Compliance, France and EU
Your regulator has a name. We write it.
This page names the authorities that supervise you, says what the rules expect from a remote identity verification, and where we stand — including, above all, where we do not stand yet.
Who supervises you, and on what
ANJ — Autorité nationale des jeux
Supervises online gambling operators licensed in France: verification of the player's identity and age, checking of the French register of self-excluded players, moderation of play, anti-money laundering.
ACPR — Autorité de contrôle prudentiel et de résolution
Supervises banks, payment institutions, finance companies and insurers, and with them their customer due diligence obligations, which apply when establishing the business relationship remotely.
AMF — Autorité des marchés financiers
Supervises crypto-asset service providers and financial market participants, including their customer identification obligations.
CNIL
Oversees compliance with the GDPR. An identity verification processes biometric data, a special category under Article 9: the legal basis, the information notice and the consent are prepared before the first file.
ANSSI — the PVID framework
Qualifies remote identity verification providers against the PVID framework, at two levels of assurance. The qualification is required for certain regulated uses, and recommended for others.
The deadlines coming up
Two European texts will change your verification flows. They carry dates: better to prepare for them knowing those dates.
The dated detail of these deadlines is being checked at source (EUR-Lex, Légifrance, ANSSI, ANJ). We will publish the dates and the reference numbers of the texts here, not approximations.
Where Sanno stands, precisely
We would rather write it down in black and white than let you find it out during your audit.
- Sanno does not hold PVID qualification today, and does not present itself otherwise. The qualification requires a full audit by an approved assessor; it is an objective, not an achievement.
- Sanno holds no certification to date (no ISO/IEC 27001, no SOC 2, no evaluation of liveness detection by an independent laboratory). The work under way and its milestones are described on the Security page.
- The photos, the data read and the analysis stay on our servers, in the European Union, and no sub-processor takes part in the analysis chain. That is verifiable, and today it is our soundest argument.
- Your company remains the controller; Sanno acts as a processor, and gives you what your compliance function needs.
- The approval of a verification is decided by your team. We will not open automatic approval until the engine has been calibrated on an independent benchmark.
A questionnaire for us to fill in?
Compliance teams work with questionnaires, processing annexes and registers. Send us yours: we fill them in, and we tell you what we cannot tick yet.