What does EBA/GL/2022/15 (remote customer onboarding) say about AI in banking?

What are the key points of EBA/GL/2022/15 (remote customer onboarding)?

• Date and status: published 22 November 2022 as the EBA final report; apply from 2 October 2023. Issued under Article 16 of Regulation (EU) No 1093/2010, so competent authorities must say whether they comply or intend to comply.
• Scope: steps institutions take when adopting or reviewing solutions to comply with Article 13(1) points (a), (b) and (c) of Directive (EU) 2015/849 when onboarding new customers remotely, and when relying on third parties under Chapter I, Section 4 of that directive.
• Governance and policies (paragraphs 9-12): written policies and procedures for remote onboarding, with management body approval of the policy and the ability to demonstrate it to the competent authority.
• Pre-implementation assessment (paragraphs 13-16): assess adequacy, completeness and accuracy of data, impact on ML/TF, operational, reputational and legal risks, test for impersonation fraud and ICT security risks, and run end-to-end testing before use.
• Ongoing monitoring (paragraphs 18-22): regular and ad hoc reviews of the quality and accuracy of data collected, with defined triggers and remedial actions; also applies to fully automated solutions.
• Identity matching and liveness (paragraphs 38-41): where biometric data is used, ensure it is sufficiently unique, use 'strong and reliable algorithms' for matching, apply additional controls when confidence is insufficient, and in unattended onboarding perform liveness detection and match photographs or video to the document image.
• Document checks (paragraphs 33-37): where OCR or MRZ features read documents automatically, the institution must ensure that they capture information accurately and consistently.
• Outsourcing and third parties (paragraphs 46-49): decide in policy which functions are performed by the institution, third parties or outsourced providers; for outsourced CDD, apply the EBA outsourcing guidelines, monitor the provider through reporting, visits or testing, and keep control of stored customer data.
• ICT and security (paragraphs 50-53): manage ICT and security risk of the onboarding process, including where outsourced to group entities, using secure channels and cryptographic protocols and, for multi-purpose devices, a secure execution environment.

What did EBA/GL/2022/15 (remote customer onboarding) change for banks?

Before the Guidelines, the AML directive did not say what was acceptable in a remote setting, and supervisory expectations differed across Member States. EBA/GL/2022/15 set a common EU standard for remote identity verification, including for biometric and automated tools, so banks buying AI-enabled identity checks must show they assessed, tested and monitor the tool. They remain the reference until the AML Regulation (EU) 2024/1624, which applies from 10 July 2027, and the technical standards and AMLA guidelines it calls for take over; No replacement or repeal had been identified as of 5 October 2026.

What does EBA/GL/2022/15 require of banks that onboard customers remotely, including with AI-based tools?

EBA/GL/2022/15 requires a bank that onboards customers remotely to set written policies approved at management level, assess any remote solution before use, monitor it continuously, and verify identity with controls proportionate to the ML/TF and fraud risk. For biometric and automated verification it expects strong and reliable matching algorithms, liveness detection in unattended journeys, reproducible document checks and escalation to a face-to-face check when evidence quality is poor. If a provider runs the process, the bank keeps the CDD responsibility, applies the EBA outsourcing guidelines and monitors the provider. The Guidelines have applied since 2 October 2023 and do not mention AI explicitly, but they are the standard supervisors apply to AI-enabled identity verification.

The Guidelines were requested by the European Commission to address divergent national supervisory expectations on remote customer due diligence. They are addressed to the AML directive's obliged entities, so they apply to banks, payment institutions and other financial institutions across the EU, and they leave the choice of technology to the institution provided the stated conditions are met.

They connect with the wider EU rulebook in three ways. DORA applies to the ICT dependency on the verification provider, including the register of information and the Article 30 contract terms. The EU AI Act classifies certain remote biometric identification as high-risk, while biometric verification that only confirms that a person is who they claim to be is carved out of that category; a bank should check each tool against the AI Act separately. And the AML Regulation (EU) 2024/1624, which applies from 10 July 2027, will move the underlying customer due diligence rules from a directive to a directly applicable regulation.

The EBA gives no guidance that banks may use an AI vendor's certification as a substitute for their own assessment: the institution must be able to demonstrate to its competent authority that the solution is adequate, reliable and remains so.

WHAT THIS MEANS IN PRACTICE

• Document a pre-implementation assessment for every remote onboarding tool, including impersonation-fraud and deepfake testing, before go-live.
• Obtain from the vendor the liveness and matching performance data needed to show the algorithms are strong and reliable, and re-test after model updates.
• Set monitoring triggers (for example rising fraud rates or false rejections) that force an ad hoc review, and keep a fallback to face-to-face verification.
• Treat the vendor as an ICT third-party provider: register it, apply the contract terms and plan an exit, in line with DORA.
• Track the AML Regulation (applies from 10 July 2027) and AMLA technical standards for changes to remote identification rules.