FINMA Circular 2016/7: Liveness Detection Now Required

Switzerland's financial regulator has drawn a clear line in the sand on AI fraud. As of November 1, 2026, FINMA's revised Circular 2016/7 on video and online identification is in force. The practical implication for Swiss financial intermediaries is specific: liveness detection is no longer a best-practice recommendation. It is a legal requirement.

The revision, adopted on October 8, 2026 following a consultation process that opened in December 2025, responds directly to the surge in AI-generated identity fraud. Deepfake videos, synthetic faces, and injection attacks against biometric pipelines have all been cited by FINMA as driving the update. The regulator has not prescribed which technology firms must use — but it has made clear that passive presentation of a document or photo is no longer sufficient to satisfy the online identification standard.

What the Revised Circular Changes

Three changes are operative from November 1, 2026.

1. Liveness Detection Is Now Mandatory

For all online identification procedures, financial intermediaries must include liveness detection as an additional security layer. The purpose is to confirm that the person being identified is physically present and is a live human — not a photograph, pre-recorded video, or AI-generated synthetic presentation.

FINMA has not mandated a specific technical approach. Active liveness tests (where the user performs a gesture or follows a prompt) and passive liveness tests (where behavioral and sensor signals are analyzed without user action) both satisfy the requirement, provided the system can demonstrate it is designed to counter known spoofing and injection vectors. Given the pace at which injection attacks against liveness detection systems have accelerated, passive-only approaches will face increasing scrutiny as the threat model evolves.

2. The Swiss e-ID Is Admitted for Online Identification

The revision adds a new identification pathway using the Swiss federal e-ID, introduced under the Federal Act on Electronic Identity and Other Electronic Credentials. The e-ID is expected to launch on December 1, 2026 — four weeks after the circular takes effect — as an optional, free credential distributed via the federal Swiss wallet app.

Under the revised circular, the e-ID can be used for online identification (not video identification). Financial intermediaries using the e-ID must confirm that the credential was issued to the person making the request, verify that it is valid and has not been revoked, verify the residential address separately, and confirm — through liveness detection — that the identification request originates from the account holder themselves.

The e-ID pathway does not eliminate the need for a bank transfer to supplement online identification. That safeguard requirement remains in place.

3. QR-Code Documents on Equal Footing with MRZ Documents

The revision extends the category of accepted identification documents to include any document carrying a QR code, placing it on the same level as documents with a machine-readable zone. The Swiss driving licence, which carries a QR code but no MRZ, can now be used as an identification document for online identification without a workaround.

Comparison: Before and After November 1, 2026

Requirement	Before November 2026	From November 1, 2026
Liveness detection	Recommended	Mandatory
Swiss e-ID	Not admitted	Admitted for online identification
QR-code documents	Not on equal footing	Equal to MRZ documents
Bank transfer supplement	Required	Still required
Video identification using e-ID	Not applicable	Not admitted
Advanced QES for identification	Not permitted	Still not permitted

Who Is Affected

The revised Circular 2016/7 applies to all Swiss financial intermediaries as defined under the Anti-Money Laundering Act. This includes banks, securities dealers, insurance companies, asset managers, payment institutions, and any firm carrying out financial intermediation activities under FINMA supervision.

It also applies to firms that outsource their identification process to a third-party provider. Under FINMA's outsourcing rules, the financial intermediary remains responsible for the compliance of the identification procedure regardless of which technology vendor performs the actual liveness check. Firms using third-party KYC providers must confirm that those providers' systems meet the revised standard.

Foreign firms operating in Switzerland under equivalence or passporting arrangements that rely on FINMA's online identification pathway should review their current setups. The revised circular does not distinguish between domestic and foreign institution-operated procedures where FINMA's rules govern the identification.

The Transition Period

A one-year transition applies specifically to the liveness detection and residence verification requirements for QES-based (Qualified Electronic Signature) online identification. Institutions have until November 1, 2027 to make the technical adjustments required for QES procedures.

The transition does not cover the e-ID pathway. Where financial intermediaries choose to adopt e-ID identification from December 2026 onwards, the full revised requirements — including liveness detection — apply without any transition delay.

The transition also does not apply to new clients onboarded from November 1, 2026 onwards under existing document-based online identification. For those onboarding sessions, liveness detection is required immediately.

The Threat Context Behind the Revision

FINMA's decision to mandate liveness detection reflects a threat environment that has shifted materially since the original Circular 2016/7 was drafted in 2016. That version addressed the risk of fraudulent document submission and identity substitution by a person presenting someone else's documents.

The 2026 revision addresses a different threat: identity creation that never involved a real document or a real person at any stage. Synthetic faces generated by generative AI, combined with virtual camera injection to bypass the camera pipeline, produce presentations that early passive liveness systems were not designed to detect.

The multimodal biometric approach that is emerging as an industry standard — combining facial geometry analysis, micro-expression signals, infrared imaging, and device-side behavioral patterns into a composite risk score — represents the technical direction regulators now expect. FINMA's requirement is not a prescription of that specific method, but it creates a legal obligation to demonstrate that the approach used is capable of detecting modern synthetic presentations.

What Compliance Teams Must Do Now

For compliance teams at Swiss financial institutions, the November 1 deadline introduces a concrete set of action items.

Audit your current identification vendor. Ask explicitly whether their liveness detection system addresses injection attacks as well as presentation attacks. These are distinct threat vectors. A system that flags a printed photo as non-live may still fail against a virtual camera feeding a deepfake video directly into the identification pipeline.

Review your outsourcing agreements. If you use a third-party KYC provider, your outsourcing contract should specify that the provider operates at or above the standard FINMA's revised circular requires. Document that specification explicitly.

Prepare for the e-ID. The Swiss e-ID launches December 1, 2026. Expect initial adoption to be low, but rising as awareness grows. Build your e-ID identification pathway now so you are not scrambling when corporate and retail clients begin presenting e-ID credentials.

Update your document acceptance policy. If you have been rejecting the Swiss driving licence as an identification document due to the absence of an MRZ, that position is no longer necessary. QR-code documents are now explicitly accepted.

Document your liveness system's threat model. FINMA does not audit to a checklist. If a supervisory examination scrutinizes your online identification procedure, the question will be whether you can demonstrate that your chosen approach addresses the threats the circular was written to counter. That documentation should exist now, not at the time of the examination.

The autonomous identity monitoring approach that Joinble's agent layer provides is designed for exactly this compliance posture: continuous verification, documented decision chains, and an updatable risk model that can incorporate new threat intelligence as FINMA's supervisory expectations evolve.

Switzerland in the Broader European KYC Landscape

Switzerland is not an EU member state and does not apply eIDAS 2.0 directly. But the direction of travel in Swiss regulation has increasingly aligned with European standards — particularly in the emphasis on digital identity, liveness detection, and the admission of government-issued electronic credentials for onboarding.

The Switzerland Transparency Act that entered into force on October 1, 2026 and the revised Circular 2016/7 that follows one month later represent a coherent compliance upgrade cycle for Swiss financial services. Teams running under-resourced compliance functions will feel the cumulative weight of these two changes together: the beneficial ownership register obligation, the adviser scope expansion, and the liveness detection mandate have all arrived within a single regulatory quarter.

Frequently Asked Questions

Is liveness detection required for all remote account opening in Switzerland from November 1, 2026? Yes. The revised Circular 2016/7 makes liveness detection mandatory for all online identification procedures. The one-year transition applies only to the technical adjustment of QES-based identification, not to standard document-based online onboarding.

What counts as compliant liveness detection under FINMA? FINMA has not mandated a specific technology. The standard is functional: the system must confirm that a live person is present and must be designed to address known spoofing and injection attack vectors. FINMA does not prescribe active versus passive liveness, but the system must demonstrably counter modern synthetic identity threats.

Can the Swiss e-ID be used for video identification? No. The revised circular permits the Swiss e-ID for online identification only. Video identification is excluded because the e-ID document itself carries neither an MRZ nor a QR code, both of which are required for the document checks in video identification.

Does the transition period apply to new clients onboarded from November 1? The one-year transition applies specifically to QES-based online identification procedures that need technical adjustment. New clients onboarded under document-based online identification from November 1, 2026 require liveness detection immediately.

What if my KYC vendor does not yet meet the revised standard? Financial intermediaries are responsible under FINMA's outsourcing rules for the compliance of procedures they outsource. If your KYC vendor does not meet the revised standard, you are non-compliant regardless of where the gap originates. Review vendor contracts and require certification of compliance with the revised circular.

Does the revised circular affect video identification procedures? Liveness detection is primarily required for online identification. Video identification already included human review, which addressed presence verification differently. The circular also clarifies which document types are accepted for each procedure, but the liveness requirement is the core change for online identification.