Remote onboarding in Italy — the eleven-step script

Italy has the most prescriptive remote onboarding rules in the EU — an annexed procedure that scripts the video session step by step. Banca d’Italia’s Disposizioni on adeguata verifica of 30 July 2019 give firms two routes: a document-plus-corroboration route with three cumulative requirements, or the video-identification procedure in Allegato 3, which sets out eleven activities the session must include. The legal hook is Article 19(1)(a)(5) of Legislative Decree 231/2007, which tasks Banca d’Italia with identifying suitable forms and methods of remote acquisition of identification data.

1. Route one: copy plus corroboration plus policy

The first route has three cumulative limbs, and the third is the one that catches firms out:

• (a) Acquire the identification data of the customer and of the esecutore, and cross-check it against a copy of a valid identity document obtained by fax, post, electronic format or analogous means.
• (b) Carry out further checks beyond those in Section V, by the means most appropriate to the specific risk. The Disposizioni give examples: a welcome call to a fixed-line number; sending communications to a physical address with return receipt; a credit transfer made by the customer through a bank or financial intermediary based in Italy or in an EU country; requesting countersigned documentation; verifying residence, domicile or activity by enquiries to the competent offices or through on-site meetings using own or third-party staff.
• (c) Identify in the AML policy document the specific mechanisms the firm intends to use for the checks under (b), and set out the assessments carried out by the AML function on the risk profile of each mechanism and its security controls.

Innovative and reliable technological mechanisms — the Disposizioni cite biometric recognition as an example — may be used within the risk-based approach, provided they are supported by robust security controls. The text points firms to the European Supervisory Authorities’ opinion on the use of innovative solutions in the customer due diligence process, adopted on 23 January 2018.

2. Route two: the Allegato 3 video-identification procedure

As an alternative to the three limbs above, identification of a natural-person customer may be carried out digitally and remotely under the audio/video registration procedure in Allegato 3. Before the session begins, the firm must ensure the communication channel is encrypted using standard mechanisms, applications and up-to-date protocols, and that the applications used are oriented to usability and accessibility for the customer.

Three quality conditions govern the session itself:

The operator must refrain from starting the process, or suspend it, where audio/video quality is poor or considered inadequate to allow identification — and may exclude the admissibility of the session for any reason, including inadequacy of the document presented.

3. The eleven activities

The session must follow a written, formalised procedure providing for at least the following:

• the operator obtains consent to the video recording and to its retention, and informs the customer it will be kept securely;
• the operator states their own identity;
• the customer confirms their identification data;
• the customer confirms the date and time of the recording;
• the customer confirms the intention to establish the relationship and the data entered in the online pre-registration forms;
• the customer confirms their mobile number and email address;
• the operator sends a message the customer displays to the camera or reads back, and an email containing a verification link;
• the operator asks the customer to show the front and back of the identity document, ensuring the photograph is clearly visible and all information legible — personal data, document number, issue and expiry dates, issuing administration — and an electronic copy is taken;
• the operator asks to see the front and back of the health card bearing the customer’s codice fiscale;
• the operator asks the customer to perform one or more random actions to reinforce the authenticity of the exchange;
• the operator summarises the customer’s expressed intention and obtains confirmation.

The document itself must be a valid identity document issued by a public administration, bearing a recent and recognisable photograph and the holder’s handwritten signature, and the codice fiscale is verified via a valid health card. The session is recorded in its entirety and retained, and consent to processing the personal data in the recording must be obtained and reflected in the privacy notice.

4. When something does not add up

Where doubts, uncertainties or inconsistencies emerge in identifying the customer, firms must carry out further checks — and the Disposizioni give a concrete example: consulting the public system for the prevention of identity theft established by Legislative Decree No 64 of 11 April 2011. The documentation to be retained includes the information and documents collected during the registration activity, kept in line with the retention rules of the AML decree.

One further point worth carrying into product design: under the simplified due diligence measures in the same Disposizioni, firms may collect identification data before opening the relationship and postpone actual acquisition of the document copy for up to thirty days — and, for e-money instruments where the conditions in Article 23(3) of the AML decree are cumulatively met, beyond that. That is a separate relief from the remote-identification routes and should not be conflated with them.

FAQ

Related: Remote onboarding compared across the EU · The Italian AML framework · UIF anomaly indicators