Biometric vs Cryptographic Checks: Understanding Their Role in AML and ID Verification

As ID verification with Companies House comes into effect, firms are expected, in most cases, to use both biometric and cryptographic checks to verify clients with Companies House. While biometric checks have long been a feature of AML processes, cryptographic checks introduce a new level of technical assurance by confirming that an identity document is genuinely issued and unaltered.

What Is a Biometric Check?

A biometric check verifies an individual’s identity by analysing their biological characteristics, particularly their facial features, against the photo on their identity document.

How Firmcheck’s Biometric (Advanced ID) Check Works

Firmcheck’s biometric process requires clients to provide:

• An image of their ID document
  This allows the system to review key passport characteristics such as fonts, spacing, holograms, and layout. These elements are compared with known, expected formats to identify potential tampering or inconsistencies.
  
  
• A proof of address
  This confirms the client’s residential information and supports AML requirements that require proof of identity and proof of address.
  
  
• A selfie (live facial image taken during the check)
  This is used for facial recognition matching. A live capture prevents the use of images that may have been copied or downloaded, adding additional integrity to the process.

Once these items are submitted, the biometric check returns:

1. Document surface analysis
   This analysis looks at visible features of the passport such as typographic consistency, embedded holographic elements, and page layout. While this is a strong first-level assessment, it is limited by image quality and lighting conditions and is not a definitive technical test of authenticity.
   
   
2. Likeness comparison (facial matching)
   The system compares the person’s selfie with the photo contained in the document they uploaded. This confirms whether the person presenting the ID appears to be the genuine owner of that document.
   

What This Achieves

For AML purposes:
This step helps a firm gather and verify the fundamental components required under AML regulations:

• Collection of proof of identity
• Collection of proof of address
• Confirmation that the face in the selfie matches the ID document
• A surface-level check that the ID document appears genuine

For ID Verification (IDV):
The biometric check confirms that the individual appears to match the passport and collects the information required to proceed to a cryptographic check, if needed.

What Is a Cryptographic Check?

A cryptographic check verifies the identity document (currently limited to passports) by reading the NFC chip embedded within it. This chip contains encrypted, official data from the issuing passport authority.

Cryptographic checks use the same technology you encounter daily in:

• Contactless debit/credit card payments
• Mobile wallet payments such as Apple Pay or Google Pay
• Airport e-gates where you tap your passport on a scanner

How Firmcheck’s Cryptographic Check Works

1. The client downloads the Firmcheck app to their smartphone.
2. They follow prompts to hold their passport against the back of their device, enabling the phone to read the NFC chip.
   The chip contains digitally signed information issued by the passport authority.
3. Firmcheck validates:
   
   • The passport number and expiry date match those captured during the biometric check
   • The digital signature embedded in the chip is valid
   • The chip has not been tampered with or cloned
     

This confirms that the passport is a genuine, government-issued document, not a replica or digitally altered image.

What This Achieves

For AML purposes:
A cryptographic check adds a much stronger form of document verification. It is especially useful for:

• International clients where local document formats may be unfamiliar
• Higher-risk clients where enhanced scrutiny is needed
  Cases where the biometric check flags document authenticity concerns
  

Because it validates the passport at a technical and cryptographic level, it provides significantly higher assurance than image-based checks.

For ID Verification (IDV):
A successful cryptographic check confirms that the passport is genuine and meets the technical authenticity requirements of IDV standards.

What If the Biometric Check Flags an Issue, but the Cryptographic Check Passes?

A mismatch between the two checks can happen, particularly because the biometric (image-based) check is dependent on photography conditions. Issues such as glare on holograms, poor camera quality, shadows, or reflections can make genuine documents appear suspicious.

In contrast, the cryptographic check authenticates the document using official, encrypted data stored in the chip. This makes it the superior verification method when assessing document authenticity.

AML guidance encourages firms to apply a risk-based approach, which means:

• Reviewing the document images again
• Considering whether the biometric ‘inauthentic’ flag is likely caused by image quality
• Weighing the stronger cryptographic result
• Determining whether further checks or clarifications are required

Using Biometric and Cryptographic Checks in Firmcheck

Firmcheck makes it simple to request both checks as part of your verification process for both AML and Companies House Verification.

Within Firmcheck, you can request a Biometric and Cryptographic check separately or have both completed sequentially. If you want to complete checks in bulk, both to meet your IDV requirements quickly or to update and improve your AML documentation, you can also request these checks in bulk, selecting up to 50 individuals to send checks to at once. 

• Biometric / Advanced ID check: £4 + VAT (included in the compliance subscription)
• Cryptographic check: Included in the subscription at no additional cost.