How to run CCH iFirm AML + Biometric KYC checks and viewing the report
What are CCH iFirm AML + Biometric KYC checks?
CCH iFirm AML + Biometric KYC checks match an individual (through a selfie) with their ID along with multiple other checks wrapped into one service. These are considered “gold standard” AML checks as they cover multiple different data points and are often done at the point of client onboarding and at specific points in the clients life cycle as outlined in your firms polices and procedures document. These checks trigger a text message and a link to your client asking them to submit information for verification.
CCH iFirm AML + Biometric KYC checks take an individuals data and verify it using multiple data sources such as the electoral register and credit bureau information, as well as making sure the clients ID is genuine, and they they are the same person they claim to be on the ID. The name and phone number used is automatically synched from the individuals data you have on CCH Central, reducing the need to rekey information and maintain a single source of data. However you can overwrite this data during the AML check process if you wish, without affecting the data held in CCH Central.
As well as the validation with trusted third parties of the submitted
- Name
- Address
- DOB
We also check for
- PEPS (Politically exposed persons)
- Sanctions
- Mortality
- Adverse Media
- Location (are they trying to hide their location via VPN use)
- Genuine ID check (is it real or tampered with)
- Visual match against the ID Via a selfie
- Liveness check (where they live and present when doing this check)
Getting started:
Please ensure you have familiarised yourself with the getting started guide to ensure that your account is set up correctly and you have the relevant permissions.
CCH iFirm AML + Biometric KYC checks:
All AML checks start from CCH Central because that is that is where we get our data from, ensuring you have a single database across the firm and reducing the need to rekey information. Select the client and then click Tasks and CCH iFirm AML
When clicking on CCH iFirm AML in CCH Central, it will launch iFirm and ask you to login with your email and password.
The following message should then display asking what type of test needs to be carried out. This list will be affected by what modules you have subscribed too.
Click Proceed
The following screen should then display. Check name and enter mobile number and click Send SMS
The client or contact will then get a text message that will ask them to do a number of items such as take a selfie, a photo of their ID and declare their name, address and DOB, taking about 90 seconds that will verify the individual. Checks last for 7 days and if unactioned by your client, they expire. You will receive an expiry notice and a reminder to send another check. You wont be charged for expired checks.
When the client or contact receives the text message they need to click on the website link. These checks require no download of an application, but the user must have a smart phone to complete the process.
If the client does not receive the text message, go to the AML Check Log page, click the ellipsis in the client’s status box, and select Copy Link then send the link directly.
Branding: we can change the sender ID so it comes from “Your firm name” however there are character limits on the length of the firm name. On some packages we can brand the journey up with your logo and colour scheme as well. Ask your account manager for more information
The following screen should display and then Click Verify Me
Click Continue to accept our terms and conditions
Client or contact then needs to enter address and postcode and it will then begin the Biometric verification
The System is now going to ask for a photo of ID (e.g. driver license or passport)
The system will now use OCR to extract the data it has been given and start to run other AML checks. Here it will also verify that the ID is genuine and untampered with.
Note: Expired ID’s are not eligible for these checks. The ID must be valid
Then check that your details are correct and amend if necessary
The system then asks for a 'selfie' so that it can measure up the face with the ID. It will ask the person to smile to confirm this is a live person rather than just a photo and create a detailed dot matrix map of the face to check against the ID document.
The system will then produce a report that judges the results of the check. This can be viewed either in CCH iFirm AML or in the document centre for the client in CCH Central. By clicking the three dots next to an entry on the CCH iFirm AML Log Page, you will be able to view and download the PDF.
Data sync to CCH Central
The driving licence or passport details that have been collected from the AML + Biometric KYC Check will automatically sync to the passport or driving licence fields within the client in CCH Central on completion of the check.
Bulk sending CCH iFirm AML + Biometric KYC checks to clients
You can use the "Bulk" functionality" in CCH iFirm AML to bulk send AML + Biometric KYC text messages to your clients. In order to do this you must first ensure that the relevant clients are in CCH iFirm. This can be done by first bulk uplading clients from CCH Central > CCH iFirm, Then Bulk sending text messages from CCH iFirm.
Bulk uploading clients from CCH Central
On the Find Contact or Find Clients windows, select either a single record or multiple records of contacts and clients and click the Upload to CCH iFirm
A pop-up box is displayed, showing how many records have been selected. The number displayed automatically excludes the following:
- Any records already uploaded (this can be found in the field chooser on the Find Contacts/Clients window)
- All employee records
- Any Supplier records
Once your clients are in iFirm, you can bulk send AML + Biometric KYC text messages or bulk activate Ongoing Monitoring.
Bulk activating clients for AML + Biometric KYC
Multiple individual clients text messages can be activated at same time from the overview screen by ticking the check box against each client and then clicking Run AML check, and selecting "AML + Biometric KYC"
It will display a list of clients that dont have a mobile number in CCH. In order to send to these clients please go back to CCH Central and add a phone number.
Understanding the PDF: An Example AML + Biometric KYC report is shown below
By clicking the three dots next to an entry on the CCH iFirm AML Log Page you will be able to view and download the PDF.
Overview: Will give you a pass, review or fail
Data: This is a catch all for Name, Address, DOB, PEPS, Sanctions and adverse Media. See slightly down the PDF for a breakdown of these sources
Biometrics: Ensures the Selfie matches the individual on the ID and they where live and present during the check
Tampering check: Validates physical (such as font, spacing and size) and cryptographic (watermarks, holograms) features of the document to ensure its authenticity and to make sure that the document isn’t tampered with, photocopied, digitally altered or fake. You’ll see a copy of the ID to the right hand side.
Location: Will raise a review flag if we cannot geolocate the user. Most often this fails if a VPN is in use or the user denies the application access to location services. This does not automatically flag as a fail but will flag as a review.
Submitted data: This is the data that was used to submit the check
Note: The location check will only fail if we detect a VPN , or if the user has denied access to their location in the phones settings.
APLYiD/AML
Drivers Licence Verified/Passport verified: This will always be N/A. The UK does not have publicly accessible data to verify an individual against their licence or passport number and as such verification of a licence or passport number against an individual is not possible, and doesn’t adhere to AML standards. However, other countries that our AML provider operates in do offer these services, hence the field is kept in on the report. This wont affect the pass or fail rate and is separate from ID tampering checks which ascertains if the ID is genuine and untampered with.
Name, DOB and address verification: This will indicate if we have been able to find enough reliable data to verify that the users name, address and DOB with trust 3rd party government and credit bureaus. You can see a breakdown of these sources under the “Data sources” heading
PEPS sanctions and adverse media: will detail a pass or fail on any of the aforementioned information. In the event of a failure here, you will be able to see more detail on the bottom of the page.
Mortality: This check will cross refence mortality data bases to see if it can find a match, if a match is found it could be that someone is trying to pose as a deceased person.
Document Fraud Tests
During the document fraud assessment process, we perform the following checks in the background:
Image Composition: We ensure the document is live and captured on the spot. Our technology checks that the document and presented image of the document are not captured from a screen or a photocopy.
Photo Check: This is a check to see if the photo on the identity document is as expected, with checks to see if any suspicious overlay or modification is applied digitally or otherwise.
Document Integrity: We look for any damage to the document or modification and analyse the image to ensure it was captured raw through a mobile camera as stipulated.
Detail Check: We inspect the finer details that an identity document is composed of and examine the cryptographic security features on the document to ensure that they align with the genuine versions of the document type
Face Scan
Face Match: This check will analyse the face of user on the ID and try to match it with the users face on the selfie. Ensuring they are one and the same.
Liveness: The 'Liveness' test is where the client or contact was asked to smile to ensure a photograph or facial filters are not being used for any kind of impersonation, and they where live and present during the check.
What about clients overseas?
If the client has a foreign document and a UK address then we can verify the client as expected, we can verify over 16,000 different documents from various countries.
If the client has a foreign address and a foreign document, we can only verify the document against the user to ensure they are the same person and the document is valid and untampered with. Due to the lack of reliable foreign data shared with 3rd parties we cannot verify name, address and DOB on foreign addresses. It is recommended here that you obtain a proof of address as well such as a utility bill or a bank/credit card statement.
The PEPS, Sanctions and adverse media of the checks are global.