Remote Customer Identification in Moldova: eKYC Requirements
How to design eKYC under NBM Regulation No. 281/2024: permitted methods, live capture, documents, face match, liveness and audit evidence.
A precise face comparison is not enough to make a remote-identification process valid. The evidence breaks down when the applicant uploads an old image or never shows the original document, when an interrupted session resumes halfway through, or when nobody checks the data against the required source. The algorithm can report that two portraits look alike while the organisation still cannot explain how it verified identity.
National Bank of Moldova Regulation No. 281/2024 governs the whole eKYC process: pre-implementation assessment, permitted methods, technical controls, stop conditions and retained evidence. Approval rate tells you little on its own. The better test of performance is whether you can reconstruct each decision.
In brief
eKYC means risk-based identification and verification, which takes more than one biometric test.
Face Match compares images; liveness assesses the live presentation; an independent source confirms identity data.
An uncertain case goes to human review or an in-person route instead of being forced through automation.
Session records, device signals, source responses, rule versions and decision reasons form one evidence chain.
Scope and pre-launch controls
The Regulation applies to the reporting-entity categories it identifies through Article 4 of Law No. 308/2017. Its published scope includes electronic identification of Moldovan natural persons and resident legal entities where the relevant representatives, founders, managers and beneficial owners are Moldovan citizens.
For a company, eKYC verifies the natural person acting on its behalf. Authority to represent, company records and beneficial ownership each need their own check. A confirmed face gives nobody a mandate and says nothing about who controls the company.
Point 6 of the full Regulation requires a pre-implementation assessment covering source quality, AML/CFT, legal, operational and security risks, data protection, identity fraud and end-to-end testing. Under Points 49–50, the entity notifies the NBM at least 30 days before the procedure starts. That notice does not amount to regulatory certification of a vendor.
Permitted methods answer different questions
Point 21 of the Regulation permits one or more methods according to risk: electronic identification and relevant trust services; live video and audio; live photography with presence checks and recording of the original document; and other electronic means supplied by a qualified trust-service provider.
Control | What it establishes | What a pass does not prove |
|---|---|---|
Independent-source check | Claimed data resolve to an accepted source | The presenter owns the record |
Face Match | The current face is sufficiently similar to the reference at the selected threshold | Document authenticity or liveness |
Liveness | The capture resembles a live presentation rather than tested attack types | Legal identity or authority |
Document verification | Fields and available document signals are consistent | Authority to act for a legal entity |
AML screening | A candidate exists in declared risk sources | Confirmed identity or the final legal action |
A verifiable session starts with live capture
For video and photo routes, the Regulation requires live transmission, so a gallery upload or a pre-recorded clip does not qualify. The applicant presents the original document, the system captures the face and the relevant document sides, and the data are compared with reliable sources, including the population register where the process provides for it.
Phone and email are confirmed with a one-time code or a time-limited link. IP, network, device and geolocation signals help assess session integrity. VPN or proxy use raises a flag without proving fraud, and your policy has to say whether it leads to continuation, review or a stop.
If a live session is interrupted, it starts again from the beginning. When the applicant appears to be under third-party pressure, or doubts about identity remain unresolved, the process must allow referral to physical presence.
PASS, REVIEW and STOP need distinct causes
PASS means every mandatory control for the chosen route produced sufficient, consistent evidence. A high face score on its own does not qualify.
REVIEW covers uncertainty that a person can resolve: borderline capture quality, a data discrepancy, a possible PEP/sanctions match or an unusual device. The reviewer sees the underlying results and records the reasons for the decision.
STOP applies when a mandatory condition is missing: required consent, live capture, the original document, session integrity or verifiable identity. Keep the cause and the permitted next route in the record.
Point 46 of the Regulation requires the entity to keep the documents and information it obtained, including video, audio, photos, captures, document copies, device fingerprint and IP address, for the whole relationship and for five years after it ends. Each data class still needs a lawful basis, access control, protection and a deletion rule.
Biometric.Vision Liveness, Face Match and Document Verification cover different technical stages. Orchestrator can connect their results. The organisation stays responsible for the lawful basis, authorised sources, thresholds and the final decision.
Implementations must also account for Personal Data Protection Law No. 195/2024, effective from 23 August 2026. Review any references to the former law before carrying them into new notices, DPIAs or processor contracts.
Sources
Ready to strengthen your customer checks?
500 checks free every month · no card · no contract · no sales call.
