How is face recognition used in banking?

In two unrelated places: verifying a customer against an identity document during remote onboarding, and controlling physical access to branch back-offices, cash areas, vaults and data centres. The first faces an active adversary and the second does not, so they share almost no requirements.

Can face verification be fooled during online onboarding?

The serious attacks do not involve a camera. Because the flow runs on a device the attacker controls, video can be injected directly into the capture path, so the check receives a clean synthetic face. Defending that requires attesting the device and securing the capture path, not better image analysis.

Is liveness detection enough for financial onboarding?

It addresses presentation attacks - a printed photo, a screen replay, a mask - and should be tested against named attack instruments under ISO/IEC 30107-3. It does not address injection attacks, document forgery or a genuine person opening an account for someone else. Each needs its own control.

Where should a bank store biometric templates?

On the reader, on a site server, or on a card the holder carries. Storing them in a vendor cloud puts them outside the institution, which most financial regulators will question and some will refuse. The storage decision determines what a breach exposes and which jurisdictions the data has entered.

How many financial firms use AI?

The US Census Bureau's Business Trends and Outlook Survey put Finance and Insurance at 33.9% as of 3 May 2026, above the national rate. That figure covers AI use generally; agent deployment — systems that call tools and change records — is reported in the single digits across nearly all business functions.

What controls does an AI agent need in a bank?

Tool scope above all: an agent can only affect what it has a tool for, so the review is which tools exist and what each may touch, under whose credentials. Add confirmation before any irreversible action, complete step logging an auditor can read later, and a limit that ends a run.

When do EU AI Act high-risk obligations apply?

They begin on 2 December 2027. The classification turns on what a system is used for rather than what it is built from, so an agent that drafts for a person to send sits differently from one deciding an outcome that affects a customer. That distinction is set by the use case, not the platform.

Face recognition and AI for banking and finance

Banking uses face recognition in two unrelated places: verifying a customer against an identity document during onboarding, and controlling physical access to branches, vaults and data centres. The first is a fraud problem with an active adversary; the second is an access control problem, and they share almost no requirements.

By Jan Mocary, Chief Technology Officer, Ayonix AI

Last updated: September 8, 2026

Why are onboarding and access control different problems?

	Customer onboarding	Physical access
What is compared	A selfie against a document photo	A live face against an enrolled staff record
Adversary	Present and motivated	Rare and opportunistic
Attack of concern	Injected or replayed video, forged document	A photograph held to a reader
Failure cost	An account opened under a false identity	An unauthorised entry, logged
Where it runs	Wherever the customer is	On the premises being protected

The two financial-services deployments compared on what actually differs.

Treating them as one requirement is the most common mistake in a financial services biometric programme. An onboarding flow hardened against a determined attacker is expensive overkill on a staff door; a door product deployed at onboarding is defeated by a video played into the capture path.

What is the real attack surface at onboarding?

The camera is not the boundary. A remote onboarding flow runs on a device the attacker controls, so the strongest attacks never involve holding anything up to a lens: synthetic or captured video is injected directly into the capture path, and the biometric check receives a clean, well-lit, entirely fake face.

Presentation attacks: a printed photo, a face on a screen, a silicone mask. Addressed by liveness detection tested to ISO/IEC 30107-3.
Injection attacks: video fed into the application, bypassing the camera. Addressed by attesting the device and signing the capture path, not by image analysis.
Document forgery: a genuine face presented with a fabricated document. Addressed by document authentication, which is a separate control from the face match.
Coercion and mule accounts: a real person, really present, opening an account for someone else. Not a biometric problem at all.

A vendor answering only the first line is answering the easiest quarter of the problem. Ask which attack instruments liveness was tested against, at what level, by which laboratory - and separately, what attests the capture device.

What does biometric access control need in a bank?

Branch back-offices, cash handling areas, vaults and data centre floors share a requirement that ordinary offices do not: the record of who entered matters as much as whether entry was allowed. A biometric credential cannot be lent or borrowed, which is precisely why it is chosen for these areas over a card.

Decide where templates live. On the reader, on a site server or on a card the holder carries - not in a vendor's cloud, which most financial regulators will question and some will refuse.
Provide a working second credential for anyone the biometric rejects or who cannot enrol, and log its use.
Define the behaviour on power or network loss, including whether each door fails open or fails secure. In a vault context these differ by door.
Retain entry records for the period the applicable regulation requires, and no longer.
Re-enrol rather than lower the threshold when one person is repeatedly rejected, which is almost always an enrolment quality problem.

Where do AI agents fit in financial services?

33.9%AI use rate in Finance and Insurance, as of 3 May 2026US Census Bureau, Business Trends and Outlook Survey

Finance and Insurance reported one of the higher sector adoption rates in that survey, well above the national figure. What that rate does not distinguish is generation from action: most reported AI use is producing text, and agent deployment - systems that call tools and change records - remains far rarer across every sector.

Document-grounded question answering over policy, product and regulatory material, with the answer citing the passage it came from.
Drafting that a person reviews and sends, where the agent never has the send permission at all.
Reconciliation and exception triage, where the agent proposes and a person disposes.
Anything touching a customer record, an instruction or a payment: confirmation gates, service identities and complete step logging, or not at all.

The control that matters is the tool list. An agent can only affect what it has been given a tool for, so the review question in a bank is which tools exist and what each may touch, under whose credentials - not how capable the underlying model is.

How should a financial institution run a biometric pilot?

A pilot in financial services has to answer a different question from a technology evaluation. The question is not whether the system works but what it will cost to operate: how many customers are turned away, how many staff hours the exceptions consume, and how often a reviewer is asked to make a decision the evidence does not support.

Run against the real population, not a volunteer group. Staff testing a door product are unrepresentative of the branch's customers in almost every dimension that matters.
Count both error types and report them separately. A genuine customer rejected and a wrong person accepted have entirely different costs, and one aggregate number hides which one is happening.
Measure the exception path in staff hours, not in percentages. A two percent referral rate is an abstraction until it is expressed as the queue it creates at a branch counter on a Friday afternoon.
For onboarding, include a deliberate injection attempt in the test plan, run by someone who did not build the integration. A flow only tested against photographs held to a camera has not been tested.
Record the threshold in force throughout, and re-baseline after any change to it. A pilot whose threshold moved partway through has measured two systems and reported one.
Keep the dismissed alerts. They are the data that tells you where the threshold should sit, and they are the first thing a pilot discards.

Independent evaluation results narrow a shortlist before any of this begins. NIST measures submitted algorithms on sequestered data and publishes what it finds; it does not endorse vendors and issues no certification, so a strong result says the algorithm is credible and the pilot says what the institution will actually operate.

What does the record-keeping have to support?

2 December 2027date the EU AI Act's obligations on high-risk AI systems beginEuropean Commission

Financial services already operates under record-keeping obligations that most AI deployments are not designed for, and the AI Act's high-risk obligations arrive on top of them. The classification turns on what a system is used for rather than what it is built from, so an agent that drafts sits differently from one that decides an outcome affecting a customer.

For a biometric check: what was compared, the score, the threshold in force, the decision and who reviewed it.
For an agent: every step, every tool call and its result, in a form an auditor can read months later.
For both: the version in force at the time, so a decision can be reconstructed against the system that made it rather than the current one.
Retention set by the applicable regulation rather than by storage cost, in both directions.

Frequently asked questions

How is face recognition used in banking?: In two unrelated places: verifying a customer against an identity document during remote onboarding, and controlling physical access to branch back-offices, cash areas, vaults and data centres. The first faces an active adversary and the second does not, so they share almost no requirements.
Can face verification be fooled during online onboarding?: The serious attacks do not involve a camera. Because the flow runs on a device the attacker controls, video can be injected directly into the capture path, so the check receives a clean synthetic face. Defending that requires attesting the device and securing the capture path, not better image analysis.
Is liveness detection enough for financial onboarding?: It addresses presentation attacks - a printed photo, a screen replay, a mask - and should be tested against named attack instruments under ISO/IEC 30107-3. It does not address injection attacks, document forgery or a genuine person opening an account for someone else. Each needs its own control.
Where should a bank store biometric templates?: On the reader, on a site server, or on a card the holder carries. Storing them in a vendor cloud puts them outside the institution, which most financial regulators will question and some will refuse. The storage decision determines what a breach exposes and which jurisdictions the data has entered.
How many financial firms use AI?: The US Census Bureau's Business Trends and Outlook Survey put Finance and Insurance at 33.9% as of 3 May 2026, above the national rate. That figure covers AI use generally; agent deployment — systems that call tools and change records — is reported in the single digits across nearly all business functions.
What controls does an AI agent need in a bank?: Tool scope above all: an agent can only affect what it has a tool for, so the review is which tools exist and what each may touch, under whose credentials. Add confirmation before any irreversible action, complete step logging an auditor can read later, and a limit that ends a run.
When do EU AI Act high-risk obligations apply?: They begin on 2 December 2027. The classification turns on what a system is used for rather than what it is built from, so an agent that drafts for a person to send sits differently from one deciding an outcome that affects a customer. That distinction is set by the use case, not the platform.