Ministry of Finance of the Republic of Lithuania Bank of Lithuania https://www.lb.lt/lt/mokejimu-taryba Vytautas Magnus University FINTECH Lithuania Group http://finmin.lrv.lt/lt/veiklos- Association of Lithuanian Banks sritys/finansu-rinku-politika/mokejimu- Association of Lithuanian Chambers of Commerce, Industry and Crafts taryba Lithuanian Small and Medium-Sized Business Council Alliance of Lithuanian Consumer Organisation Association of Payment and Electronic Money Institutions Fintech Hub LT Kaunas University of Technology 18 April 2019 Vilnius Feasibility study Issues relating to opportunities for new identification means and compatibility with anti-money laundering objectives Task Force Report on Opportunities for New Identification Means and Compatibility with Anti-Money Laundering Objectives ISBN 978-609-8204-44-5 (online) Table of contents Summary ..................................................................................................................................................... 3 Introduction .................................................................................................................................................. 4 1. Overview of the development of legal framework and practices of remote identification in Lithuania and relevant issues ............................................................................................................................................. 5 1.1. Overview of the Law of the Republic of Lithuania on the prevention of money laundering and terrorist financing and the development of the legal regime of remote identification ............................................... 5 1.2. Overview of the application and interpretation of the Rules for Remote Identification by Lithuanian courts 6 1.3. Practical relevance of and issues pertaining to regulating remote identification ................................... 8 2. Examining remote identification means ................................................................................................10 2.1. Fundamental assumptions and methods of the study.........................................................................10 2.2. Process analysis of remote identification means ................................................................................11 2.2.1. Direct video streaming/image transmission ................................................................................13 2.2.2. Qualified electronic signature .....................................................................................................18 2.2.3. Electronic identification ..............................................................................................................22 2.2.4. Payment order ...........................................................................................................................23 2.2.5. Third-party information ...............................................................................................................25 2.3. Comparison of remote identification means .......................................................................................27 2.4. Evolution trends of remote identification means ...................................................................................31 3. Goals and possibilities for regulating remote identification ....................................................................32 4. Recommendations on regulating remote identification means ..............................................................34 Sources ......................................................................................................................................................36 2 Summary Remote identification is becoming a crucial and integral part of innovation in financial services but such changes create challenges for legal regulation. The purpose of this study is to draw up recommendations on legal regulation of remote identification (before establishing a business relationship) in Lithuania. An overview of legal framework and the development of practices in the area of remote identification in Lithuania has shown that up until the end of 2016 the rules for remote identification were interpreted narrowly, legitimate identification means being only personal identification documents (or duly certified copies thereof) received from third parties. A stringent legal framework gave rise to delays or inefficiency issues in remote financial services business that were partially tackled only at the end of 2016 when the list of proper remote identification means was expanded. However, the history of regulating remote identification and the narrow application and interpretation of the legal regime established in Lithuanian courts call for the conclusion that to-date national regulation has been lacking a tradition of adaptation to technical progress. A process analysis of current statutory remote identification means has revealed that out of all statutory remote identification means it is only direct image transmission (by transmitting a photograph) that does not require physical contact with the customer or purchasing special tools. Moreover, a structured online survey of payments market participants has revealed certain peculiarities pertaining to the use of remote identification means and accuracy, security and accessibility parameters of those instruments: respondents believe that the most secure means are qualified electronic signature and e-identification tools while a payment order and image transmission an are seen as the least secure tools even though the latter has also been listed as a tool of the greatest popularity and potential; respondents believe that the most accessible means is image transmission/video streaming tools while the least accessible is third parties’ means of information, i.e. the more automated the identification process is and the fewer special instruments it requires, the greater is the accessibility of those means; respondents believe that the most accurate means are qualified electronic signature and e-identification tools while image transmission/video streaming tools are seen as the least accurate. The means issued and used in Lithuania are exclusively associated with the category of possession or knowledge. However, the ever-improving technological advances of mobile devices and an increasing use of biometric security elements in personal identification documents issued by the state, have the potential to greatly enhance the effectiveness and efficiency of customer identification by inherence (biometric) measures. Still, in order to ensure due adaptation of legal regulation to highly dynamic market conditions, there is a need to compile a non-exhaustive list of means setting out the terms and procedures for the recognition of new identification means. An overview of goals and possibilities for regulating remote identification has revealed that the state should not establish any legal regulation that would create unfavourable conditions for economic entities to exercise their freedom to pursue an economic activity. Furthermore, AMLD5 does not contain an exhaustive list of tools for remote identification. On the contrary, it requires ensuring that obliged entities could prove to competent authorities or self-regulation bodies that the means are appropriate given the established risk of money laundering and terrorist financing. Therefore, with a view to ensuring the adaptation of legal framework to highly dynamic market conditions and implementing the AMLD5 requirements, here are some recommendations: to make a non-exhaustive (open) list of remote identification means as well as procedures and methods for the state to regulate, recognise, approve or adopt all secure and accessible remote identification processes; to enable all obliged entities to prove to national or self-regulation authorities (e.g. associations of obliged entities) that the means they use are appropriate given the established risk of money laundering and terrorist financing, the nature of the business and the size of the entity; to implement a proactive policy on e-identification tools ensuring that anyone has convenient access to e-identification or other remote identification means. 3 Introduction With the expansion of the market in payment services, remote accessibility and security of these services acquire ever-increasing relevance. New financial technologies (FINTECH) actually change business models of payment service providers while the promotion of innovation in this area has already become synonymous with Lithuania’s economic policy. Market players providing all services online are being established. Remote establishing of business relationships and remote identification as its component therefore become a critical and integral part of their activity. Significant changes create challenges for legal framework that does not always keep pace with unprecedented development of financial technology. Still, there is a need to create legal framework of remote identification so that it does not hinder innovation or cause delay or inefficiency problems and that it also ensures the compatibility of the process with anti-money laundering objectives. The need to promote financial innovation and make the compliance with money laundering and terrorist financing prevention more efficient has also been acknowledged by responsible authorities. At the plenary of the Financial Action Task Force (FATF) on 19 October 2018 the drawing up of