On 18 April 2024, the Federal Ministry of Finance (BMF) published the draft of an ordinance on money laundering identification by video identification (Money Laundering Video Identification Ordinance – GwVideoIdentV) (“GwVideoIdentV-E”).
Table of Contents
Background
Creation of a legal basis for the use of the video identification procedure
The draft presented by the BMF is intended to put the video identification procedure, which has so far been accepted and regulated solely on the basis of administrative practice, for example by BaFin, on a legal footing. The basis for this is the authorisation to issue an ordinance in Section 13 (2) AMLA, which was only added to the AMLA with the amendment to the AMLA on 23 June 2017 and has remained unused to date. The Federal Ministry of Finance states that the video identification procedure is an established procedure that enables comprehensive remote identification as a “bridging technology” until the widespread introduction of (partially) automated procedures.
Definition of technical requirements
The requirements that providers of video identification procedures have to comply with are based in particular on Circular RS 3/2017 (GW) (“Circular Video Identification“), which BaFin published on 10 April 2017. Since then, the video identification procedure has been criticised, in particular due to a high-profile campaign by the Chaos Computer Club. As a result, gematik initially prohibited the use of the video identification procedure for the healthcare sector.
Content of the draft
Specification of the requirements for video identification procedures
The draft now defines legal standards for video identification procedures that must be met if the video identification procedure is to be used to fulfil the due diligence obligations under anti-money laundering law in accordance with sections 11-13 GwG. A legal presumption of suitability for identification applies to the procedure in question if the requirements are met (section 13 (2) no. 2 GwG).
The draft aims to transfer the existing regulations of the previous circular on video identification into a regulation that applies to all obligated parties “taking into account current security-specific findings“. The “Joint Release” Remote Identity Proofing published by the BSI in cooperation with the French Agence nationale de la sécurité des systèmes d’information Secrétariat général de la défense et de la sécurité nationale (ANSSI), which describes the main areas of attack and the technical protective measures, provides guidance on the background to the “current security-specific findings”.
In contrast to the previous BaFin circular on video identification, the draft regulation now divides video identification procedures into a “simple” video identification procedure and a partially automated video identification procedure. Semi-automated video identification procedures are video identification procedures in which partial steps are IT-based (Section 2 (2) GwVideoIdentV-E). Another new provision is that obliged entities who wish to enable remote identification by video identification procedure must also “offer a procedure for verifying an electronic proof of identity in accordance with Section 18 of the ID Card Act, Section 12 of the eID Card Act or Section 78 (5) of the Residence Act” for each identification process (Section 5 (2) GwVideoIdentV-E).
Legal basis for trialling fully automated processes
In addition, the draft regulation in Section 17 GwVideoIdentV-E contains the basis for testing fully automated procedures. The trial procedure is intended to determine whether the fully automated procedure “has a level of security that is equivalent to the non-automated video identification procedure” (Section 17 (1) sentence 2 GwVideoIdentV-E). Within the scope of application, only credit institutions or domestic branches or branches of foreign institutions (section 2 (1) no. 1 GwG) or third parties commissioned by such obliged entities can carry out such a test (section 17 (1) sentence 3 GwVideoIdentV-E).
Testing first requires that the BSI confirms in a summary review that a comparable level of security is not excluded (Section 17 (2) sentence 1 (Section 17 (1) sentence 2 GwVideoIdentV-E). In addition, such a fully automated procedure in testing may not be used to identify high-risk customers (Section 15 (2) GwG).
Criticism of the draft
During the consultation phase, the draft was criticised by various parties. For example, it was criticised that the competent supervisory authorities should be able to exclude the use of the video identification procedure as an “opt-out” for obliged entities under their supervision (Section 5 (1) GwVideoIdentV-E). It can also be criticised, for example, that identification using the video identification procedure should no longer be permitted if the identification had to be aborted (Section 13 (2) GwVideoIdentV-E). Such an interruption should be required, for example, if a visual check in accordance with the requirements of the AMLO-VIdentV-E is not possible, for example due to insufficient lighting conditions or “insufficient verbal communication with the person to be identified” (Section 13 para. 1 sentence 2 no. 1, 4 AMLO-VIdentV-E). It is not clear why the video identification procedure should no longer be permitted once the obstacles have been removed (e.g. by moving to another room).
Further procedure
The BMF is now analysing the comments received and will amend the draft ordinance if necessary. After adoption and publication in the Federal Law Gazette, the ordinance will then apply on the first day of the quarter following promulgation.
What impact does the draft have on obligated parties?
While the technical requirements primarily affect technical service providers that offer video identification procedures, the mandatory offer of alternative identification procedures is particularly relevant for obligated parties. Although the process of identification using the electronic ID card has been considered highly secure and theoretically available across the board for years, the process is only used sporadically as an identification method in practice. In this respect, the “semi-enforced” introduction could possibly lead to more widespread use. The comparatively inexpensive identification and the standardised database are likely to be of interest to obligated parties.
