documentary and non-documentary verification methods, which accommodates digital and biometric approaches. FinCEN and the federal banking agencies have encouraged responsible innovation. State biometric privacy laws (notably the Illinois Biometric Information Privacy Act, BIPA) impose consent and retention requirements and carry litigation risk.
• United Kingdom: the Joint Money Laundering Steering Group (JMLSG) guidance accepts electronic verification; the Money Laundering Regulations recognise electronic identification processes that are secure from fraud and misuse and provide an appropriate level of assurance.
• Asia and elsewhere: national eID systems (Aadhaar e-KYC in India, Singpass/MyInfo in Singapore, Hong Kong iAM Smart) are explicitly permitted for CDD by their regulators, often with transaction or balance caps for lower-assurance tiers.

7. Risks, Limitations and Red Flags

Candidates often lose marks by treating technology as a silver bullet. The exam expects balanced awareness of risk:

Spoofing and deepfakes. Generative AI has made realistic face swaps, synthetic voices and real-time video manipulation cheap. Liveness and injection detection must be continuously updated and independently tested (for example, against ISO/IEC 30107-3 by accredited laboratories).

Synthetic identity fraud. A fraudster combines a real identity number (often a child's or deceased person's) with fabricated names and dates to build a new persona over time. Document and selfie checks may pass if the fraudster obtains a genuine document fraudulently issued to the synthetic identity. Data corroboration against authoritative sources and velocity analysis (same device, phone or address linked to many applications) are the key mitigants.

Genuine document, wrong holder (impersonation). Biometric matching plus liveness is precisely the control for this risk.

Coercion and mule onboarding. A genuine person may pass every check while opening an account for a criminal controller. Technology cannot detect intent; behavioural signals, source of funds questions, network analysis and post-onboarding monitoring remain essential.

Data privacy and security. A compromised password can be reset; a compromised fingerprint cannot. Institutions must encrypt templates, minimise retention, obtain valid consent, conduct impact assessments and respond to data subject rights requests.

Bias and financial exclusion. Higher false rejection rates for certain demographics, people without smartphones, those with damaged fingerprints or facial differences, or people lacking standard documents can be excluded. The risk-based approach requires alternative verification routes.

Model risk and explainability. Machine-learning models drift, can be poorly calibrated and may be hard to explain to regulators. Model validation, threshold reviews, periodic testing with known attack samples and documented governance are expected.

Vendor and third-party risk. Due diligence on providers (certifications, penetration testing, data residency, subcontractors, financial stability, incident history), contractual audit rights, exit strategies and ongoing performance monitoring are mandatory elements of outsourcing governance.

Over-reliance and complacency. A passed liveness check verifies the person at that moment. It does not verify beneficial ownership, source of wealth, PEP status or the purpose of the relationship. Digital identity is one component of CDD, not a substitute for it.

Onboarding red flags that a well-designed system surfaces for AML teams: multiple applications from one device or IP address with different identities; selfie or document images that match previously declined applications; mismatch between declared country and device geolocation or SIM country; document data that does not corroborate with any independent source; use of emulators, virtual cameras or remote-access tools during onboarding; unusual time-of-day or velocity patterns; newly created email addresses and VoIP phone numbers.

8. Governance: What Good Looks Like

• A documented, board-approved policy that defines acceptable digital ID methods, assurance levels mapped to customer and product risk, and fallback procedures.
• A risk assessment of the digital ID solution itself (the FATF decoupled approach) covering technology, security, governance of the provider and reliance arrangements.
• Clear decision rules: what is auto-approved, what is referred, what is declined, and who has authority to override.
• Human review capacity trained to recognise manipulated documents and deepfake artefacts, with quality assurance sampling of auto-approved cases.
• Independent testing and validation of biometric and liveness performance (FAR, FRR, PAD error rates, demographic performance) at implementation and periodically thereafter.
• Data protection by design: minimisation, encryption, retention schedules, consent management, Data Protection Impact Assessment.
• Complete, retrievable audit trails to satisfy record-keeping obligations and regulatory inspections.
• Integration with sanctions, PEP and adverse media screening, transaction monitoring and fraud systems so onboarding signals inform the ongoing risk profile.
• Management information and metrics: pass rates, referral rates, fraud caught, false positives, abandonment rates, performance by segment, vendor SLA compliance.
• Three lines of defence oversight: first-line operations, second-line compliance and model risk, third-line internal audit.

9. Exam Tips: Answering Questions on Digital Identity, Biometrics and Liveness Checks

Tip 1: Default to the risk-based approach. CAMS is built on the FATF risk-based approach. When a question asks what an institution should do when adopting digital onboarding, the best answer almost always involves assessing the assurance level of the technology against the ML/TF risk of the customer, product, channel and geography, rather than applying one rigid rule to everyone or rejecting technology outright.

Tip 2: Remember the FATF position on non-face-to-face risk. A common trap answer states that remote onboarding is always high risk and always requires EDD. Under the FATF Digital ID Guidance, non-face-to-face relationships using reliable, independent digital ID systems with appropriate mitigants may be standard or even lower risk. Choose the answer that reflects this nuance.

Tip 3: Know the three components of a digital ID system. Identity proofing and enrolment; authentication; and portability or lifecycle management. If asked which stage establishes who the person is, the answer is identity proofing. If asked which stage confirms the returning user is the same person, the answer is authentication.

Tip 4: Distinguish verification of the document from verification of the person. Document authentication proves the document is genuine. Biometric face matching proves the person resembles the document photo. Liveness proves a real person is present. Data corroboration against independent sources proves the identity exists and is consistent. A strong answer recognises that all layers are needed; a weak answer treats any single one as sufficient.

Tip 5: Liveness answers the spoofing question. If a scenario describes fraudsters using printed photos, replayed videos, masks or deepfakes to pass facial recognition, the control being tested is liveness detection or presentation attack detection. If the scenario describes a feed being manipulated at the software level rather than in front of the camera, think injection attack detection and device integrity.

Tip 6: Active versus passive liveness. Active means the user performs a requested action (blink, turn, read digits). Passive means analysis happens silently on a normal selfie. Passive offers less friction; active is more intuitive but can be mimicked by real-time deepfakes. Questions about reducing customer abandonment while maintaining security point toward passive or combined approaches.

Tip 7: Physiological versus behavioural biometrics. Face, fingerprint, iris and voice are physiological and are used mainly at onboarding and step-up authentication. Typing cadence, swipe patterns and device handling are behavioural and are used for continuous authentication and detecting account takeover or mule handover after login. Match the biometric type to the use case described in the question.

Tip 8: FAR and FRR are a trade-off. If a question describes too many fraudsters getting through, the issue is the False Acceptance Rate and thresholds should be tightened. If genuine customers are being rejected or excluded, the issue is the False Rejection Rate. The correct answer typically recommends recalibrating thresholds based on risk, not abandoning the system.

Tip 9: Responsibility cannot be outsourced. When an institution uses a third-party identity provider or relies on another institution's CDD, the relying institution remains ultimately responsible for compliance. Expect answers involving vendor due diligence, contractual access to underlying CDD information, ongoing monitoring of the provider and immediate availability of identification data. Reject answers that suggest the vendor bears the regulatory liability.

Tip 10: Technology supplements CDD; it does not replace it. A passed liveness check does not identify beneficial owners, establish source of funds, determine PEP status or explain the purpose of the account. If an answer implies that biometric verification alone completes CDD, it is wrong.

Tip 11: Privacy and data protection are part of the compliance answer. Biometric data is sensitive or special-category personal data. Correct answers acknowledge consent or lawful basis, data minimisation, encryption of templates, retention limits and impact assessments alongside AML obligations. An answer that ignores privacy in favour of collecting as much biometric data as possible is usually a distractor.

Tip 12: Think about bias and inclusion. If a scenario mentions certain customer groups being disproportionately rejected, the correct response involves testing for demographic performance differences, providing alternative verification channels and documenting the rationale, consistent with FATF's financial inclusion objectives.

Tip 13: Record keeping and audit trail. Questions about what to retain or how to demonstrate compliance to a regulator are answered by: retain the evidence, scores, decisions and timestamps for the statutory period (at least five years after the relationship ends under FATF standards, longer where national law requires) and ensure it can be produced promptly.

Tip 14: Connect onboarding to screening and monitoring. Accurate, verified identity data improves sanctions and PEP screening match quality and feeds the customer risk profile used in transaction monitoring. If a question asks how digital onboarding affects downstream controls, point to improved data quality, reduced false positives and richer risk signals.

Tip 15: Use elimination on scenario questions. Eliminate answers that are absolute (always, never, only), that place liability on a vendor, that ignore risk assessment, that treat technology as infallible, or that disregard privacy. The remaining answer, which balances a documented risk assessment, layered controls, human oversight and regulatory alignment, is usually correct.

10. Quick Revision Summary

• Digital ID = proofing and enrolment + authentication + lifecycle/portability, measured by assurance levels (NIST IAL/AAL, eIDAS Low/Substantial/High).
• Biometrics = physiological (face, fingerprint, iris, voice) and behavioural (typing, gestures, device handling); stored as encrypted templates; performance measured by FAR and FRR.
• Liveness/PAD (ISO/IEC 30107) = active (challenge-response) or passive (silent analysis); defends against presentation attacks; complemented by injection-attack and device-integrity detection against deepfakes.
• End-to-end flow: document capture and authentication, selfie and liveness, biometric match, data corroboration, screening, risk-based decision, record keeping, ongoing authentication and monitoring.
• FATF Digital ID Guidance (2020): reliable digital ID can satisfy R.10; non-face-to-face is not automatically high risk; assess the system (decoupled approach) then apply the risk-based approach; supports financial inclusion.
• Reliance on third parties (R.17): ultimate responsibility stays with the institution.
• Key risks: spoofing and deepfakes, synthetic identity, mule onboarding, privacy and data security, bias and exclusion, model risk, vendor risk, over-reliance.
• Governance: policy, risk assessment of the technology, thresholds, human review, independent testing, privacy by design, audit trail, metrics, three lines of defence.

Master these points, apply the risk-based lens to every scenario, and you will be well positioned to answer any CAMS question on digital identity, biometrics and liveness checks with confidence.