FINMA Video and Online Identification Rules 2026: What Changes on 1 November?

On 8 October 2026, FINMA announced a partial revision of Circular 2016/7, "Video and online identification". The amended text was adopted on 23 September 2026 and applies from 1 November 2026.

The revision changes several specific things:

• the identity documents firms may accept
• the safeguards required for some online identification routes
• the evidence firms can use to confirm a client's residence
• a new identification route using the federal e-ID

It does not rewrite digital onboarding as a whole.

For compliance teams, the practical questions are narrower than the headlines suggest:

• Which of our onboarding channels are affected?
• Which existing processes remain acceptable unchanged?
• Does the one-year transitional provision apply to us, or only to a specific route?

The federal e-ID is a separate matter. FINMA now permits it as an identification method, but the government has not yet launched it. This article covers the FINMA online identification rules 2026 margin number by margin number, and what to review before and after 1 November.

What FINMA changed in Circular 2016/7

The revised Circular has a modification list:

• New margin numbers (MN): 43.1, 44.1–44.4 and 54
• Amended: MN 2, 6, 14, 15, 31.3, 32, 33, 37.1, 39, 45 and 53

The table below uses that list and FINMA's explanatory report (in German).

Two points from FINMA's consultation report (in German) are just as important. These consultation proposals were rejected:

• using the E-ID for video identification
• recognising EU (eIDAS) identities
• accepting signatures below the qualified level
• "reverse" bank transfers

Who needs to review their digital onboarding procedures?

Under MN 1, the Circular sets out FINMA's supervisory practice under the Anti-Money Laundering Act (AMLA) and the FINMA Anti-Money Laundering Ordinance (AMLO-FINMA). It does not create new statutory duties. It explains how FINMA expects the identification duties in those texts to be met through digital channels.

A fintech brand does not decide the answer. What matters is the firm's legal entity, its licence or SRO affiliation, and the activities it performs.

Video identification versus online identification

The Circular treats these as separate procedures with different safeguards.

This is why a vendor licence is not evidence of compliance. A provider may support several workflows, but the regulatory test depends on which route your configuration actually follows, and whether each required step is performed, recorded and archived (MN 17, MN 31.3).

Liveness detection and identity-fraud controls

The revised Circular uses "liveness detection" in three places, and each serves a slightly different purpose:

• Photo route (MN 32): the intermediary must ensure the photograph of the contracting party was taken during the identification process. This guards against reused, pre-recorded or manipulated images.
• Qualified electronic signature route (MN 39): the intermediary must ensure that the identification request originates from the contracting party.
• E-ID route (MN 44.3): the same objective, that the request originates from the contracting party.

FINMA introduced these to counter risks from artificial intelligence, including deepfakes and synthetic identities. The Circular does not prescribe a technology, an algorithm or a vendor. The consultation report describes FINMA's approach as technology-neutral and principle-based, and treats the Circular's rules as minimum standards. Risk-based measures beyond them follow from the firm's own risk management.

In practice, firms should separate four control questions:

1. Freshness and presence. Was the face image captured live, in this session?
2. Attribution. Is the person starting the request the contracting party, rather than someone using their credentials or documents?
3. Document authenticity. Were the MRZ or QR data read and decrypted, and were the security features checked?
4. Escalation. What happens when a check fails or is inconclusive? Who reviews it, and is the decision recorded?

Hypothetical scenario. A Swiss financial intermediary uses an outsourced provider for automated document and face capture. The provider confirms the identity document is genuine. However, its configuration reuses a selfie uploaded earlier in the process, so it does not establish that the contracting party was present when the identification took place.

The firm should first establish which route the process follows:

• Photo route (MN 32). The live-capture requirement has applied without any transition, and the gap needs urgent review.
• Qualified signature route (MN 39). The MN 54 transition may cover the technical adjustment, but only for that route.

In either case, the firm should record the facts, assess any onboardings already completed through that configuration, and document the remediation. Whether there is a breach depends on the facts. It should not be assumed.

Swiss e-ID: what FINMA permits and what is not live yet

Under MN 44.1–44.4, a financial intermediary may identify a contracting party online using electronic identity credentials issued under the federal e-ID Act (eIDG). It must:

• require the E-ID to be presented
• check that it was issued to the contracting party and is valid
• verify the residential address under MN 34–37.1
• ensure the request originates from the contracting party
• document the process

MN 53 also treats the E-ID as a valid identification document for AMLO-FINMA purposes.

The regulatory permission and the credential's availability are separate. On 30 June 2026, the Federal Office of Justice postponed the e-ID introduction to strengthen protection against malware and deepfakes:

• The trust infrastructure is expected to be operational in the first half of 2027.
• The e-ID launch date will be announced once that work is largely complete.

The 1 November effective date therefore does not make the e-ID available.

Several limits also apply:

• The route covers the federal E-ID only. Other electronic credentials, such as a future electronic driving licence, are not the E-ID.
• The route does not replace beneficial-owner declarations, risk classification or any other due diligence duty.
• Until the e-ID is issued, the sensible step is to plan the integration, update procedures and decide on testing, without advertising e-ID onboarding.

QR-coded documents, residence verification and payment checks

Accepting QR-coded documents is a permission, not a duty. FINMA's explanatory report confirms that firms still decide which documents they accept.

The operative requirements are the same for MRZ and QR documents:

• The document must be an official identification document of the issuing country, with an MRZ or QR code and optical security features (MN 15, 31.2).
• The information stored in the MRZ or QR code must be read and decrypted by machine (MN 6, 14, 32).
• The security features must be checked: in video identification, one optically variable feature and one other random feature (MN 14); on the photo route, at least two randomly selected features (MN 32).
• The decoded data must be checked against the document and the information the client provided, and the client's photograph against the document photograph (MN 13, 32).

The firm must also decide whether a given document qualifies for the procedure it has chosen.

Neither OCR text from a document image nor simply detecting that a QR code is present amounts to reading and decrypting the stored data. QR-coded documents do not all use the same data structure or signature scheme. Where a document's code carries a digital signature that can be verified, checking it is a sensible technical control, but the Circular does not set one cryptographic standard for all documents.

Residence. The previous Circular already allowed residence to be confirmed by geolocation (MN 37.1, added in 2021), alongside utility bills, postal delivery and public or trustworthy private registers. A digitally issued municipal residence confirmation could already qualify under the register route in MN 37, depending on its source.

The 2026 wording replaces the narrow geolocation reference with "an equivalent digital process that reliably links the contracting party and its infrastructure to a place of residence". The test is whether the method reliably connects this person and their device to that address. A bare IP location is not conclusive on its own. Document the method, why it is reliable, and the evidence kept for each case. A utility bill is still acceptable.

Payment origin and chip reading. On the photo route, MN 33 requires a payment from an account in the contracting party's name at a bank in Switzerland or Liechtenstein. A bank in an FATF member state also qualifies if that country's evaluation has not rated it non-compliant on the customer due diligence and wire transfer recommendations, and not low on immediate outcomes 3 and 4. "Bank" includes institutions covered by Art. 1b of the Banking Act.

FINMA's explanatory report notes that some intermediaries did not check who actually sent the payment. Payments made through non-bank providers, such as card issuers or payment apps, do not by themselves show that the funds came from an account at an eligible bank. Keep evidence of the sending institution and the account name.

The existing alternative in MN 33.1 is unchanged. The transfer can be dispensed with if the chip in a biometric document is read, its data passes authenticity and integrity checks, and the data matches the information provided and the client's photograph.

The one-year transition: which firms actually qualify?

The revised Circular applies from 1 November 2026. MN 54 grants one year from that date, but only for the technical adjustments needed to add residence verification and liveness detection to online identification using qualified electronic signatures under MN 39.

It does not cover the photo route, video identification, the payment-origin check under MN 33 or the E-ID route. QR-code acceptance and the new routes are permissions, so firms adopt them on their own timetable. Once adopted, every condition applies in full.

Hypothetical comparison. Firm A onboards through a remote qualified signature issued after unattended identification. It may use the transition to add address verification and liveness detection to its MN 39 process, and should record the plan and its progress. Firm B uses the photo route with a payment from the client's account. It gets no transitional relief, and needs to confirm before 1 November that its live-capture and payment-origin controls meet MN 32 and MN 33.

The Circular gives the period as "one year from the date of entry into force". Confirm the exact end date for your process with your adviser, rather than relying on an assumed calendar date.

Which onboarding workflows need action before 1 November?

The routes in MN 43.1 concern how the natural persons acting for a legal entity or partnership are identified. The intermediary must still obtain the entity extract and the power-of-attorney document (MN 24, 44). An E-ID or qualified signature proves who a person is, not that they are authorised to act for the entity. The declaration on the controlling person or beneficial owner remains a separate step under Section V.

Outsourced KYC vendors: practical compliance questions

Under MN 51, an intermediary may mandate third parties to identify clients under AMLO-FINMA's delegation rules. It must check that the provider has the necessary professional knowledge and technology. Outsourcing the technology does not transfer the intermediary's responsibility for due diligence.

The evidence must also reach the intermediary. Under MN 51, the intermediary is sent, and must file, the following material generated by the third party:

• photographs or electronic copies
• audio recordings
• declarations, including beneficial-owner declarations under Section V
• other documentation, including any qualified electronic signatures

Art. 29(2) AMLO-FINMA requires copies of the documents used, with confirmation that they match the originals. MN 53 allows that confirmation to be given electronically, where the sender and the documents covered can be clearly identified. Under Art. 28(3) AMLO-FINMA, a mandated third party may not delegate further. MN 53 clarifies one exception: where another financial intermediary directly engages an identification service provider, that provider is not treated as a prohibited further subcontractor. A vendor that relies on undisclosed sub-processors for the identification itself therefore needs close review.

The questions below are recommended oversight practice, not a statutory questionnaire.

FINMA November 2026 readiness checklist

• Confirm the supervisory route: direct application, CDB or SRO-SIA, or SRO rules
• Inventory every digital onboarding channel, including channels for legal-entity representatives
• Classify each channel using the workflow table above, with an owner and status
• Set an internal deadline for any qualified-signature channel relying on MN 54
• Test MRZ and QR validation, including failure handling
• Verify the live-capture and attribution controls for each online route
• Confirm that payment-origin checks identify the sending bank
• Obtain evidence from vendors, not just confirmations
• Update procedures, assign remediation owners, and keep test results and sign-offs

When to seek an independent AML onboarding review

Many firms can do this assessment internally. Outside support is more likely to help when:

• several onboarding providers or legacy flows run in parallel
• the supervisory route is unclear
• audit evidence is incomplete
• the liveness logic cannot be explained from the vendor's documentation
• cross-border onboarding mixes documents and residence methods
• vendor claims differ from documented controls

A targeted Swiss AML gap analysis compares your current processes with the applicable requirements and ranks the remediation. It is different from a formal independent audit, which is a separate assurance exercise with its own scope and reporting.

Frequently asked questions

Does the revision require re-identifying existing clients?

Neither the revised Circular nor FINMA's reports set a general duty to re-identify clients onboarded under earlier versions. Under Art. 5 AMLA, identity must be verified again if doubts arise during the relationship. A known weakness in a past onboarding flow, such as a gap in live capture, could raise such doubts for the clients affected. Assess the affected population on a risk basis and document the decision.

Can we use an identity-verification provider based outside Switzerland?

MN 51 does not name a location requirement, but that is not general permission to outsource abroad. The institution must separately assess the delegation rules in Arts. 28–29 AMLO-FINMA, including the ban on further delegation, and any FINMA outsourcing rules that apply to it. It must also assess Swiss data-protection law for cross-border disclosure. Above all, the identification evidence must be delivered to it, filed, and available to supervisors and auditors.

If your institution needs to determine which identification procedures are affected, check third-party verification controls or set remediation priorities, ComplyFactor's Swiss AML regulatory advisory services can support a targeted assessment and implementation plan.