Until recently, Fintech companies and financial service providers in Israel were required to identify their customers in person, without the ability to do so online. Non-banking financial services require a digital identification system, which is critical for online and app-based businesses that lack bank branch infrastructure. Institutions in Israel, contrary to European and US standards, had to identify their customers “face to face” and have them sign original documents.

Online identity verification is structured as an exemption, allowing financial institutions to conduct eKYC if they meet certain technological standards. Each financial regulator, including the Israel Securities Authority, the Capital Markets Insurance and Savings Authority, and the Bank of Israel’s Banking Supervision unit, publishes exemptions as part of its AML compliance guidance documents, which follow the principles described below:

Scope – In most cases, “face-to-face” identification is not required for customers with an accumulated activity of less than 50,000 NIS over six months that doesn’t involve high-risk countries, so the requirements target activity above those thresholds. Online identity verification is only allowed for Israeli private customers acting on their own behalf (not on behalf of another entity or a “beneficiary”) and Israeli corporations. The guidance does not allow for the identification of foreign residents or any private customers acting on behalf of a third party.

Entities wishing to identify their customers online must meet the following mandatory requirements:

• Obtaining the customer’s signature on the digital Ultimate Beneficial Owner (UBO) declaration – The functionality must allow signing the UBO declaration in a format published by the regulator online, thus providing quality documentation of the signature and enabling it to be securely linked to the declaration. 
• Phone Number Verification – The phone number of the person undergoing identification should be verified by sending a one-time password (OTP). The IP address of the device from which the identification process was initiated must also be stored.
• The person responding to the “Know Your Customer” questionnaire and receiving the online service must be confirmed to be the same person.
• Risk Assessment – Customers who are identified online should be flagged as such, and the company should consider adding or removing restrictions from their services.

The guidance allows for two types of online identification verification: a combination of visual conferencing technology and penny testing or identification using dedicated remote identity verification technology: 

Visual conferencing technology with penny testing – This type allows for customer identification and verification to be completed through videoconferencing software. Any software that permits video conferencing and a clear recording of customer video and audio can be used. Examples of such software include Skype, Zoom, and Google Meet. The guidance requires penny testing, which involves conducting bank transfer involving an account in the customer’s name an Israeli bank.

Remote identity verification technology (IDV)  – This type uses specialized tools and platforms to confirm a person’s identity without their physical presence. These tools usually include biometric verification, such as facial recognition to check unique physiological characteristics that can be used to identify an individual. The system ensures that the user is a living human, not a picture, video, or mask. 

Requirements for IDV technology are as follows:

• The customers must be identified and verified via IDV technology using valid identification documents, such as an identification card (Teudat Zehut), passport, or driver’s license. The functionality must support real-time video interaction or real-time video capture. 
• The technical characteristics of the technology for remote identification, such as the quality of the communication (such as continuity of image and sound) and the image and the sound (such as resolution, contrast, brightness, and lighting), allow identification and verification with a high level of certainty of the customer and the identification documents presented by them.
• IDV technology must rely on audio and video communication between technology providers’ servers and the customer. 

As part of the process, the following requirements will be implemented:

• Optical Character Recognition–Full OCR support to extract identification information from Israeli Identification documents: Teudat Zehut (local ID), Israeli driving license (optional), and Passport (optional).
• Data Extraction – The ID number field must be extracted using OCR technology without the possibility of the customer altering or updating the field if the technology fails to extract the number. Updates or changes of other data fields (not ID number) need to be verified by the company’s representative. Authorization logs should be maintained.
• Forgery Tests – Verification of Identification Document authenticity. It will allow the verification of the authenticity of a customer’s identification documents. Authentication of the ID presented must be verified based on specific document characteristics, the integrity of the ID must be examined, and the information on the ID must be complete, up-to-date, and consistent.
• Liveliness Tests – The requirement ensures that the biometric sample is from a real person and not a fake or spoof.
• Identification Verification – Determines whether the image on the customer’s government identity document matches the image on their video. Algorithms determine how similar the two representations are. The system determines whether the two faces belong to the same individual if their features match beyond a certain threshold.  
• Audio UBO Declaration – The functionality must support obtaining an audio recording of the customer’s statement that they are acting on their own behalf and not for a beneficiary. For Corporations, the audio recording of the customer’s statement attests to the correctness of the declaration of an Ultimate Beneficial Owner (UBO). 
• Israeli Evidence Keeping Regulation – The service provider or the company is required to undergo a process for editing an institutional record, which will be based on the opinions of a legal entity, and which will relate to the conditions for proving an institutional record, including the output of an institutional record, as detailed in Section 36(a) of the Evidence Ordinance [New Version], 5711-1971. 
• Expert Opinion from the Service Provider – An expert should confirm that the technology in use complies with legal requirements.

In addition to the previously mentioned guidelines, companies must adhere to specific requirements concerning risk management and corporate governance during the service integration process. The requirements in this domain are detailed below:

• Designated Officer for Online Identification – Companies must designate a responsible individual or officer to manage online identification processes.
• Preparing and Authorizing Board of Directors’ Policy Document – Comprehensive policy documents should be formulated to address various aspects, including management pertaining to money laundering and terrorist financing activities, the clear definition of roles and responsibilities across various job positions, and managerial and board-level oversight mechanisms, which include work plans and reporting procedures.
• Establishing Operational Procedures – These should cater to technical conditions and include guidelines related to wearable items on the client during identification, such as glasses, facial hair, etc., as well as parameters for client photographs that detail required image size and the necessary conditions for capturing identification documents. Additionally, guidelines must outline the conditions for “face-to-face” identification in situations where online identification fails and should provide clarity on disclosures to the client about the identification process. Finally, they should establish requirements for outsourcing, with particular emphasis on collaborations with technology providers.
• Monitoring and Control Framework – A monitoring and control mechanism is essential to manage risks. It should encompass:
• Regular audits to ensure data integrity – Strict oversight controls for technology providers.
• High-security digital documentation – Guarantee that recordings and documents are stored using advanced digital security measures.

Most Israeli financial regulators require their supervised entities to submit a request for online identity verification authorization. This request must include a comprehensive description of the identity verification process that the entity intends to use.