Selfie ID Checks: What They Prove for AML/CTF

A selfie identity check is one way, not the required way, to take reasonable steps to establish that a customer is the person they claim to be. For a Tranche 2 reporting entity, such as a real estate agency, law firm or accounting practice, the obligation sits in section 28(3)(a) of the AML/CTF Act. The selfie is a tool that helps you meet it. It proves that a live person’s face matches the photograph on a document. It does not prove that the document is genuine or that its details are correct, and the decision that you are satisfied remains yours.

This guide explains what a selfie check does and does not establish, how it fits AUSTRAC’s expectations, what the Privacy Act requires when you collect biometric data, and what to do when a match fails.

TL;DR

• A selfie check is an accepted method, not a mandatory one. AUSTRAC’s guidance for individuals also accepts an in-person comparison with photo ID and a video call.
• It shows a live person whose face matches the document photo. It does not show the document is authentic or that the details on it are right.
• Biometric data used for automated checks is sensitive information under the Privacy Act. Get consent and offer an in-person or video alternative.
• A failed match is not proof of fraud. If you suspect on reasonable grounds that the customer is not who they claim, a suspicious matter report (SMR) is due under section 41, and you must not tip off.
• Keep a record of what you did and the outcome, with an officer’s decision attached, rather than hoarding copies of full ID documents.

Table of Contents

• What a selfie identity check actually does
• What a selfie proves, and what it does not
• Where the selfie fits in your AML/CTF obligations
• Biometric data, consent and the alternative you must offer
• Running the check well: customer instructions that reduce failures
• When the match fails
• Choosing a liveness and selfie approach
• What to record
• Our perspective
• Putting this into practice with AML Guard
• FAQ
• Sources

What a selfie identity check actually does

In a selfie identity check, the customer captures a photo or short video on their phone or computer. The system does two separate things with it. First, it checks that a live person is present at that moment. Second, it compares the face with the photograph on a trusted identity document, such as a passport or driver licence.

These are different questions, and it helps to keep them apart. Service NSW describes liveness as asking whether a live person is present now, and matching as asking whether that person’s face corresponds to the trusted reference photograph. myID explains that the liveness step also looks for impersonation attempts such as the wearing of a mask, while face matching compares your image with the photograph on your passport or licence.

The comparison is normally one-to-one. The selfie is checked against the image on the particular document the customer supplied, not searched against a database of faces. Australia’s Digital ID System defines one-to-one matching as matching a person’s selfie with an ID document they own, with consent.

In many government processes there is a third step before the face comparison: the document’s details are verified with the issuing authority. The Digital ID System gives the example of licence details being checked with the relevant state or territory authority and passport details with the Department of Foreign Affairs and Trade. Whether your own process includes that step depends on how your identity verification is set up, and it is worth knowing precisely, because it changes what the result tells you.

What a selfie proves, and what it does not

A clear statement of the limits protects you in front of a supervisor. Treat the output of a selfie check as a specific piece of evidence, not as a verdict on the customer.

The consequence is simple. A passed selfie check on a forged licence that carries the fraudster’s own photograph can still produce a clean face match. That is why the selfie should sit alongside document capture and checks of the document details, not stand in for them. It is also why the rest of your customer due diligence (CDD) still runs: you identify the customer’s ML/TF risk and collect and verify additional information as appropriate to that risk.

Where the selfie fits in your AML/CTF obligations

The obligation is to establish, on reasonable grounds, that the individual is who they claim to be, and not to start providing a designated service until you are satisfied of that. AUSTRAC’s initial CDD for individuals page gives three examples of how to compare the customer’s appearance with their photographic identification:

1. In person, with the customer and the document in front of you.
2. By video call.
3. Using biometric technology from an identity verification provider.

The word to notice is “examples”. The regime does not say the customer must take a selfie, and it does not say a selfie is enough on its own. Biometric technology is one listed route. You remain responsible for satisfying your CDD obligations and should weigh the result alongside the document and the other KYC information the customer’s risk calls for.

In practice, this gives an agency real flexibility. An older vendor who is uncomfortable with a phone app can be identified in person or on a video call. A buyer overseas can complete a biometric check remotely. A returning customer on a low-risk transaction might be handled differently from a first-time buyer purchasing through a company. Your AML/CTF program should say which methods you use, for which customers, and why. For more on remote scenarios, see our guide to verifying identity remotely under Tranche 2, and for the wider process, our overview of Tranche 2 customer due diligence.

Biometric data, consent and the alternative you must offer

A face template used for automated matching is biometric information, and biometric data used for automated verification is sensitive information under the Privacy Act. The practical rules follow from that.

• Ask for consent before the check starts. In the OAIC’s guidance for reporting entities, consent should generally be sought before biometric identification or verification for customer due diligence, and any collection of biometric information must be necessary and proportionate.
• Offer an in-person or video option. A customer who says no to a biometric check has not refused CDD. They have chosen a different permitted method. If the only way forward is the selfie, the consent is not really free.
• Collect and keep only what you need. The OAIC advises privacy by design and data minimisation. Its guidance on handling ID documents notes that excessive collection and retention of full ID documents creates privacy and security risks, and that the AML/CTF Act does not require copies of full ID documents.
• Say what you do in your privacy notice. Your collection notice and privacy policy should describe the biometric step in plain words, who processes the data, and how long records are kept.

Our article on privacy and AML/CTF for Tranche 2 goes further into the notices and retention decisions an agency needs to settle.

Running the check well: customer instructions that reduce failures

Most failed selfie checks are practical failures, not signs of dishonesty. Tell the customer what to expect before you send the link. The steps that myID recommends for its own photo check are a sound template:

1. Allow the browser or app to use the camera.
2. Be in a well-lit area.
3. Remove anything that obscures the face.
4. Keep your eyes open and look at the screen.
5. Hold the device still.
6. Move close enough that the framing indicator turns green.

Add a line about the document: a clear, flat, uncovered photo page or card, without glare across the photograph. Send the instructions with the link, and give the customer a phone number to call if they are stuck. A customer who can ask for help on the spot is far less likely to abandon the check or to be pushed towards a workaround.

When the match fails

A failed match is a flag to review, not a finding of fraud. Poor lighting, an old licence photo, a change in hair or glasses, a camera fault, an unfamiliar device or a customer with a disability or limited digital confidence can all produce a failure. Treating every failure as suspicious is unfair to customers and will bury genuine concerns among false alarms.

A workable sequence for the compliance officer looks like this:

1. Look at the cause. Check whether the system reports an image quality issue, a liveness issue or a mismatch.
2. Offer another attempt with the guidance above, or with a different device.
3. Offer another method. An in-person comparison with the photo ID, or a video call, is a recognised alternative. If the customer cannot provide ID at all, our guide to what to do when a client can’t provide ID sets out the options.
4. Record the decision. Note what failed, what you tried, and why you were or were not satisfied.
5. Do not proceed with the designated service until you are satisfied on reasonable grounds that the customer is who they claim to be.

When failure points to something more

Sometimes the review turns up more than a bad photo: a document that appears altered, a customer who avoids every alternative, details that do not fit the story. If you suspect on reasonable grounds that the person is not who they claim to be, an SMR is due under section 41 of the AML/CTF Act.

The customer must not be tipped off. Do not tell them that you have formed a suspicion or lodged a report. Keep your messages neutral, such as saying that you need to complete verification before proceeding. The OAIC’s guidance adds a point that is easy to miss: you need not give a collection notice where that would be inconsistent with the tipping-off prohibition, and you must not give access to personal information, or explain why you are refusing access, if that would breach the tipping-off offence in section 123. Your privacy process and your SMR process need to be built together.

Choosing a liveness and selfie approach

If you are choosing a provider or a platform, assess the check against the job it has to do in your program, not against marketing claims. These questions are a practical starting point:

• Does it do both jobs? You need a liveness result and a face match, reported separately, so that your reviewer can see which one failed.
• Is it one-to-one? Matching against the document the customer supplied is the standard design. Understand any other use of the face data.
• What does it do about the document? Ask whether document details are checked against authoritative sources, or only the photo is compared.
• What happens on a failure? Look for a route to retry, an alternative method and a human reviewer, not a flat rejection.
• Where does the data go? Ask where biometric data is processed and stored, who can access it, how long it is kept and how it is deleted.
• Can you show your reasoning? A supervisor will ask what the outcome was and what you did about it. The result needs to be recorded in a form you can retrieve.
• Is it accessible? Customers with limited vision, tremors, older devices or low confidence need a workable path.

We do not suggest any single score or vendor claim settles the matter. Independent testing results and the provider’s own documentation are useful inputs, but your obligation is to be satisfied on reasonable grounds, and your records should show how you reached that view.

What to record

The OAIC’s guidance says reporting entities need to retain records reasonably necessary to demonstrate CDD compliance, and not copies of full identity documents. In practice, the record of a selfie check should capture:

• what method you used to identify the customer, and why it suited that customer;
• the key identifying details and the document type;
• the verification outcome, including any failed attempt and what followed;
• the customer’s consent to the biometric step, or the alternative method used;
• the ML/TF risk assessment for that customer, and who approved the determination.

The point of the record is to let a supervisor reconstruct your reasoning months or years later. Our AML/CTF compliance checklist for real estate agents lists the other records an agency should have in place, and the AML training guide for real estate covers how to make sure staff handle exceptions consistently.

Our perspective

We built AML Guard around a simple idea: the platform should automate the lookups and the record keeping, not the judgement.

A selfie check is a good example. It is quick, and for many customers it is the most convenient route. But it is one input to a decision that belongs to a person. In AML Guard, each identity check, screening result and officer decision sits in one case record, so what was checked and what the officer decided are in the same place.

We designed the platform for Tranche 2 reporting entities, not adapted from banking tools, because the questions a real estate agency, law firm or accounting practice faces are different. A customer who declines a biometric check should be offered an in-person or video check, and a failed match is a prompt to look closer, not to accuse. The record should show that care.

AML Guard

Putting this into practice with AML Guard

If your agency is working out how identity checks, officer review and record keeping fit together, AML Guard is an Australian AML/CTF compliance platform for Tranche 2 reporting entities. It keeps one case record holding each identity check, screening result and officer decision, with ACN-based beneficial ownership determination and an officer approving each one.

AML Guard is not self-service; every firm starts with a demo. Book a demo, or see the pricing page for the subscription and per-check fees.

FAQ

Is a selfie check required under the AML/CTF Act?

No. Section 28(3)(a) requires reasonable steps to establish that the customer is who they claim to be, and AUSTRAC’s guidance gives three examples: comparing the customer with their photo ID in person, by video call, or with biometric technology. A selfie check is one acceptable route among those.

Does a passed selfie check mean the ID is genuine?

No. It shows that a live person’s face matches the photograph on the document supplied. It does not show that the document is authentic or that the name, date of birth and other details are correct, so document checks and wider CDD still apply.

Do I need the customer’s consent for a biometric check?

Yes, you should seek it. Biometric data used for automated verification is sensitive information under the Privacy Act, and OAIC guidance says consent should generally be sought first. Offer an in-person or video alternative for customers who decline.

What should I do if the selfie check fails?

Treat it as a flag to review. Check the cause, offer another attempt or another method, and record what you did. If you form a suspicion on reasonable grounds that the person is not who they claim, an SMR is due under section 41, and you must not tip off the customer.

Do I have to keep a copy of the customer’s ID?

The OAIC’s guidance says the AML/CTF Act does not require copies of full ID documents. You must keep records reasonably necessary to show your CDD compliance, such as what you did, the document type, key details and the outcome.

Sources

• Initial CDD for individuals, AUSTRAC
• Verifying your identity, Service NSW
• Verifying your ID in myID, myID
• 1:1 matching vs 1:many, Digital ID System
• How the system works, Digital ID System
• Handling ID documents for AML/CTF Act compliance, OAIC
• Privacy guidance for reporting entities under the AML/CTF Act, OAIC

Recommended

• Client Can’t Provide ID? AML/CTF Options
• Liveness detection for Australian AML checks
• Identity Document Capture Fails: What to Record