Liveness detection is mandatory in Swiss onboarding. Is it enough?

From 1 November 2026, Swiss financial intermediaries supervised by FINMA must add liveness detection to every online onboarding route, including the new e-ID route ¹². Liveness detection answers one question: is a real person present at capture? It does not answer whether the video stream itself was tampered with. The circular is technology-neutral and does not name that second risk. Whether liveness detection delivers real protection therefore depends on a design decision each institution makes itself, and the board should know which decision was taken.

What FINMA changed on 8 October

On 8 October 2026 FINMA adopted a partial revision of Circular 2016/7 "Video and online identification", which sets due diligence expectations for digital client onboarding. It takes effect on 1 November 2026 ¹.

The revision does four things. It admits the Swiss e-ID as an identification document for online onboarding once the e-ID Act is in force, which FINMA expects in 2027 ³. It treats identity documents with a QR code, such as the Swiss driving licence, like documents with a machine-readable zone ¹³. It adds liveness detection to the document-copy route, the qualified-electronic-signature route and the e-ID route ². And it allows digital procedures that reliably tie the client or the client's device to a place of residence ²³.

FINMA's explanatory report gives the reason: the fraud risk rises with artificial intelligence, video manipulation and deepfake technology, and manipulated videos or forged documents are increasingly hard to detect ³. It defines liveness detection as technical procedures that check whether the counterparty is physically present and alive, rather than a manipulation using photos, videos or other means of deception ³. Institutions using the qualified-signature route get one year from entry into force to adapt their residence check and liveness detection ².

Four questions behind one control

"We have liveness detection" is a statement about one control. Online onboarding rests on four separate assurances, and the revision touches each differently. This is our own model, not FINMA's.

The weak point is the third row. A presentation attack puts a fake in front of a real camera, for example a printed photo or a replayed video. An injection attack bypasses the camera and feeds manipulated data into the capture pipeline. The European technical specification CEN/TS 18099 treats them separately: it covers detection of injection attack instruments, mitigation and test plans, and it leaves presentation attack testing to ISO/IEC 30107, while noting that presentation attack detection can serve as one defense ⁴.

FINMA's report mentions technical means to detect deepfakes and manipulated videos as important flanking elements ³, but the circular text itself prescribes only that the institution "ensures" the request comes from the client ². Our assessment: a liveness check on a compromised capture channel verifies what the attacker chooses to show. Two vendors can both claim liveness detection and offer very different protection, so the claim should be tested against the attack types it was designed for.

Two further points shift where the risk sits:

• The e-ID does not remove the binding problem. The institution checks that the e-ID is valid and was issued to the client, then still checks residence and liveness ². The government operates the trust infrastructure and issues the credential ⁵, so the document assurance gets stronger. The binding and channel assurances remain with the institution.
• Provenance is checked less rigorously than assumed. FINMA observed in supervision that not all intermediaries verify the banking status of the institution sending the required transfer. Credit card issuers, PayPal or Twint do not count as banks under the circular ³. A weak provenance check removes the safety net that liveness gaps rely on.

What it means for Swiss institutions

For banks, securities firms and other FINMA-supervised intermediaries, three consequences follow.

First, accountability stays with the institution. FINMA states that intermediaries are responsible for compliance with the Anti-Money Laundering Act and decide for themselves which identification documents they accept ³. Outsourcing the onboarding flow to a vendor does not move that responsibility.

Second, the scope is narrower than before. The circular now applies only to intermediaries supervised by FINMA, not to the other intermediaries the old reference captured, such as casinos ³. Unsupervised intermediaries should check which standards apply to them instead.

Third, the timing is tight. The date is 1 November 2026 for most routes and one year later for the signature route ¹². The e-ID route cannot be used before the e-ID exists: the swiyu wallet infrastructure is still in a sandbox stage for future issuers and verifiers ⁵, and the federal e-ID site gives no launch date. Institutions can use the lead time to test verifier integration, but should not plan on a date.

Beyond Switzerland, the same pattern applies wherever remote identity proofing is regulated. A control named in a rule is a starting point, and the protection comes from how it is specified, tested and monitored.

Questions for leadership

1. Which of the four assurances does our onboarding flow cover, and which are we assuming the vendor covers?
2. Can we show how our liveness detection performs against injection attacks, not only presentation attacks, and who tested it?
3. Do we verify that the incoming transfer really comes from a bank comparable to a Swiss-authorized one, and is the check automated?
4. If a vendor changes its capture software, who notices that our assurance level changed?
5. What fraud signals from newly opened accounts reach the risk committee, and how quickly?