Many who are obliged persons pursuant to the German anti-money laundering law (GwG) are hoping that it will soon be possible to identify natural persons in a user-friendly and resource-saving online process. This could be made possible by the Federal Ministry of Finance (BMF) if it were to issue a corresponding legal ordinance.
The current legal status of online identification
According to the current legal status, natural persons can only be identified in the following ways (Section 13 (1) GwG):
- On-site by presenting an identification document.
- Through an equivalent procedure that is just as safe as on-site checks.
The following procedures are recognized as equivalent procedures in accordance with BaFin’s guidance notes with regard to the interpretation of the GwG:
- By electronic identity card (e.g. ID card, e-ID card)
However, for this process, the eID function must be activated on the relevant document, which is very often not the case. Thus, this procedure is hardly ever used in practice.
- By electronic signature with a reference transfer from an account identified at EU level The reference transaction makes this quite a cumbersome process and in addition, an electronic signature often requires on-site identification as well, so nothing is gained.
- By notified electronic identification system (this would be the identity card again)
- Video ident in accordance with the requirements set out in BaFin Circular 3/2017 (GW) dated 10. 4. 2017
In concrete terms, this means that, with the exception of the video ident procedure, there are no widespread and user-friendly options for online identification in Germany to date.
Other procedures are currently not recognized as equivalent by BaFin. However, they could be recognized if the BMF were to permit them by means of an ordinance pursuant to Section 13 (2) GwG. Unfortunately, no ordinance has been issued to date.
The new sandbox of money laundering
What is new is that the BMF may approve a new procedure (for example, an AI-based verification of documents with life-detection) on a trial basis. Such a “sandbox” option, i.e. the testing of procedures on a trial basis, is common in other countries, but a novelty for Germany. The sandbox for money laundering was newly included in the law in summer 2021 by a proposal of the Finance Committee (BT-Drs. 19/30443, p. 66). The latter justified the inclusion as follows:
“Specifically, the ordinance authorization is now also intended to allow corresponding procedures, whose basic principles and security requirements have not yet been comprehensively regulated, to be tested in the area of identification under money laundering law. (…) In order to ensure a sufficient level of security during the trial period and to obtain information on the effectiveness of the procedure, the approval by the supervisory authority is to be subject to ancillary provisions, the key points of which will be laid down in the ordinance. For example, the obligated party may be required to offer not only the procedure to be tested but also another, already approved procedure for identity verification, such as identity verification using electronic proof of identity.”
Pursuant to Section 13 (2) sentence 3 GwG, approval of a new procedure in a trial phase, once the ordinance has been issued, will only be possible for electronic systems if the Federal Office for Information Security has previously tested the procedure for the necessary security. Providers of new procedures therefore face a rather time-consuming process. It is therefore all the more important that the Federal Ministry of Finance soon creates the legal basis for this with the ordinance.
Effects on previously approved procedures
If the BMF creates a new regulation, it can be assumed that the video identification procedure will also be newly regulated. This is because the approval of this procedure on the basis of the BaFin circular is on thin ice from a legal point of view, because an ordinance is required for the approval of new procedures. The Finance Committee has also seen this and states:
“When exercising the power to issue ordinances to regulate further identification procedures, the video identification procedure previously approved by way of the circular issued by the Federal Financial Supervisory Authority must also be regulated as a suitable procedure for identification under money laundering law for reasons of legal systematics.”
Should the ordinance come into force, it is to be hoped that the already complex video identification procedure will not become even more complex.
The legislator should always keep in mind that the standard of equivalence is the on-site inspection, which is by no means reliable and error-free because hardly anyone is really able to recognize and check the security features of different ID cards from 190 countries. Ultimately, AI-supported processes are better here, but unfortunately not yet approved.
Waiting for the EUid?
According to the explanatory statement of the Finance Committee, the declared aim of the introduction of the sandbox is to support the digitization strategy of the Federal Republic of Germany. The idea is to create an ecosystem for digital proofs of identity that, based on the principle of self-sovereign identity, which provides users with control over their proofs of identity. This sounds a lot like the introduction of the EUid wallet planned at the EU level, which will create a European digital identity. Unfortunately, this project will take a long time to materialize because the infrastructure and acceptance have yet to be created. In addition, the EUid does not help with the identification of EU foreigners. It is, therefore, to be hoped that regulation will come before then to enable other solutions.
Just do it?
The introduction of new procedures by an obliged person without prior approval on the basis of a regulation entails some risks. A violation of Section 13 GwG is in fact subject to a fine pursuant to Section 56 GwG.
Conclusion
The sandbox is there, but the moulds are missing. Mr. Lindner, please take over!
Topic related articles
Draft Guidelines on remote customer onboarding – EBA to set common EU standards
Anti-Money Laundering 3.0: The Anti-Money Laundering Regulation, AMLA and the 6th AML Directive
