Onboard customers remotely with your own procedure that withstands a request for information: choice of method, checks, retained evidence, audit report and real control over the technology provider.
Do you identify customers by video? Free review of your procedure
Tell us how you onboard your customers remotely and we will tell you what is missing for the procedure to be defensible before the supervisor.
Remote onboarding is not solved by buying software. These are the six pieces that turn your onboarding into a file that holds up.
We draft the document that describes your actual flow: the video method chosen, checks on the document and on the person, acceptance and rejection criteria, human intervention, incident handling and evidence retention. It is the document you will be asked for when someone asks how you identify customers.
Identification is the first step. We design the rest of the onboarding: purpose of the relationship, source of funds, risk profile, list screening and a documented decision. Video fits within the due diligence process; it does not replace it.
If your manual still describes in-person onboarding, the video procedure is born orphaned. We integrate it and keep it under version control.
Contract, access to evidence, audit rights, subcontracting and orderly exit. The task is outsourced; the responsibility is not.
Remote onboarding is the norm for exchanges and wallets. We adapt the procedure to the sector’s risk profile.
Simplified, standard or enhanced: which measures you apply to each profile and how you justify it in writing.
Four different entities with the same problem: digital customer acquisition moves faster than compliance documentation.
“We open accounts in minutes and it works. The problem came when they asked us for the procedure: we had screenshots of the product, not a document explaining what we check and who decides.”
“We were previously registered as an exchange and custody service provider. With the CASP license, onboarding stopped being a form and became a file we must be able to show.”
“In our authorization application we said how we would identify customers. Months later, our actual operations bore no resemblance to what we had described, and nobody had updated the procedure.”
“We hired a very well-known identity verification solution and assumed that this made us compliant. Nobody warned us that the procedure had to be our own and had to be audited.”
They are rarely technology failures. They are failures of documentation, internal governance and the contract with the provider: all three are detected in the first review.
Buying the tool and writing nothing down: the provider’s solution describes a product, not your operations. When the supervisor asks for “the procedure”, the vendor’s commercial documentation is not an acceptable answer.
Keeping the result but not the evidence: a record that says “verified” without the material that led to that conclusion makes it impossible to reconstruct anything. Evidence you cannot retrieve is as good as evidence that never existed.
Assuming the provider answers for you: you are the obliged entity. If the contract does not give you access to the evidence, audit rights and control over subcontracting, the third party’s failure is attributed to you.
| Identification method | What it involves | What you must be able to prove |
|---|---|---|
| Asynchronous video | The customer captures and sends the material; review and decision take place afterwards, with human intervention or with supervised automated controls. | A documented and audited procedure, the review criteria applied and the evidence that allows the check to be repeated. |
| Live video | An operator from the entity connects with the customer in real time and performs the checks during the video call. | A retained recording, a uniform script of checks, documented operator training and rejection criteria applied equally to everyone. |
| In-person identification | Face-to-face onboarding with the document shown in person and a record in the customer file. | A copy of the document, a record of the check and its integration into the same file, to the same standard as remote onboarding. |
We review your actual flow, choose with you the method that fits your volume and your risk, draft the procedure, organize the evidence and bring the provider contract up to standard. First consultation free of charge and a reply within 24 h.
Yes. Non-face-to-face identification is fully valid for the purposes of Law 10/2010 of April 28, provided you use an accepted method and have your own procedure behind it. In Spain, remote video identification methods are regulated by Order ETD/465/2021 of May 6.
The difference between an entity that has it sorted and one that does not rarely lies in the technology: it lies in whether there is a document describing the actual flow, whether the evidence is retained and whether someone controls what the provider does. That is exactly what is reviewed when the request for information arrives.
With live video, an operator from your entity connects with the customer in real time and performs the checks during the video call. You need staff available during the hours when you onboard customers, a uniform script and documented training for whoever handles the call.
With asynchronous video, the customer captures and sends the material and the review takes place afterwards. It scales much better, but it shifts the whole burden onto the procedure: how the review is done, who decides, what happens with doubtful cases and how a rejection is documented. The specific requirements for each method are set by Order ETD/465/2021: they are not improvised or copied from a competitor.
Order ETD/465/2021 does not merely describe acceptable technologies: it subjects the procedure to prior review by the competent anti-money laundering authority, with a scope that varies depending on the method you choose. Buying a solution and switching it on is not an option.
We will not give you a fixed timeframe, because it depends on the method, on the quality of your documentation and on the audit report that accompanies the procedure. What we do know from experience is that a generic procedure, one that does not describe the entity’s actual flow, drags out the process far more than any technical issue.
No. Hiring an identity verification provider takes care of execution, not compliance. Your entity is still the obliged entity, and the procedure has to be yours: your scope, your acceptance and rejection criteria, your human intervention, your retention policy and your internal governance.
The most expensive mistake we see is the entity that shows the vendor’s manual when asked for its procedure. That documentation describes a product; the supervisor asks about your operations. We explain how to hire and control a third party without being left exposed in outsourcing of AML/CFT functions.
At a minimum, everything that allows you to reconstruct the identification without bothering the customer again: the video or image material captured, the copy of the document, the result of the checks, the identification of who or what carried them out, the decision taken and the reasons for it, and the trail of failed attempts and rejections.
Retention is governed by the period set by anti-money laundering legislation, with guarantees of integrity and of retrieval in a readable format. And it is worth rehearsing: evidence that nobody can locate when an AML/CFT review arrives works, in practice, like evidence that does not exist.
You are. Responsibility for due diligence is not outsourced: the task is. That is why the contract with the provider is part of your AML/CFT file and not a matter solely for the procurement department.
It must give you access to the evidence at any time, audit rights, control over subcontracting, clear rules on data processing and data location, service continuity and an orderly exit if you change provider. If you are also within the scope of DORA (Regulation (EU) 2022/2554, applicable since January 2025), that contract includes mandatory clauses and the provider goes into your register of information on ICT third-party service providers.
No. Identifying means proving who that person is. Due diligence also includes understanding the purpose and intended nature of the relationship, the source of funds, the customer’s risk profile, list screening and subsequent monitoring of the customer’s activity.
We see entities with flawless remote onboarding that later cannot explain why they classified a customer as low risk. If the customer acts on behalf of someone else, or turns out to be a politically exposed person, enhanced measures come into play and the procedure has to provide for this.
Not on its own. Video identification covers the individual: who the person on the other side of the camera is. When your customer is a company, that video only identifies the authorized signatory, and the substantive work is different: up-to-date corporate documents, the signatory’s powers, the ownership chain and beneficial ownership.
We cover that part in KYB: verification of corporate customers. The boundary is clear: here we validate individual identities remotely; there, corporate structures.
The procedure has to say so. One of the issues that triggers the most requests for information is silence: documents that describe the flow with a Spanish national ID and say absolutely nothing about foreign documents, non-resident customers or jurisdictions subject to enhanced monitoring.
The solution is neither to prohibit everything nor to accept everything, but to set out in writing which documents you accept, which additional checks you require and in which cases onboarding goes to manual review or is escalated to the internal control body. A written criterion applied uniformly is defensible; a series of case-by-case decisions is not.
We do not start with the technology: we start with your actual onboarding and the risk you take on. The tool is chosen at the end, once we know what it has to do.
We map how you onboard today, what type of customer you acquire and in what volume. That determines the choice between asynchronous video and live video, which shapes staffing, hours, cost and the level of documentation required.
We draft the procedure with your operations built in: checks, rejection criteria, human intervention, incidents, roles and retention. It then goes through the audit report and the prior review required by Order ETD/465/2021.
Team training, a provider contract up to standard, periodic sampling of onboardings, rejection indicators and a review of the document every time you change tool, method or target market.
If you prefer us to handle it end to end, start with our anti-money laundering service or with a review of your AML/CFT manual, which is where the remote channel must fit.
The 10 elements of an AML/CFT system that can be defended before SEPBLAC, with the documentary evidence you must be able to show for each one. Use it as a self-assessment before an inspection arrives.
No spam. Your email is only used to send you this checklist and, occasionally, relevant regulatory updates.
The checklist is downloading now. If it does not start automatically, click here.
Need help implementing any of the steps after reading it? Write to us directly:
These terms will appear in your document, in the audit report and in the first request for information you receive. Using them precisely saves explanations.
Verification of the customer’s identity without the customer coming to a branch, using methods accepted by anti-money laundering legislation.
The customer records and sends the material; the entity reviews it afterwards and decides. It scales well, but it requires a very precise review and decision procedure.
An employee or agent of the entity performs the checks in real time during the connection with the customer.
Order ETD/465/2021 of May 6, which regulates remote video identification methods for the purposes of Law 10/2010.
The set of evidence associated with each customer: captured material, copy of the document, checks, decision and reasons.
Expert report that analyzes the remote identification procedure and accompanies its filing with the competent authority.
An entity included in the list in Article 2 of Law 10/2010, which bears the due diligence obligations before SEPBLAC.
A third party that provides the capture, biometric matching or document validation on behalf of the entity.
Person appointed by the obliged entity as the contact with SEPBLAC and responsible for the compliance of the AML/CFT system.
An approved document describing the entity’s actual remote identification flow, not the provider’s catalog.
A versioned and dated procedure, with an approval resolution from the competent body and change control.
A clearly defined video method and checks applied uniformly to all customers in the channel.
Script of checks, acceptance and rejection criteria, and a log of decisions on doubtful cases.
Ability to reconstruct any specific onboarding and to deliver the complete file when requested.
Captured material, copy of the document, results of the checks, timestamps and retention policy.
External review of the procedure before go-live and whenever the flow changes significantly.
Audit report, action plan on the findings and proof that they have actually been closed.
Effective control over the third party that performs the verification, with access to information and real oversight capacity.
Contract with audit and subcontracting clauses, service reports and a log of incidents handled.
If you recognize yourself in two or more, review the procedure before someone else does.
The video identification procedure is not the same for an exchange as for a payment institution, or for a high-risk customer. These pages cover the adjacent scenarios that usually come up in the same project: sector, license, outsourcing and customers who require enhanced measures.
Fully digital onboarding, international customers and traceability of funds: the remote channel with the highest bar.
The identification procedure is part of what you describe to the supervisor and of what you then have to comply with.
What you can delegate to a third party, what contract you need and what remains yours no matter what.
Customers and activities that require going beyond standard onboarding: what you add and how you document it.
If what you need is to put the whole system in order, start with our anti-money laundering service, review your AML/CFT manual and check how your onboarding fits into the AML and KYC process.
Explain your remote onboarding flow to us and we will tell you what to document, what evidence to keep and what to require from your verification provider.
Last updated: August 4, 2026
Onboarding a customer without having them in front of you is now standard practice in digital banking, payment institutions, CASPs and insurance, but it is still an act of due diligence subject to Law 10/2010 of April 28 on the prevention of money laundering and terrorist financing and its implementing regulation, Royal Decree 304/2014. In Spain, remote video identification methods are regulated by Order ETD/465/2021 of May 6. The practical consequence is uncomfortable for many product teams: what is reviewed is not your app, but the procedure behind it and the evidence you have managed to retain.
Order ETD/465/2021 provides for identification by live video and by asynchronous video, and the choice is not a technical detail: it reorganizes your entity. With live video, an operator connects with the customer in real time and performs the checks during the video call. That means staff available during the hours when you onboard customers, a uniform script so that two operators do not apply different criteria, documented training and a recording that is retained. It is a demanding method in terms of headcount, but relatively simple to explain: there is a person who looks and decides.
With asynchronous video, the customer captures and sends the material and the review takes place afterwards, with human intervention, with supervised automated controls or with a combination of both. It scales infinitely better and it is what powers onboarding in minutes, but it shifts the whole burden onto paper: how the review is done, against what criteria, who decides in doubtful cases, what happens when the system returns an ambiguous result and how a rejection is documented. The specific requirements for each method are set by the Order itself, and there is no room for creativity there. What we do decide with you is which method fits your volume, your type of customer and your actual review capacity, because choosing the wrong method is paid for every day in a queue of pending onboardings. You can see how this piece fits into the complete AML and KYC process.
The most common failure in this area is confusing the technology solution with compliance. The entity hires a reputable identity verification provider, integrates it, starts onboarding customers and assumes the matter is settled. Months later a review arrives, someone asks for “the non-face-to-face identification procedure” and what is handed over is the vendor’s commercial documentation. That document describes a product; nobody asked about the product.
Your procedure must describe your operations: the scope and type of customer accepted through the channel, the video method chosen, the documents you accept, the checks performed on the document and on the person, acceptance criteria, rejection criteria, escalation cases, who is involved and with what autonomy to decide, incident handling, the evidence retention policy, training of the staff involved and periodic review. It must be approved, dated and versioned, and it must fit with the rest of the system: with the AML/CFT manual, with the entity’s risk self-assessment and with the functions of the internal control body. A procedure that does not resemble what the entity actually does is worse than having none: it proves in writing that you knew what had to be done and did something else.
The question that drives all this work is simple: if tomorrow you are asked for the file of a specific customer onboarded some time ago, can you reconstruct the complete identification without contacting them again? If the answer is no, you have a problem, however good your technology is.
A complete remote identification file includes the video or image material captured, the copy of the document presented, the result of each check performed, the identification of who or what carried it out, the date and time, the final decision and the reasons for it, and the trail of failed attempts, retries and previous rejections of the same applicant. All of it retained for the period set by anti-money laundering legislation, with guarantees of integrity (nobody can alter it without leaving a trace) and retrievability in a readable format. It is worth rehearsing the handover before you are asked for it: extract a sample file, time how long it takes and check whether the provider delivers what it says it delivers. And remember that identification does not exhaust due diligence: the purpose of the relationship, the source of funds and the risk profile are part of the same file, as we explain in due diligence for anti-money laundering.
Practically no entity develops biometric capture and document validation in-house, and there is no need to. What cannot be outsourced is the responsibility: under Law 10/2010 your entity remains the obliged entity, and the third party’s failure is attributed to you. That is why the contract with the technology provider is part of the compliance file and is not a matter that procurement and the technical team can close on their own.
The points we always review: access to the evidence at any time and also when the relationship ends, effective audit rights, control over chain subcontracting, data location and processing (we are talking about biometric data, with everything that implies in terms of data protection), service levels, incident notification and an exit strategy that does not leave you without your history if you change provider. And a detail that is always forgotten: what happens to the evidence of customers already identified on the day you terminate the contract, because your obligation to retain it does not end when the commercial relationship with the third party ends. If your entity is within the scope of DORA, Regulation (EU) 2022/2554, applicable since January 2025, that contract also includes mandatory clauses and the provider must appear in the register of information on ICT third-party service providers: we cover this in DORA services and in AML/CFT outsourcing.
A well-built remote identification procedure takes care of the front door, but the relationship with the customer lasts for years and the risk changes. The same document that describes how you identify must connect with what happens afterwards: classifying the customer into a risk level, the measures applied at each level, screening against sanctions lists and ongoing monitoring of activity. An entity that identifies flawlessly and then reviews nothing has the same problem, only discovered later and with more customers inside.
There are three cases you should have settled in writing from day one. First, the customer who turns out to be a politically exposed person, or who has someone close to them who is one: standard onboarding is not enough there. Second, the customer who acts on behalf of a third party, which requires you to identify that person as well. And third, the profiles and jurisdictions that trigger enhanced measures, where the procedure must state what additional information is requested and who approves the relationship. Add to this the European horizon: the EU AML package (Regulation (EU) 2024/1624, Directive (EU) 2024/1640 and the new AMLA authority) is moving forward with phased application and will harmonize due diligence, including remote identification. If you are redesigning your onboarding now, do it with that scenario in mind.
This content is for general information purposes only and does not constitute legal advice. The legislation cited may have been amended after the update date shown: always check the version in force or contact us to analyze your specific case.
Key legislation, linked to the official text:
Legislation and links reviewed in .