Biometric Verification: Fingerprint, Facial and Voice

Biometric verification is the 1:1 comparison of a live biometric sample against a previously enrolled reference template to confirm that a person is who they claim to be. It covers fingerprint, facial and voice recognition. These processing activities are classified as special category data under Article 9(1) of the GDPR (Regulation EU 2016/679), and as of 2 August 2026 fall within the scope of the EU AI Act (Regulation EU 2024/1689).

This article is for informational purposes only and does not constitute legal, financial, or regulatory advice. Regulatory references are accurate as of the publication date. Requirements vary by jurisdiction and sector. Consult a qualified professional for guidance specific to your situation.

What Is Biometric Verification?

Biometric verification performs a 1:1 match between a live biometric sample and a stored template linked to a known individual. It is fundamentally different from biometric identification, which compares a sample against an entire database of unknown individuals (1:N matching). This distinction has direct and significant consequences under EU law.

As of 2 August 2026, when the EU AI Act applies in full, biometric verification (1:1) is not automatically classified as high-risk under Annex III of Regulation (EU) 2024/1689 — but biometric identification (1:N) is (EUR-Lex, EU AI Act Annex III).

The Three Primary Modalities

The Equal Error Rate (EER) is the operating point at which the False Acceptance Rate (FAR) equals the False Rejection Rate (FRR). For high-security deployments, the target FAR is below 0.01%. A lower EER indicates a more accurate system.

Verification vs Identification: A Critical Legal Distinction

The EU AI Act draws a sharp line between these two operations. Biometric verification — confirming that a selfie matches the photo on a passport — does not automatically trigger high-risk obligations. By contrast, real-time remote biometric identification by law enforcement is prohibited under Article 5 of Regulation (EU) 2024/1689, subject to narrow exceptions. Private operators who deploy facial recognition to identify individuals from a database (1:N) in publicly accessible spaces fall under Annex III high-risk obligations, including mandatory risk management systems, human oversight, logging and accuracy declarations under Articles 9 to 16.

The Regulatory Framework

GDPR: Biometric Data as Special Category Data

Biometric data processed for the purpose of uniquely identifying a natural person constitutes special category data under Article 9(1) of the GDPR. Processing is prohibited unless one of the exceptions in Article 9(2) applies. The most commonly relied upon grounds in a business context are:

• Article 9(2)(a): Explicit consent of the data subject.
• Article 9(2)(b): Necessity for employment obligations, subject to national law safeguards.
• Article 9(2)(g): Substantial public interest, on the basis of EU or Member State law.

A Data Protection Impact Assessment (DPIA) is mandatory before any biometric processing deployment under Article 35 of the GDPR, as confirmed by supervisory authority guidance across the EU (GDPR Article 35, EUR-Lex).

Data controllers must also apply the principle of data minimisation: where technically feasible, only the biometric template — not the raw image — should be stored, and only for as long as the processing purpose requires.

EU AI Act: Obligations from 2 August 2026

As of 2 August 2026, the EU AI Act requires providers and deployers of high-risk AI systems to comply with the obligations in Articles 9 to 16, covering: risk management systems, training data quality and representativeness, technical documentation, automatic event logging, transparency to deployers, human oversight measures, and accuracy, robustness and cybersecurity requirements.

Biometric identification systems listed in Annex III are subject to conformity assessment before market placement. Real-time remote biometric identification in publicly accessible spaces by law enforcement is prohibited under Article 5, except in narrowly defined circumstances involving specific serious crimes.

AMLD6, AMLA and Biometric KYC

The 6th Anti-Money Laundering Directive (AMLD6, Directive 2024/1640) and the upcoming EU Anti-Money Laundering Authority (AMLA) regulations reinforce identity verification obligations at the point of customer onboarding. Biometric verification is a recognised method for satisfying know-your-customer (KYC) requirements, provided it complies with applicable GDPR obligations. Global AML penalties reached $4.6 billion in 2024, underscoring the cost of non-compliance. Biometric verification does not substitute for documentary due diligence.

For more on document fraud detection techniques that complement biometric verification, see our article on AI document fraud detection.

Liveness Detection

Liveness detection is the technical layer that distinguishes a live person from a presentation attack — a printed photo, a 3D mask, or an injected deepfake video feed. It is an essential component of any remote biometric verification system.

Passive liveness detection — which analyses texture, depth and micro-motion without requiring any user action — reduces presentation attack success rates by over 95% in benchmarks conducted under ISO/IEC 30107-3, according to iBeta evaluation results (ISO/IEC 30107-3).

Active vs Passive Liveness

• Active liveness: The user is prompted to perform a specific action — blink, turn their head, read a displayed code. Effective against static spoofs but introduces friction in the user journey.
• Passive liveness: Analysis runs in the background without user instruction. It detects deepfakes, masks and digital video injection attacks. Recommended for low-friction onboarding flows.

The eIDAS 2.0 framework and the EU Digital Identity Wallet (EUDIW) reference liveness detection standards for remote identity verification at Level of Assurance High, reinforcing the role of certified liveness checks across regulated sectors.

Performance Metrics

FAR, FRR and EER in Practice

• FAR (False Acceptance Rate): The probability that an impostor is incorrectly accepted by the system. A FAR of 0.01% means that on average one fraudulent attempt in 10,000 succeeds.
• FRR (False Rejection Rate): The probability that a legitimate user is incorrectly rejected. A high FRR generates friction, support costs and customer abandonment.
• EER: The operating point where FAR equals FRR. It is the standard metric for comparing biometric systems. Typical values: fingerprint 1–2%, face 0.1–2%, iris 0.01%.

For regulated KYC applications, industry practice targets a FAR below 0.01% with ISO/IEC 30107-3 Level 2 certified liveness detection.

CheckFile Platform Data

Our platform records a fraud detection recall of 94.8%, a false positive rate of 3.2%, and an average verification time of 4.2 seconds. Identity document fraud accounts for 19% of all document fraud detected — a figure that makes the combination of documentary analysis and biometric verification not merely best practice, but operationally necessary for institutions with meaningful fraud exposure.

Deployment: Best Practices

Matching Modality to Context

The appropriate biometric modality depends on the channel, the risk level and the regulatory requirements. Fingerprint scanning is well-suited to physical environments such as branches and kiosks. Facial recognition is the dominant choice for remote digital onboarding. Voice recognition integrates naturally into telephone and call centre authentication flows.

Building a Layered Identity Verification System

Biometric verification alone does not satisfy AML due diligence obligations. It must be combined with documentary verification (OCR analysis, forgery detection, MRZ validation) and data verification (sanctions screening, PEP checks, address verification). This layered approach constitutes a compliant KYC programme under AMLD6 requirements.

For a broader view of how employers and regulated entities structure identity checks, see our article on background check documents and employer verification.

Practical GDPR Compliance Steps

1. Conduct a DPIA before any biometric processing commences.
2. Identify a valid legal basis under Article 9(2) of the GDPR.
3. Apply data minimisation: store only the template, not the raw biometric image, where technically feasible.
4. Define retention periods and implement automated deletion of templates on expiry.
5. For workplace biometrics, verify that applicable national law (collective agreements, works council consultation) permits the processing.
6. Document the processing activity in the Article 30 Records of Processing Activities.
7. In the event of a data breach involving biometric templates, notify the supervisory authority within 72 hours under Article 33 of the GDPR.

Risks and Limitations

Biometric verification carries specific risks that differ from those of password-based authentication. Biometric templates are permanent: unlike a password, they cannot be reset if compromised. Injection attacks — where a synthetic video stream is substituted for the camera feed — bypass systems without certified liveness detection. Algorithmic bias, documented across age, gender and ethnic groups, can expose operators to discrimination risk; Article 10 of Regulation (EU) 2024/1689 mandates training data quality and representativeness requirements to address this. Operators processing biometric data outside the EU must comply with Chapter V transfer requirements of the GDPR.

---

Frequently Asked Questions

Is biometric verification required for KYC compliance?

Biometric verification is not universally mandatory for KYC. AMLD6 requires identity verification from reliable, independent sources but leaves the choice of methods to obliged entities. Biometrics become mandatory in specific national frameworks — for example, where a regulator requires Level of Assurance High verification for remote onboarding — or where internal risk policies demand it for high-risk customer segments.

What is the difference between biometric verification and identification under the EU AI Act?

Biometric verification (1:1) compares a live sample against a template linked to a known, pre-enrolled individual. Biometric identification (1:N) searches an entire database to find a possible match for an unknown individual. As of 2 August 2026, only biometric identification is presumed high-risk under Annex III of Regulation (EU) 2024/1689. Real-time remote biometric identification by law enforcement in publicly accessible spaces is prohibited under Article 5, except in cases of imminent threat involving specific serious crimes.

Does biometric processing always require explicit consent under the GDPR?

Explicit consent under Article 9(2)(a) is a valid legal basis but not the only one. For workplace biometrics, supervisory authorities including the CNIL have noted that consent may not be freely given due to the power imbalance between employer and employee, making other legal grounds necessary. For consumer-facing digital services, explicit consent remains the most common basis. Regardless of the legal basis, a DPIA is always required before deployment.

What is liveness detection and why is it necessary?

Liveness detection verifies that the biometric sample comes from a physically present person, rather than a photograph, mask or deepfake. Without this layer, a facial verification system can be defeated by a printed photo. ISO/IEC 30107-3 Levels 1 and 2 are the market reference standards for presentation attack detection. Certified liveness detection is a prerequisite for verification systems seeking to meet Level of Assurance High under eIDAS 2.0.

How should biometric templates be handled under the GDPR?

Biometric templates must be encrypted at rest and in transit, stored separately from identity data, and deleted as soon as the processing purpose is fulfilled. Retention periods must be defined before deployment and recorded in the Article 30 register. If a data breach involves biometric templates, notification to the supervisory authority within 72 hours is mandatory under Article 33 of the GDPR. Because a compromised biometric template cannot be changed, the security controls applied to template storage require a higher standard of care than those applied to standard personal data.

---

Biometric verification is a technically mature, legally regulated capability that forms an increasingly central part of compliant identity verification programmes. Deploying it responsibly requires a clear understanding of the GDPR special category framework, the EU AI Act obligations that apply from August 2026, and the technical standards that govern liveness detection and accuracy.

CheckFile provides a document and identity verification platform that integrates biometric analysis within a layered, AMLD6-compliant framework. All processing is hosted exclusively within the European Union. Explore our security architecture, compare pricing plans based on your verification volume, or visit our fraud and data guide for a broader view of the threat landscape.