Understanding Digital Identity Compliance

Why compliance matters

Identity checks often sit inside regulated flows: account onboarding, age gates, payments and financial services. In these flows the check is not only a fraud control. It is also evidence that the business met an obligation, and that evidence may need to hold up months or years later in an audit or a regulator's review.

Requirements vary by market. The same product can face different rules in Zurich, Berlin and Lisbon, and a different set again depending on whether it holds a financial licence, sells age restricted goods or simply wants to keep fake accounts out. Compliance work starts with knowing which of these situations applies to you.

This article gives a general overview. It is not legal advice, and the details of your obligations depend on your licence, your sector and the markets you serve. Confirm them with your legal or compliance team.

Customer due diligence in general terms

Most identity obligations in regulated sectors come from anti-money laundering rules. The usual label is KYC, and the underlying process is customer due diligence. In broad terms it asks a business to:

• Identify the customer. Collect name, date of birth and other identifying data.
• Verify that identity. Check the data against a reliable source, typically an identity document, and confirm the person presenting it is its holder.
• Understand the relationship. Know what the account is for and, for companies, who the beneficial owners are.
• Monitor over time. Keep the information current and react when activity no longer fits the profile.

The depth of each step is meant to scale with risk. A low value account might need simplified checks, while a high risk customer or jurisdiction calls for enhanced due diligence. That risk-based approach is what lets a business run lighter flows where they are justified and stronger ones where they are needed. The AML framework sets the outcome; how you design the flow is largely up to you.

Switzerland

Two sets of rules matter most for identity verification in Switzerland.

The revised Federal Act on Data Protection (nFADP) has been in force since 1 September 2023. It brought Swiss law closer to the GDPR in structure, with principles such as purpose limitation, proportionality, privacy by design and privacy by default. Biometric data that uniquely identifies a person is treated as sensitive personal data, which raises the bar for how it is processed, explained to users and protected. A face match used to confirm a document holder falls into this category.

Anti-money laundering rules apply to financial intermediaries, such as banks, payment providers, asset managers and many crypto businesses. These rules, together with guidance from the supervisor and self-regulatory organisations, set out how customers must be identified, including requirements for remote onboarding. Which exact rules apply depends on the licence and how the business is supervised. Our Switzerland coverage page lists the documents supported for the Swiss market.

European Union

In the EU, the GDPR governs personal data processing. Biometric data used to uniquely identify a person is a special category of data, so a business needs both a lawful basis and an applicable condition for processing it, plus the usual transparency, security and data subject rights.

On the anti-money laundering side, the EU adopted a package that replaces much of the old directive-based approach with a directly applicable regulation, the AMLR, applying from July 2027. A single rulebook should reduce the differences between member states, but businesses will need to review their customer due diligence procedures against it before that date.

eIDAS 2.0 introduces the European Digital Identity Wallet, which member states are required to offer to citizens. Over time, wallets may become an accepted way for people to share verified attributes, such as proof of age or identity, without handing over a full document image. It is worth designing your flow so a new evidence source can be added later without rebuilding everything.

Cross-border considerations

Data residency, retention, and what you store after a check all change with jurisdiction. Plan the stack before you scale.

Three questions come up in almost every cross-border rollout:

1. Where is data processed and stored? Transfers out of Switzerland or the EU need a legal basis, and some customers or regulators expect data to stay in a specific country. See our glossary entry on data residency.
2. Which subprocessors touch the data? You are accountable for your vendor chain. Ask for a current list, such as our subprocessors page, and check it against your records of processing.
3. Which documents are accepted? Coverage of passports, ID cards and residence permits differs by country, and some documents carry an NFC chip while others do not.

Retention and audit trail

Two obligations pull in opposite directions. Anti-money laundering rules often require you to keep identification records for a defined period after the relationship ends. Data protection rules require you to keep nothing longer than necessary.

The practical answer is to separate what you keep from what you discard:

Whatever you keep, make it reconstructable. An auditor should be able to see which checks ran, which version of the flow was used, what the outcome was and who reviewed any manual case.

Practical takeaways

Pick controls that match your risk and obligations. Verification should support compliance without becoming the product's bottleneck.

A short checklist before launch:

• Map each market to the rules that apply to your licence and sector.
• Define risk tiers and the checks each tier requires.
• Document your lawful basis for processing biometric data.
• Set retention periods per data type, and automate deletion.
• Confirm where data is hosted and which subprocessors are involved.
• Make sure every decision leaves an audit record.

secuveri is built for this kind of setup. Data is processed and stored in Switzerland, on-premise deployment is available, and you choose which checks run in each flow. If you want to talk through a specific market, book a call.