Video identification in Germany: the rules behind the call

The German Money Laundering Act, the Geldwäschegesetz or GwG, obliges a bank, a payment institution and a crypto-asset service provider to find out who their contracting party is before the business relationship starts. Identification is the narrow part of that duty: collecting the name, the date and place of birth, the address and the nationality, then verifying them against a document the law accepts. Around it sit the wider duties on customer due diligence, the purpose of the relationship and ongoing monitoring, which anti-money laundering in Germany covers.

In a branch, verification means a person holding your passport in their hands. The GwG also allows procedures that do not require physical presence, which is where video identification comes from. The duty is identical either way, so the question supervision asks about a remote method is whether it reaches a security standard comparable to the counter.

The rule set is BaFin Circular 3/2017 (GW), published on April 10, 2017 and in force since June 15, 2017, which replaced the earlier Circular 1/2014 (GW). It applies to every entity under the GwG that BaFin supervises, and it reads as a list of conditions, not as a permission slip.

Only trained employees of the obliged entity, or of a third party the duty has been outsourced to, may run a session, and they have to sit in separated rooms with access control. The video chat must be end-to-end encrypted, and the identification has to run in real time and without interruption: a recorded video does not satisfy the GwG. The employee checks the security features of the document, drawn from the categories the circular names, among them diffraction-optical features such as holograms, the personalization technique, the material and the security printing. During the transmission the person enters a number sequence, a TAN, generated centrally for that one session and sent to them by email or text message. That code is why a session cannot be assembled from parts: it binds the live call to a channel the provider already reaches the person through.

A BaFin circular states a supervisory practice. The German Federal Ministry of Finance has drafted an ordinance to carry the same substance in law: the Verordnung zur geldwäscherechtlichen Identifizierung durch Videoidentifizierung, short GwVideoIdentV, whose reference draft went out for comment and which amends the GwG and the Tax Code. The register entry records the ministry as the lead and the associations' responses as part of the public file.

For a compliance team the consequence is that the method is being kept, not retired, and that its conditions will sit in a text harder to change than a circular. If you are writing an onboarding specification now, the circular is still what an audit measures you against, and the draft ordinance tells you which way the conditions are heading.

The second remote route uses the chip in the German identity card. The holder activates the online ID function, holds the card against a phone, and enters a six-digit PIN; the chip and the provider's terminal authenticate each other before any data moves, so the provider receives attributes the card itself vouches for. The BSI writes the technical guidelines the chip and the readers follow.

The difference that decides a product question is the assurance level. The eID function was notified under eIDAS at level "high", while a video session, however well run, rests on a human judgment about a document in a camera frame. That gap is why some products accept video and others insist on the card. Friction is the other half of the trade: a video call needs no reader and no activated PIN, which is why it still carries a large share of German account openings.

The eIDAS Regulation sorts electronic identification schemes into three levels of assurance, low, substantial and high, by how much confidence the scheme gives that a person is who they claim to be. A level is a property of the scheme, not a label a provider awards itself, and a member state notifies a scheme at a level for cross-border recognition.

Read it as a procurement question. A low-risk product can live with a lower level and keep the customers who abandon a harder flow; a product that moves large sums for a legal entity cannot. The same ladder appears in the identity assurance work of NIST under different names, which is why identity teams in German institutions often argue in two vocabularies at once.

Less than people expect. MiCA governs authorization, governance and conduct for a crypto-asset service provider and adds no identification method of its own: the identification duty comes from the AML rules, the same ones a bank follows. A provider going through the CASP licensing process therefore builds the same video or eID flow a payment institution builds, and crypto AML covers the transfer-side duties on top.

What differs is the attention. German supervision has watched remote onboarding at crypto providers closely, and MiCA in Germany sets out how BaFin handles the authorization. If you came looking for a route that skips identification, this page is the wrong one: the rules require it, and a provider that offers an account without it is telling you something about itself.

The circular's conditions were written for a world where a face in a video stream was evidence of a person in a room. Generated video and injected camera feeds break that assumption, and the attack does not need to fool a human for long: it needs to survive one session. Deepfake attacks on remote onboarding sets out which part of the check each attack class defeats and why detection that only inspects pixels cannot settle the question.

That is the honest reason the eID route and a qualified electronic signature keep coming up in German identity discussions. Both move the proof from a judgment about an image to a cryptographic operation a chip performs, which an attacker cannot imitate by rendering something convincing.

Yes. BaFin Circular 3/2017 (GW) remains the supervisory rule for the procedure, and the Federal Ministry of Finance's draft ordinance is written to keep the method, not to remove it. What has tightened over the years is the conditions on the session, not the availability of the route.

A session that goes smoothly is a matter of minutes, because the employee only has to see the document, see you, and receive the code back. The time most customers actually lose sits before and after: waiting for a free agent at a busy hour, and repeating the whole thing when the light, the camera or the connection was not good enough for the document check.

Because the code ties the live session to a channel that already belongs to you. BaFin Circular 3/2017 (GW) requires a number sequence generated centrally for that one identification and delivered by email or text message, which the person enters during the transmission. Without it, a session would prove only that someone showed a document to a camera.

Yes, with a passport or a national identity card the provider's procedure accepts, which is the usual route for a customer who lives in Germany without German citizenship. The eID route is the one that depends on a German card, since it reads that card's chip. Each provider decides which documents its video procedure handles, so the list differs between institutions even though the GwG duty behind it does not.