Question 1

Watch List

Accepted Answer

Watch list screening involves checking individuals or entities against official lists maintained by governments, regulatory bodies, or international organizations that flag those associated with financial crime, terrorism, corruption, or other high-risk activities. These lists can include sanctions lists, PEP lists, Interpol red notices, and law enforcement watch lists. Watch list screening is a core part of KYC and AML processes, helping organizations identify and mitigate risk, avoid regulatory violations, and ensure they are not doing business with prohibited or high-risk parties.

Question 2

What is AML

Accepted Answer

AML stands for Anti-Money Laundering.

It is the umbrella term for the laws, regulations, and procedures aimed to stop criminals from disguising illegally obtained funds as legitimate income.

The goal of AML is to detect and report suspicious activity, thereby combating:
Money laundering
Terrorist financing
Fraud

KYC (Know Your Customer) is the most important component of the overall AML framework.

Question 3

What is KYC

Accepted Answer

KYC stands for Know Your Customer (or Know Your Client).
It is a regulatory process that requires businesses—especially financial and high-value institutions—to verify the identity of their clients and assess their potential risk of involvement in illicit activities.

3 Essential Components of the KYC Process

The entire process is built on three mandatory pillars, often mandated by global standards like the FATF (Financial Action Task Force):

Customer Identification Program (CIP): The initial step of collecting and verifying the customer's identity information. Mostly by analysing the government issued document.
Customer Due Diligence (CDD): The ongoing process of understanding the customer's background, financial activities, and transaction patterns to establish a risk profile.
Ongoing Monitoring: Continuous screening of the customer and their transactions to detect and report any unusual or suspicious activities. High-risk customers require Enhanced Due Diligence (EDD).

Industries Where KYC is Mandated

The requirement for KYC has expanded far beyond traditional banking to any sector at risk of being exploited for financial crime: 
Financial Services
Cryptocurrency Exchanges
Real Estate
Luxury Goods Dealers
Professional Services like Law and Accounting firms
Gambling and Betting

In short: KYC is the legal requirement to know who you are doing business with to prevent crime.

Question 4

Video KYC (vKYC)

Accepted Answer

A remote KYC process that uses video conferencing to verify a customer's identity.

Question 5

Synthetic Identity Fraud

Accepted Answer

Synthetic identity fraud occurs when a fraudster creates a fake identity by combining real and fabricated information, such as a legitimate Social Security number (often from a minor or deceased individual) with a false name, date of birth, and address. Unlike identity theft, where an existing person's identity is stolen, synthetic fraud creates an entirely new persona that appears legitimate to systems and institutions.

🧠 Why It’s a Growing Threat
Synthetic identities can bypass traditional fraud detection methods, especially during digital onboarding, because they don’t raise immediate red flags. Fraudsters often nurture synthetic profiles over time, building up credit histories or user trust, before executing large-scale fraud or "bust-out" schemes—leaving financial institutions with major losses.

🛡️ Detection and Prevention
Combating synthetic identity fraud requires:
Advanced identity verification tools, including biometrics and liveness detection
Cross-checking data across multiple data sources and databases
Use of AI and machine learning to detect anomalies and suspicious behavior patterns

📍 Industries Most Affected
Banking & Fintech: Credit card fraud, loan scams
Telecommunications: Fake accounts used for service abuse
Healthcare: Fraudulent insurance claims and benefits access

🌐 Compliance and Regulation
While synthetic fraud is not always explicitly addressed in regulations, preventing it is essential for meeting AML, KYC, and data protection obligations (e.g., GDPR, FinCEN, FATF guidelines).

Question 6

Spoofing

Accepted Answer

An attempt to impersonate someone or something else, often to gain unauthorized access or commit fraud.

Question 7

Sanctions Screening

Accepted Answer

Sanctions scanning is the process of checking individuals, businesses, or entities against national and international sanctions lists to ensure they are not subject to economic or legal restrictions. This helps organizations comply with regulations by preventing transactions with sanctioned parties, which could lead to fines or reputational damage. It’s a key component of AML and KYC procedures, often integrated into onboarding and ongoing monitoring systems.

Question 8

Privacy-Enhancing Technologies (PETs)

Accepted Answer

A Politically Exposed Person (PEP) is an individual who holds—or has held—a prominent public role, such as a head of state, senior politician, judge, military official, or executive in a state-owned enterprise. Due to their influence, access to public funds, and decision-making power, PEPs are considered to present a higher risk for potential involvement in corruption, bribery, money laundering, or other financial crimes.

🔍 Why PEP Screening Matters

Financial institutions and regulated entities are required under KYC and AML laws to identify PEPs and apply enhanced due diligence (EDD) when onboarding or transacting with them. This may include source-of-funds checks, ongoing monitoring, and screening of associated individuals such as family members and close associates, who may also pose elevated risk.

🌍 Global Compliance Requirements

FATF guidelines mandate risk-based controls for PEPs, both domestic and foreign.
The EU AML Directives, FinCEN (U.S.), and other global regulators require PEP identification and monitoring as part of standard AML compliance.
Some jurisdictions distinguish between foreign PEPs, domestic PEPs, and international organization PEPs (e.g., UN officials).

PEP screening is a core component of effective fraud prevention, risk management, and regulatory compliance in financial services and identity verification systems.

Question 9

PEP (Politically Exposed Person)

Accepted Answer

An individual who holds a prominent public function and is therefore considered to be at higher risk of involvement in bribery and corruption.

Question 10

Personally Identifiable Information (PII)

Accepted Answer

Any data that could potentially identify a specific individual.

Under the General Data Protection Regulation (GDPR), Personally Identifiable Information (PII) is referred to as “personal data.” GDPR defines personal data as:

“Any information relating to an identified or identifiable natural person (‘data subject’)” (Article 4(1), GDPR)

An identifiable person is one who can be directly or indirectly identified, particularly by reference to an identifier such as:
A name
An identification number
Location data
An online identifier (like an IP address or cookie ID)
Or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

🛡️ Examples of PII under GDPR include:
Full name
Email address
Passport or ID number
Phone number
IP address (in some contexts)
Biometric data (e.g., facial images, fingerprints)
Health and financial data

GDPR places additional protection on “special categories of personal data”, including racial or ethnic origin, political opinions, religious beliefs, genetic data, and biometric data used for identification purposes—which are highly relevant in identity verification.

Question 11

Optical Character Recognition (OCR)

Accepted Answer

Optical Character Recognition (OCR) is a technology that converts text from scanned documents, images, or ID cards into machine-readable data. In identity verification, OCR is used to extract information like names, dates of birth, and document numbers from passports, driver's licenses, and other official IDs. This enables automated form filling, faster onboarding, and improved data accuracy. Advanced OCR systems often include error correction and support for multiple languages and document formats.

Question 12

NFC (Near-Field Communication)

Accepted Answer

A short-range wireless technology that enables communication between devices, often used for contactless identity verification (e.g., reading data from e-passports).

Question 13

MiCA (Markets in Crypto-Assets)

Accepted Answer

MiCA is a comprehensive regulatory framework introduced by the European Union to govern the issuance, trading, and provision of services related to crypto-assets across EU member states. Officially adopted in 2023 and set to come into full effect in 2024–2025, MiCA aims to create legal certainty, protect consumers, and combat financial crimes such as money laundering and market manipulation in the rapidly evolving crypto industry.

📘 Scope of MiCA

MiCA applies to:
Crypto-asset issuers (e.g., stablecoin projects)
Crypto-asset service providers (CASPs) such as exchanges, wallets, and trading platforms
Token types not already regulated under EU financial laws (e.g., utility tokens, certain stablecoins)
It does not cover NFTs (unless part of a broader offering) or DeFi protocols—though these may be addressed in future legislation.

🧾 Key Requirements Under MiCA

✅ Authorization for Crypto Service Providers
CASPs must obtain a license from a national competent authority (e.g., BaFin in Germany or AMF in France) to operate within the EU. They are required to maintain operational resilience, cybersecurity standards, and complaint-handling systems.

✅ Whitepaper & Disclosure Rules for Issuers
Crypto-asset issuers must publish a whitepaper with clear information about the project, underlying technology, risks, and rights. This must be submitted to the regulator for approval or notification.

✅ Capital & Governance Requirements
CASPs and issuers must meet minimum capital thresholds, establish clear governance structures, and ensure segregation of client assets from operational funds.

✅ Anti-Money Laundering (AML) Alignment
While MiCA does not directly implement AML rules, it complements the EU’s AMLD framework by requiring service providers to implement strong identity verification (KYC) and fraud prevention practices.

🔐 MiCA & Identity Verification
Under MiCA, crypto service providers are obligated to:
Implement robust KYC processes
Conduct customer due diligence (CDD), especially for high-risk transactions
Store and secure user data in compliance with GDPR
These requirements aim to mitigate financial crime and build trust in the digital asset space.

🌍 Why MiCA Matters
Harmonizes regulation across all 27 EU member states, creating a single crypto market.
Enhances consumer protection and investor confidence.
Sets a potential global benchmark for regulating crypto-assets and related identity practices.

📅 Timeline
Adopted: April 2023
Enforceable from:
June 2024 for stablecoin-related rules
December 2024 for CASP licensing and full regulatory compliance

Question 14

Multi-Factor Authentication (MFA)

Accepted Answer

Multi-factor authentication (MFA) is a security method that requires users to verify their identity using two or more distinct types of credentials, such as a password, a smartphone notification, or a fingerprint scan. It adds an extra layer of protection by combining something the user knows, has, or is, reducing the risk of unauthorized access.

Question 15

Liveness Detection

Accepted Answer

Liveness detection is a biometric security feature that ensures the person being verified is physically present, not a spoof (e.g., photo, video, or deepfake). It’s commonly used in facial recognition and selfie-based identity verification. Techniques include detecting natural movements, texture analysis, or requiring user interaction like blinking or head turns. This helps prevent identity fraud and strengthens trust in remote onboarding.

Question 16

KYC (Know Your Customer)

Accepted Answer

Know Your Customer (KYC) is a regulatory and business process used to verify the identity of clients, assess risk, and ensure compliance with anti-money laundering (AML), counter-terrorism financing (CTF), and fraud prevention laws. KYC is mandatory for financial institutions and increasingly adopted across fintech, crypto, gaming, insurance, and telecommunications to prevent illegal activities and maintain trust.

🧾 Key Components of KYC

✅ Customer Identification Program (CIP)
Collects and verifies personally identifiable information (PII) such as name, date of birth, address, and ID number.
Requires proof of identity (e.g., passport, driver's license) and sometimes a selfie or video for biometric matching.

✅ Customer Due Diligence (CDD)
Involves assessing the customer’s background, financial behavior, and risk profile.
Low-risk customers undergo standard CDD, while higher-risk profiles require enhanced due diligence (EDD).

✅ Ongoing Monitoring
Transactions are monitored continuously to detect suspicious or unusual behavior.
Includes regular KYC updates, especially when a customer’s profile changes or triggers alerts.

🌍 Global KYC Regulations

🇪🇺 European Union
Governed under AMLD (Anti-Money Laundering Directives), particularly 4AMLD, 5AMLD, and 6AMLD.
KYC is a legal obligation for banks, crypto platforms, and other regulated entities.
Includes verifying beneficial ownership, PEP screening, and watchlist checks.

🇺🇸 United States
KYC is enforced through the Bank Secrecy Act (BSA) and the USA PATRIOT Act.
Financial institutions must maintain a Customer Identification Program (CIP) and perform ongoing due diligence.
Regulated by FinCEN and other U.S. regulatory agencies.

🇬🇧 United Kingdom
Enforced under the Money Laundering Regulations 2017 and updated post-Brexit.
Obligates KYC for banks, estate agents, accountants, and others handling high-risk transactions.
Supervised by FCA, HMRC, and NCA.

🌏 Other Jurisdictions
Canada: KYC required under FINTRAC’s AML regime.
Singapore: KYC obligations enforced by MAS, especially for fintech and crypto sectors.
Australia: Governed by AUSTRAC under the AML/CTF Act.
UAE, Brazil, India: Local regulators enforce sector-specific KYC laws, especially in finance and telecom.

🧠 Technologies Supporting KYC
eKYC (Electronic KYC): Fully digital KYC process using OCR, facial recognition, and automated checks.
Liveness Detection: Prevents spoofing in biometric verification.
PEP & Sanctions Screening: Identifies high-risk individuals or prohibited entities.
Data Extraction & Validation: Automates form-filling and document verification for efficiency.

🎯 Why KYC Matters
Prevents identity fraud, money laundering, and terrorist financing.
Builds trust between service providers and customers.
Ensures compliance with local and international regulations.

Question 17

Identity Verification

Accepted Answer

Identity verification is the process of confirming that an individual’s claimed identity matches their real-world identity. This typically involves checking government-issued documents, biometric data, or trusted digital credentials. It's a key step in preventing fraud, meeting regulatory requirements, and building trust in digital interactions.

Question 18

Identity Theft

Accepted Answer

Identity theft is a form of crime where someone steals and misuses personal information, such as social security numbers or passport data, often to commit financial fraud or other offenses. Victims can suffer long-term consequences, including damaged credit and legal complications. Digital platforms must implement strong safeguards to detect and prevent such activity.

Question 19

Identity Proofing

Accepted Answer

Identity proofing is the process of collecting, validating, and verifying personal information to establish that a person is who they claim to be. It often involves document checks, biometric analysis, and database cross-referencing. This step is foundational in secure onboarding, especially in regulated industries like finance or healthcare.

Question 20

Identity Fraud

Accepted Answer

Identity fraud involves the use of stolen or fabricated personal information to impersonate someone else for fraudulent purposes, such as opening bank accounts or accessing services. It can occur through tactics like phishing, document forgery, or synthetic identity creation. Preventing identity fraud is a critical objective of modern KYC and verification systems.

Question 21

Identity as a Service (IDaaS)

Accepted Answer

Identity as a Service (IDaaS) is a cloud-based solution that delivers identity management, authentication, and access control features to organizations in a simple and intuitive way with minimal integration.

Question 22

Good AI

Accepted Answer

Good AI refers to artificial intelligence systems that prioritize ethical behavior, fairness, and positive social impact. These systems are developed with principles such as transparency, privacy protection, non-discrimination, and human oversight at their core.

🌍 Why It Matters
With AI playing a growing role in decision-making—from identity verification to healthcare and finance—ensuring it's used responsibly helps prevent harm, bias, and misuse. Good AI supports regulatory compliance (like GDPR and AI Act), builds public trust, and promotes accountability in both public and private sector applications.

✅ Key Principles of Good AI
Fairness: Avoids bias or discrimination across gender, race, age, etc.
Transparency: Operates in a way that can be explained and audited
Privacy: Respects and protects user data and consent
Safety: Minimizes risks of misuse or harmful behavior
Accountability: Human oversight and clear responsibility

Question 23

GDPR (General Data Protection Regulation)

Accepted Answer

The General Data Protection Regulation (GDPR) is a comprehensive privacy law enacted by the European Union that governs how personal data is collected, processed, and stored. For identity verification, GDPR has significant implications, as it regulates the handling of sensitive personal information such as names, dates of birth, government-issued IDs, and biometric data.

🔐 Key GDPR Principles in Identity Verification

Lawful Basis: Identity verification providers must have a lawful reason to process personal data—most commonly consent, legal obligation (e.g., for KYC), or legitimate interest.
Data Minimization: Only the necessary data should be collected to complete the verification process—nothing more.
Purpose Limitation: Data must be used strictly for identity verification and not repurposed without additional consent.
Storage Limitation: Data must not be kept longer than needed. Many providers implement auto-deletion policies in line with GDPR retention rules.
Security: High standards of data protection, including encryption and access control, must be enforced to safeguard identity data.

📄 Biometric Data and GDPR

Biometric information (e.g., facial recognition or fingerprints) used in identity verification is considered special category data under GDPR. Processing it typically requires explicit consent, unless a legal obligation justifies its use (e.g., AML/KYC compliance).

🛡️ User Rights Under GDPR

Right to Access: Individuals can request access to their verification data.
Right to Erasure ("Right to be Forgotten"): Users may request deletion of their personal data.
Right to Object: Users can object to certain types of data processing unless required by law.

✅ Compliance Best Practices for Identity Verification Providers

Clearly state your privacy policy and purpose of data collection.
Obtain explicit consent where required.
Use data protection impact assessments (DPIAs) for high-risk processing.
Choose processors that are GDPR-compliant, especially if data is handled outside the EU.

Question 24

Fraud Detection

Accepted Answer

Fraud detection is the process of identifying suspicious behavior or anomalies that may indicate identity theft, account takeover, or financial crime. It leverages techniques like rule-based systems, machine learning models, and behavioral analytics to flag high-risk users or transactions. Effective fraud detection is essential for regulatory compliance and maintaining trust in digital platforms.

Question 25

Federated Identity

Accepted Answer

Federated identity allows users to access multiple services using a single set of credentials, often managed by a central identity provider (e.g., Google, Microsoft). This reduces password fatigue and enhances security through centralized authentication and Single Sign-On (SSO). It’s commonly used in enterprise and consumer ecosystems to streamline access control.

Question 26

False Negative

Accepted Answer

A false negative is when a system fails to detect a fraudulent user and mistakenly approves them as legitimate. This poses a significant security risk, as it allows fraudsters to bypass identity checks and potentially commit financial or reputational harm. Balancing false negatives with false positives is a central challenge in identity verification.

Question 27

False positive

Accepted Answer

A false positive occurs when a system incorrectly flags a legitimate user as suspicious or fraudulent. In identity verification, this can lead to poor user experience, unnecessary manual reviews, and delays in onboarding. Minimizing false positives is key to maintaining both security and customer satisfaction.

Question 28

Face Swap

Accepted Answer

Face swap refers to the use of digital techniques to replace one person's face with another in images or videos, often leveraging artificial intelligence or machine learning tools. While it can be used for entertainment or creative content, face swapping is increasingly linked to identity fraud, particularly in attempts to bypass biometric verification systems during digital onboarding or authentication.

⚠️ Risks in Identity Verification
Face swap technology can be used to impersonate individuals in liveness checks or video KYC processes, posing a serious challenge for systems that rely solely on facial recognition. Advanced anti-spoofing and deepfake detection tools are critical to identify and stop such manipulations before they lead to fraudulent account creation or unauthorized access.

Question 29

Face Recognition

Accepted Answer

Face recognition is a biometric technology that identifies or verifies a person by analyzing unique facial features such as the distance between the eyes, nose shape, and jawline. It is widely used in identity verification, access control, and mobile device authentication. Accuracy can vary based on lighting, image quality, and algorithm robustness, making liveness detection and spoof resistance critical.

Question 30

Electronic Signature

Accepted Answer

A legal equivalent of a handwritten signature in digital form, used to authenticate documents and transactions.

Question 31

Document Verification

Accepted Answer

Document verification is the process of confirming the legitimacy of identity documents like passports or driver’s licenses. It typically includes visual checks (e.g., holograms, fonts, photo matching) and data checks (e.g., validating names, dates, and document numbers against known patterns or databases). These steps help detect forged or tampered documents and ensure regulatory compliance during identity verification.

Question 32

Document Data Extraction

Accepted Answer

The process of automatically retrieving information from identity documents (e.g., name, date of birth, address) by taking a picture of the document and using technologies like Optical Character Recognition (OCR) to extract data.

Question 33

Digital User Onboarding

Accepted Answer

Digital user onboarding refers to the remote process of acquiring, verifying, and activating new users or customers through digital channels such as web platforms or mobile apps. This process eliminates the need for physical interaction and enables businesses to provide a fast, seamless, and scalable onboarding experience.

🚀 Why Digital Onboarding Is Important
Speed and convenience: Users can sign up and verify their identity in minutes from anywhere in the world.
Compliance: Enables businesses to meet regulatory requirements like KYC, AML, GDPR, and CIP while maintaining a streamlined customer journey.
Fraud prevention: Uses tools such as biometric verification, liveness detection, and document authentication to protect against identity theft and fraudulent account creation.
Cost efficiency: Reduces the need for manual reviews, paperwork, and in-person verifications, cutting operational costs and increasing scalability.
User trust and conversion: A smooth, secure onboarding process improves user satisfaction and boosts conversion rates.

🌍 Where It’s Used
Digital onboarding is widely used across regulated and high-trust industries, including:
Banking & Fintech: Opening accounts, issuing credit cards, applying for loans
Crypto & Blockchain Platforms: Onboarding users while complying with MiCA and FATF guidelines
Telecommunications: Activating SIM cards and managing subscriptions
Insurance: Signing up new policyholders and verifying beneficiary identity
Healthcare: Patient registration, prescription access, and telemedicine onboarding
Travel & Mobility: Verifying driver identity in ride-hailing or checking passenger documents in online travel bookings

🔧 Key Components of Digital Onboarding
Identity Verification: Confirming that the user is who they claim to be, often through document scanning, selfies, or biometrics
Liveness Detection: Ensuring the user is physically present and not using spoofed images or deepfakes
Document Verification: Authenticating the validity of ID documents like passports and driver's licenses
AML Screening & Sanctions Checks: Scanning users against watchlists and politically exposed persons (PEPs)
User Education & Activation: Guiding users through the first steps of using the service or product

Question 34

Digital Identity

Accepted Answer

Digital identity refers to the online representation of an individual’s or entity’s identity, built from attributes like name, date of birth, biometric data, and credentials used to access digital services. It is essential for secure authentication, regulatory compliance (e.g., KYC), and enabling trusted interactions in online ecosystems.

Question 35

Deepfake

Accepted Answer

A deepfake is synthetic media—usually video, audio, or images—created using AI and deep learning to manipulate or generate hyper-realistic representations of people. It can replace someone’s face or voice with another’s, often making it appear they said or did something they never did.

⚠️ Risks in Identity Verification

Deepfakes pose a serious challenge to identity verification systems, especially those relying on video KYC or facial recognition. Fraudsters may use deepfakes to impersonate real users, bypassing biometric verification or fooling liveness detection.

🛡️ Countermeasures

Liveness Detection (active and passive)
Deepfake Detection Algorithms
Human Review in High-Risk Cases

📜 Regulation & Compliance

Some jurisdictions (e.g. California’s AB-730 law) have begun regulating deepfake usage, especially in politics and fraud. In the identity space, compliance frameworks like KYC and AML require robust defenses against synthetic identity fraud.

Question 36

Cross-Device Verification

Accepted Answer

Verifying a user's identity across multiple devices or platforms. In most cases used to increase verification security.

Question 37

Credential Stuffing

Accepted Answer

A type of cyberattack where attackers use lists of compromised usernames and passwords obtained from data breaches to try and gain unauthorized access to user accounts on other services.

Question 38

CIP (Customer Identification Program)

Accepted Answer

A Customer Identification Program (CIP) is a key regulatory requirement in the United States, mandating that financial institutions verify the identity of individuals or entities seeking to open an account. Introduced under the USA PATRIOT Act (Section 326), CIP aims to prevent money laundering, terrorist financing, and other illicit financial activities by ensuring institutions “know” their customers from the moment of account creation.

📋 Core Elements of CIP

Under U.S. law, financial institutions must implement a written, risk-based CIP that includes the following:

✅ Identity Information Collection
Institutions are required to collect specific personally identifiable information (PII), including:
Full legal name
Date of birth
Residential or business address
Identification number (e.g., SSN for individuals or EIN for businesses.

✅ Verification of Identity
The institution must verify this information using either:
Documentary methods: government-issued photo IDs (e.g., passport, driver’s license)
Non-documentary methods: database checks, credit reports, or utility bills

✅ Record keeping
Firms must maintain records of the information gathered and how verification was performed, usually for five years after the account is closed.

✅ Comparison with Government Lists
CIPs must include procedures to check new accounts against government watch lists, such as those maintained by OFAC (Office of Foreign Assets Control), to ensure the individual or business is not a known threat or sanctioned party.

🌍 CIP vs. CDD

While CIP focuses specifically on identity verification at onboarding, it is often the first step within broader Customer Due Diligence (CDD) and Know Your Customer (KYC) frameworks.
CIP = Initial identity verification
CDD/EDD = Ongoing risk assessment and monitoring

⚖️ Regulatory Context

Enforced by FinCEN and applicable to banks, credit unions, brokers, and certain fintech companies
Applies to both individuals and legal entities, with specific provisions for beneficial ownership in business accounts
Financial institutions can face civil penalties for non-compliance

🧠 Why CIP Matters
Strengthens the integrity of the financial system
Helps prevent the misuse of accounts for illegal purposes
Forms the foundation for AML and KYC compliance efforts

Question 39

CDD (Customer Due Diligence)

Accepted Answer

Customer Due Diligence (CDD) is the process by which financial institutions and regulated businesses assess the identity, background, and risk profile of their customers to prevent financial crimes such as money laundering, terrorist financing, and fraud. CDD is a core component of AML (Anti-Money Laundering) and KYC (Know Your Customer) regulations globally and is required before establishing a business relationship or conducting significant transactions.

📋 Key Elements of CDD

✅ Customer Identification
Verify the identity of the customer using reliable, independent source documents (e.g., government-issued ID, utility bills).
Gather essential PII: full name, date of birth, address, and identification number.

✅ Risk Assessment
Assess the nature and purpose of the relationship (e.g., personal account, corporate services, cross-border transactions).
Classify the customer as low, medium, or high risk, determining how extensively they will be monitored.

✅ Beneficial Ownership
For business or legal entities, identify and verify the ultimate beneficial owner (UBO)—the individual(s) who ultimately control or benefit from the entity.

✅ Ongoing Monitoring
Continuously monitor customer activity for unusual patterns or transactions.
Perform regular reviews and updates of customer information, especially for high-risk clients.

🛡️ Types of CDD

🔹 Standard CDD
Applied to low- and medium-risk customers.
Includes identity verification and basic risk assessment.

🔹 Enhanced Due Diligence (EDD)
Required for high-risk customers, such as PEPs (Politically Exposed Persons) or those from high-risk jurisdictions.
Involves deeper background checks, source-of-funds verification, and stricter monitoring.

🔹 Simplified Due Diligence (SDD)
Used for low-risk products or customers (e.g., small accounts or government agencies).
Involves limited verification and monitoring.

🌍 Regulatory Context

🇪🇺 European Union
CDD is mandated under the EU AML Directives (especially 4AMLD, 5AMLD, 6AMLD).
Required for banks, crypto providers, payment firms, and others handling financial transactions.

🇺🇸 United States
Governed by FinCEN, with CDD requirements under the Bank Secrecy Act (BSA) and Customer Due Diligence Final Rule (2016).
Includes identifying beneficial owners and maintaining risk-based monitoring.

🌐 Global Standards
The Financial Action Task Force (FATF) sets international standards for CDD practices.
Required in all G20 countries and by regulators in Asia, Middle East, Africa, and Latin America.

🔍 CDD vs. CIP and KYC
CIP: Identity verification at the start of a relationship
CDD: Broader process involving risk assessment, purpose, and ongoing monitoring
KYC: Umbrella framework that includes both CIP and CDD

🧠 Why CDD Matters
Prevents financial systems from being used for illicit purposes
Enables institutions to understand their customers and detect suspicious behavior early
Ensures compliance with local and global regulatory requirements

Question 40

Biometric Verification

Accepted Answer

Biometric verification is the process of confirming an individual's identity using unique physical or behavioral characteristics. It offers a secure and convenient alternative to passwords and PINs by relying on data that is inherently tied to a person.

🧬 Types of Biometrics Used in Verification

✅ Physical Biometrics
Fingerprint Scanning – One of the most common forms; used in smartphones, banking apps, and border control.
Facial Recognition – Matches facial features captured via camera to a stored template.
Iris Recognition – Scans the unique patterns in a person's iris; highly accurate but less widely deployed.
Voice Recognition – Analyzes vocal tone, pitch, and patterns; often used in call centers.
Palm or Vein Pattern Recognition – Uses vein structures or hand geometry, often for high-security applications.

✅ Behavioral Biometrics
Typing Rhythm – Measures how a person types on a keyboard.
Mouse Movement – Analyzes navigation patterns on screen.
Gait Analysis – Identifies a person based on how they walk.

🛡️ Why Use Biometric Verification?

🔒 Enhanced Security
Biometrics are difficult to replicate or steal, making them more secure than traditional passwords.

⚡ Convenience
No need to remember or manage passwords — identity is confirmed through innate traits.

🧠 Fraud Prevention
Reduces the risk of identity theft, account takeover, and unauthorized access.

🧪 Liveness Detection: Preventing Spoofing
Liveness detection ensures that biometric data is being captured from a live, present person, not a photo, mask, or recording. It can be:
Passive (analyzes natural behavior or reflections without user action)
Active (requires user action like blinking or turning their head)

Question 41

Biometrics

Accepted Answer

The use of unique biological characteristics (e.g., fingerprints, facial features, iris patterns) to identify and authenticate individuals.

Question 42

Access Control

Accepted Answer

Mechanisms that restrict access to resources based on user identity and permissions.

Question 43

Account Takeover (ATO)

Accepted Answer

Unauthorized access and control of a user's account by a malicious actor.

Question 44

Address Verification Service (AVS)

Accepted Answer

A system that checks the billing address provided by a user against the address on file with the credit card issuer.

Question 45

Anti-Money Laundering (AML)

Accepted Answer

Anti-Money Laundering (AML) refers to a set of laws, regulations, and procedures aimed at preventing criminals from disguising illegally obtained funds as legitimate income. AML frameworks are designed to detect and report suspicious activities, monitor transactions, and verify the identities of customers.

🔍 Key AML Regulations by Region

🇺🇸 United States

✅ Bank Secrecy Act (BSA)
Enacted in 1970, the BSA is the cornerstone of U.S. AML regulation.
Requires financial institutions to keep records and file reports that could be helpful in detecting and preventing money laundering and fraud.
Includes mandatory Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs).

✅ USA PATRIOT Act (2001)
Expanded the BSA by increasing due diligence requirements, particularly for foreign accounts and correspondent banking relationships.
Introduced stronger KYC (Know Your Customer) and CDD (Customer Due Diligence) requirements.

✅ FinCEN (Financial Crimes Enforcement Network)
The U.S. Treasury’s bureau responsible for enforcing AML laws and overseeing regulatory compliance.

🇪🇺 European Union

✅ EU Anti-Money Laundering Directives (AMLD)
The EU has issued six AMLDs to date, progressively strengthening AML frameworks across member states:
	4th AMLD (2015):
Introduced a risk-based approach.
Required identification of Beneficial Owners.
	5th AMLD (2020):
Added virtual currencies and prepaid cards to AML scope.
Enhanced access to Beneficial Ownership Registers.
6th AMLD (2021):
Harmonized definitions of money laundering offenses across EU.
Introduced criminal liability for legal persons and harsher penalties.

✅ European AML Authority (AMLA)
A new centralized EU body, launching by 2026, to oversee cross-border AML supervision.

🌍 Other Regions

🇬🇧 United Kingdom
Money Laundering Regulations 2017, updated post-Brexit.
Supervised by HMRC, FCA, and NCA.
Aligns closely with EU directives but under UK-specific frameworks.

🇨🇦 Canada
Regulated by FINTRAC (Financial Transactions and Reports Analysis Centre of Canada).
Proceeds of Crime (Money Laundering) and Terrorist Financing Act is the core AML legislation.

🇦🇺 Australia
Overseen by AUSTRAC (Australian Transaction Reports and Analysis Centre).
AML/CTF Act 2006 governs compliance for financial and non-financial businesses.

🇸🇬 Singapore
AML obligations enforced by Monetary Authority of Singapore (MAS).
Strong emphasis on digital AML solutions and fintech regulation.

Question 46

Authentication

Accepted Answer

The process of verifying the identity of a user, device, or system.

Question 47

Authorization

Accepted Answer

The process of determining what actions a verified and authenticated user is permitted to perform.

Question 48

What is Deepfake?

Accepted Answer

People often assume that all AI-generated or synthetic content is a deepfake, but that is not the case.

A deepfake is AI-generated or AI-manipulated content that convincingly portrays a real world in a way that did not actually exist or occur.

How to choose an identity verification (IDV) and KYC vendor?

How to detect Deepfake?

How to choose an identity verification (IDV) and KYC vendor?

How to detect Deepfake?

How to choose an identity verification (IDV) and KYC vendor?

How to detect Deepfake?

Frequently asked questions

Watch List

What is AML

What is KYC

Video KYC (vKYC)

Synthetic Identity Fraud

Spoofing

Sanctions Screening

Privacy-Enhancing Technologies (PETs)

PEP (Politically Exposed Person)

Personally Identifiable Information (PII)

Optical Character Recognition (OCR)

NFC (Near-Field Communication)

MiCA (Markets in Crypto-Assets)

Multi-Factor Authentication (MFA)

Liveness Detection

KYC (Know Your Customer)

Identity Verification

Identity Theft

Identity Proofing

Identity Fraud

Identity as a Service (IDaaS)

Good AI

GDPR (General Data Protection Regulation)

Fraud Detection

Federated Identity

False Negative

False positive

Face Swap

Face Recognition

Electronic Signature

Document Verification

Document Data Extraction

Digital User Onboarding

Digital Identity

Deepfake

Cross-Device Verification

Credential Stuffing

CIP (Customer Identification Program)

CDD (Customer Due Diligence)

Biometric Verification

Biometrics

Access Control

Account Takeover (ATO)

Address Verification Service (AVS)

Anti-Money Laundering (AML)

Authentication

Authorization

What is Deepfake?

Identity Verification and KYC Glossary