Remote Video Identification: Assisted and Automated KYC Methods

Remote video identification lets a bank, trust service provider or regulated platform verify a new customer through a camera instead of a branch, and the camera is now the main attack surface. Two models dominate: attended sessions, where a trained operator runs a live video call, and unattended sessions, where software checks a document and a selfie video with no human present. This guide explains how ETSI TS 119 461 structures both, what the EBA remote onboarding guidelines and national schemes such as Germany's BaFin video identification circular require, and how to defend against presentation and injection attacks. It is written for identity architects, fraud and AML leads, and assessors who run or buy video KYC. For the wider proofing and KYC picture, see the Identity Proofing and KYC Guide; this page goes deeper on the video channel only.

Key takeaways

• ETSI TS 119 461 is the European reference. Version 2.1.1 (February 2025) defines Baseline and Extended levels of identity proofing and splits remote work into attended and unattended use cases: attended sessions run manually (Baseline only) or hybrid, and unattended sessions run manually (Baseline only), hybrid or fully automated.
• Attended and unattended carry different risks. Attended video adds a human who can spot behaviour and ask unpredictable questions, but can be socially engineered; unattended scales well but depends entirely on liveness, injection detection and document chip checks.
• Injection is now the threat to design for. ENISA reports that market players see injecting video straight into the capture feed as the most promising attack, and ETSI TS 119 461 names injection, including deepfakes, as a key concern.
• Testing deadlines are real. ETSI TS 119 461 requires an identity proofing service provider's presentation and injection attack detection to be tested by an independent accredited laboratory every second year, with the first test before the end of 2026.
• Regulators are prescriptive about the session. The EBA guidelines (applying from 2 October 2023) and the BaFin circular set rules on image quality, random actions, interruption, staff training and recording that you can audit against directly.

What it is and who it applies to

Remote video identification is identity proofing where the applicant and their identity evidence are captured through a camera on a device the provider does not control. It sits inside wider onboarding: the output is a verified identity bound to the applicant, which then gets an account, a certificate or a wallet credential.

ETSI TS 119 461 treats identity proofing as a trust service component that a trust service provider may run itself or subcontract to an IPSP. The specification states it is intended to be referenced by an implementing act under Article 24.1c of the amended eIDAS regulation. For the eIDAS background see the eIDAS Qualified Trust Services Guide.

NIST SP 800-63A-4 uses the same split under different words: remote unattended (fully automated, no agent) and remote attended (a secure video session with a proofing agent or trusted referee). The NIST SP 800-63A-4 Identity Proofing (IAL) Guide covers the US levels in full.

Structure and key requirements

ETSI TS 119 461 levels and process

The specification defines two Levels of Identity Proofing (LoIP). Baseline gives substantial confidence and supports qualified certificates under the original eIDAS Article 24.1. Extended gives high confidence and supports qualified certificates and qualified electronic attestations of attributes under the amended regulation. The risk assessment for Baseline must consider attackers with moderate attack potential; Extended must consider high attack potential.

Every use case is built from five tasks in clause 8: initiation (8.1), attribute and evidence collection (8.2), attribute and evidence validation (8.3), binding to applicant (8.4) and issuing of the identity proofing result (8.5). Binding covers face image capture, automated face biometrics and manual face verification.

Remote use cases

The specification notes that automated operation is not considered relevant for attended remote proofing, because a registration officer is needed to communicate, and that manual-only validation of a physical document or manual-only binding in unattended cases can reach only Baseline. Hybrid operation is strongly encouraged for physical document validation and binding.

Evidence rules

• Authoritative evidence: at least one of a physical identity document, a digital identity document, an eID means used in authentication, or a digital signature certificate.
• Digital identity documents: eMRTD documents under ICAO 9303 part 10 (the chip), or other digital documents of equivalent reliability (COL-8.2.3-06X).
• Supplementary evidence: trusted registers, proof of access such as a bank account, and attestations. It never stands alone.
• Minimum attributes: family and first names plus information that uniquely identifies the person (COL-8.2.2.1-02).

EBA and national rules

EBA/GL/2022/15 is technology neutral but specific about the session. Images, video and audio must be clear enough to recognise the customer, and the process must halt on technical faults or interruptions (paragraph 24). Unattended processes need liveness detection, active or passive, and strong matching against the document photo (paragraph 41). Attended processes need good image and audio, staff trained to detect deception and an interview guide (paragraph 42). Where possible the sequence of customer actions should be randomised and employees assigned at random (paragraph 43).

The BaFin circular, in force since 15 June 2017, is the most detailed national attended scheme. It requires trained staff in separate access-restricted premises, explicit logged consent, end-to-end encrypted real-time video following BSI TR-02102, checks of at least three randomly selected visible security features from different categories, tilting and covering movements by the applicant, varied interview questions, a centrally generated one-time TAN entered during the call, and full audio and video recording kept for five years. Germany is one example; other member states publish their own schemes, so check your national supervisor's current text.

Identity and NHI requirements

The identity question in video KYC is less about the human than about the machine path between camera and decision engine. Treat every element of that path as an identity that needs proving.

• Capture client integrity: NIST SP 800-63A-4 requires detection of virtual cameras, device emulators and jailbroken devices, and recommends device attestation or sensor authentication. ENISA recommends a dedicated app over a browser for the same reason.
• Protected channel: NIST requires authenticated protected channels for remote proofing data; EBA paragraph 51 asks for cryptography in line with best practice; BaFin names BSI TR-02102 for the video link.
• Service accounts and API keys: the vendor SDK, the document verification API and the case management system talk with credentials. Scope them per environment, store them in a secrets manager and rotate them. See the Secrets Management Guide.
• Operator accounts: registration officers and reviewers hold the power to approve an identity. Give them phishing-resistant MFA and session logging. See the Phishing-Resistant MFA Guide.
• Binding after proofing: the proofing result is only as good as the authenticator issued next. Bind the verified identity to a strong authenticator in the same session.
• AI agents: an agent must never complete video proofing on a person's behalf. Where an agent opens accounts or requests credentials, it should act under delegated, scoped authority from a person who has been proofed.

Implementation steps

1. Set the target level. Decide per product whether you need Baseline, Extended, an EBA-compliant AML onboarding, or a NIST IAL. This decides whether manual-only flows are acceptable.
2. Choose attended, unattended or both. Use the decision table below. Many providers run unattended as default and route failures and high-risk cases to an attended session.
3. Define accepted evidence. Prefer chip-enabled documents read over NFC. List accepted document types per country and keep a lost and stolen document check in the flow, as ENISA recommends.
4. Build the capture controls. Minimum resolution, frame rate and lighting checks; randomised challenges that change over time; virtual camera and emulator detection; session metadata capture such as IP, geolocation and VPN use (EBA paragraph 28).
5. Write the operator playbook. For attended flows: varied interview structure, plausibility questions, coercion checks, clear stop rules, and training before first shift and at least yearly (the BaFin minimum).
6. Pilot in shadow mode. Run the new flow alongside the existing one, compare decisions and measure false rejections by document type and demographic group before switching.
7. Red team the capture path. Commission presentation and injection testing before go-live; ETSI TS 119 461 expects accredited laboratory testing every second year.
8. Plan rollback. Keep the previous provider or an in-person route available. EBA paragraph 40 already expects redirection to face-to-face verification when evidence quality is poor.

Attended or unattended: decision guidance

Small firms almost always buy rather than build; their work is assessing the IPSP and keeping the evidence. Large institutions often run hybrid flows with their own risk engine and several providers. Our view at NHI Mgmt Group: do not use unattended manual review for any product that needs Extended or equivalent assurance, because the specification caps it at Baseline.

Evidence and assessment

ETSI TS 119 461 clause 8.5.2 requires evidence of the process so the outcome can be explained later. EBA paragraph 26 requires time-stamped, securely stored and retrievable records. BaFin requires full recording kept for five years.

Metrics to track

• Attack detection rate: confirmed presentation and injection attempts caught at capture, against those found later.
• False rejection rate by document type and demographic group: exposes bias and poor capture guidance.
• Early-life fraud rate: accounts flagged for fraud within 90 days of onboarding, by channel.
• Operator stop rate: share of attended sessions interrupted, and reasons.
• Escalation share: share of unattended sessions routed to manual review; a sudden rise often signals a new attack.

Mapping to other frameworks

Biometric testing maps to ISO/IEC 30107-3 for presentation attack detection and CEN TS 18099 for injection attack detection, both cited by ETSI TS 119 461. For PAD in depth see the Biometric Liveness and Presentation Attack Detection Guide.

Common pitfalls

• Browser-only capture with no injection controls: a browser cannot reliably tell a real camera from a virtual one. ENISA recommends a dedicated app and device sensor checks.
• Predictable challenges: fixed head-turn sequences can be pre-recorded or generated. EBA paragraph 43 and ENISA both call for randomisation that changes over time.
• Operators trained on documents but not deepfakes: NIST asks agents to spot latency, sync problems and inconsistent skin tone. Refresh training from threat intelligence, as ETSI OVR-5-09 requires. See the Deepfake-Resistant Identity Verification Guide.
• Ignoring the chip: optical checks on a chip-enabled passport leave the strongest evidence unused. Read and validate the chip signature where the document has one.
• No stop rule: operators under target pressure push through poor-quality sessions. EBA paragraph 24 and BaFin both require interruption.
• Treating the IPSP as a black box: outsourcing does not move accountability. EBA paragraph 48 expects monitoring, testing and notice of changes.

Practitioner checklist

• Record the target assurance level per product and confirm the chosen ETSI use case can reach it.
• Prefer NFC chip validation for documents that have a chip; list accepted documents per country.
• Require virtual camera, emulator and rooted device detection on every capture client.
• Randomise liveness challenges and operator interview order, and change them over time.
• Obtain the IPSP's latest independent PAD and injection test report and diary the next one.
• Train operators on documents, deepfake signs and coercion before first shift and at least yearly.
• Keep time-stamped recordings and decision logs for the retention period your regulator sets.
• Track false rejections by document type and demographic group and review them monthly.
• Protect operator and API credentials with phishing-resistant MFA and a secrets manager.

Standards and references

• ETSI: TS 119 461 V2.1.1 Policy and security requirements for trust service components providing identity proofing of trust service subjects
• European Banking Authority: Guidelines on the use of remote customer onboarding solutions (EBA/GL/2022/15)
• BaFin: Circular 3/2017 (GW) video identification procedures
• NIST: SP 800-63A-4 Identity Proofing and Enrollment
• ENISA: Remote Identity Proofing, Attacks and Countermeasures
• European Banking Authority: EBA publishes guidelines on remote customer onboarding

Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Biometric Liveness and Presentation Attack Detection Guide · eIDAS 2.0 and the European Digital Identity Framework Guide · Account Opening and Application Fraud Guide