Frequently Asked Questions

Contents:

How Spotlite performs identity checks

How do I use Spotlite to perform identity checks?

Spotlite is about helping you collect evidence of compliance and meeting basic control standards. In doing this, it provides an impressive user and applicant experience that is quick and easy to use, reducing time spent photocopying, form filling and filing documents whilst most importantly, helping you achieve compliance. It produces MI that provides evidence and traceability that standards are maintained and met. It helps your staff demonstrate regulatory and risk control throughout their portfolio which they can both measure and understand.

However, Spotlite is not a magic wand nor an all-seeing eye. It’s just a tool – a Spotlite on identity. Artificial intelligence and machine learning is not the same as real intelligence and computers will never better humans. Consequently, do not be afraid to question and overrule the system, there are checks and balances downstream which will pick up and correct errors and omissions. At all times, as with all technology, you rule the tool; the tool does not rule you. If you are doing a good job in good faith, the system will support you. If you attempt to abuse or cheat the system with the intention of wrong doing, the system will detect you. Accountability, mastery and purpose all remain with you – as it should do. You are in control.

What level of assurance can I have that Spotlite is validating identity?

Spotlite is comprised of different Services which provide different Levels of Assurance. Which Service is right for you depends on the Level of Assurance (LoA) you require. The LoA definitions we use are based on the UK Government’s Good Practice Guide to Identity Proofing and Verification of an Individual which seeks to align national and international standards. However, because we are using biometrics in our app and we are supporting you, the user, our level of validation exceeds these standards in some cases. The details of the Control Standards applied to our Services can be seen within the Spotlite app. The principles we have followed to create these Control Standards are as follows:

Our Basic ID Checks meet both LoA1 and LoA2 standards that the Applicant is, on the balance of probabilities, the rightful owner of the Claimed Identity. This is evidenced by the fact that you have met them, you have taken pictures of two identity documents as required by regulation and you have confirmed to us that you have seen the two original documents confirming identity. In addition, we collect biometric evidence (the selfie) from the Applicant and compared that to the Applicant Photo ID. Finally, we have checked the Applicant’s Social Media profiles to determine the age of the profiles, the date the profile was last used and, where available, a count of the Applicant’s connections.

Our KYC Checks provide the LoA3 standard in that the Applicant’s identity is a real person and they are the rightful owner of the Claimed Identity. We do this by performing the same checks as the Basic ID Checks plus collecting additional evidence concerning the Applicant’s citizenship and activity within the last 180 days – specifically economic activity, evidence of living at the Applicant’s resident address (including historical addresses if they have only been at their current address for a short time). We also include a mortality check and sanctions check as part of our KYC Checks.

Our more advanced Services meet the LoA4 standard for high risk identity validation. These include Politically Exposed Person Checks, Adverse Media, Enhanced Due Diligence, DBS and Reference Checking. Details of our more advance Services can be found on our website and within the app.

Why do I need two documents to prove my ID?

Currently within UK regulation, you will need to provide two forms of ID for employment, tenant checks and AML checks with regulated institutions like banks, building societies, estate agents, solicitors, etc. The Photo ID, i.e. a Passport, National ID Card or Driving Licence, is evidence of your Claimed Identity and we conduct biometric checks against your Selfie and your picture on the Photo ID. The Proof of Address is recent evidence of your place of residence.

On some documents it captures the scan but some of the captured details have recorded incorrectly

That’s ok. We are supporting the user in doing their job, not testing their ability to take good pictures or that our artificial intelligence and machine learning algorithms always get everything right – no system can do that!

If the document has an MRZ Code, a Bar Code or a QR Code, we will pick up details from that code – in these cases you will not be able to edit the document. But if we are simply reading the document using OCR, then you can edit the details as necessary. The app will prompt you to do this.

Anything that is changed from what is scanned is recorded and shown on the certificate. We also run analytics and spot checks behind the scenes to ensure that the system is tuned as best it can be and there is not systematic abuse. In the case of biometric alerts we always double check the documents on behalf of our clients.

I don’t think the documents presented to me are genuine

You should progress in line with your internal procedures. In the meantime, click here for the UK Government Advice on detecting fraudulent documents. If the documents are fraudulent, click here to report your concerns to Action Fraud.

Can I use the same Identity document for both the photo ID and proof of address scans?

No, that would be one document used twice! This all about helping to reduce fraud and criminal activity within our economy. That’s why the regulations exist! For these reasons you need to provide two separate documents – one for identity and one to demonstrate your recent activity at your residential address. While this may seem inconvenient it is better than letting criminality continue unchecked – we must all play our part.

Taking a Selfie

I’m having problems getting the selfie to work

Okay, let’s check the settings first: On the iPhone, go to Settings. Scroll down until you see the CDD Onboarding, CDD Employment, CDD Tenant or Spotlite entry (the name depends what version of the app you are using). Press the little arrow in the row for the app, you should then see the Allow Access settings. Spotlite needs access to the Camera, Face ID and Mobile Data. You can also switch on Siri to read the screens if you like.

Next check that your camera lens is clean and free from obstruction. You also must have good data or internet connection and there is sufficient battery power to complete the process – never good to run out of power during an application!

Now, if that is all good, here is what you need to do to get the best results:

  • We just need a simple passport looking selfie – no need for silly hats, silly faces, theatrical make-up, unusual or trendy poses or miscellaneous body parts!
  • Ensure the applicant’s face is in good even lighting. Avoid overhead lighting or lighting from side angles. Particularly avoid bright light coming from behind the applicant such as from a window – a dark selfie in silhouette is nether use nor ornament!
  • Ask the Applicant to take off their glasses – particularly if they were not wearing them in the Photo ID
  • Ask the Applicant to make sure that their face is visible in the oval window and ask them to blink when the app prompts them to do so
  • Sometimes, just sometimes, if the applicant blinks too fast or too slow or does not look like they are not a real person, we won’t take the selfie. We need to see a live applicant, moving and blinking normally! Avatars, zombies or blinking plastic dolls need not apply!

The customer has refused to take a selfie – what can I do now?

Well, that’s fair enough. Applicants have a right to withhold their consent under GDPR. Depending on the circumstances you may be obliged to offer an alternative manual approach for the applicant to proceed. Check with your compliance officer. You can also click here to find out why gaining consent is important for both you and your applicant.

I’m not really that old!

When we take a selfie besides capturing the distinguishing features of your face we also try to take a guess at your age, gender and hair colour. This is known as biometrics and we use these to match to your Photo ID. Now this is not an exact science and even humans get these things wrong! Nevertheless, we thought we’d let you know our best guess and you can see this by swiping up while looking at the selfie on screen. If you want some fun, see how young you can make yourself look – and please forgive us if we get it wrong. It’s only a computer, not a life coach!

Does trying to cheat the selfie undermine the whole point of the system?? Well, no! Spotlite is about helping you collect evidence of compliance and setting basic control standards. Artificial intelligence is not the same as real intelligence and computers will never better humans. We have some checks and balances later down the line, so if you want to have some fun in the meantime, why not! All it means is that you might have to take the selfie again if you have managed to make yourself look about 10!

Taking a Photo ID

Why does the Applicant need to provide a Photo ID?

Asking the Applicant to provide a government issued Photo ID is a straightforward way to link an individual with their claimed identity while at the same time creating a significant barrier for others trying to claim to be somebody they are not. We face match the applicant’s selfie with the photo on the Photo ID.

Spotlite does not recognise or accept the Photo ID

Several things could be going on here, we’ll go through a few:

Depending on the jurisdiction only certain Photo ID documents are acceptable, for example, UK regulations do not accept an American Driving Licence as a Photo ID for the purposes of employment or tenancy agreements. Typically, the UK configurations of Spotlite will recognise most passports, most EU National ID cards and EU Driving Licences.

If the document has an MRZ code, we must be able to read the full MRZ Code from the document. If it is only partially visible, either because of a mark on the document or by glare causing a reflection, the document will not be accepted. Check that the document is not damaged and that all of the MRZ Code is clearly visible and not marked in anyway.

Several Photo ID documents use plastic coatings or holograms to ensure that the document has not been tampered with. Under certain lighting conditions, these features can cause glare or reflections that prevent the camera from reading the document or scanning the photo. Make sure the photo is clearly visible and avoid glare and reflections on the photo or the elsewhere on the document.

Best practice is to use Spotlite in an office or other environment where light is evenly diffused and there is no direct strong light source causing glare or reflections on the document. Even the best cameras cannot out-perform the human eye in uneven or extreme bright or dark lighting conditions. Beware, low light conditions can cause unpredictable results!

Hold both the document and camera steady while Spotlite tries to recognise and lock on to the document. Placing the document on the desk may help if it is not directly under a light. Tilt the document or the camera slightly if Spotlite tells you to do so but don’t keep moving the document or phone.

Hold the document by its edges. Don’t put your thumb over the picture or any of the text – we don’t do x-ray!

If Spotlite does not accept the document or has Amber warning errors, just retake another scan of the document in better lighting conditions. You can retake a picture of the Photo ID as many times as you like.

If the document does not have an MRZ Code, you will have the opportunity to correct any OCR errors. Spotlite is about helping you collect evidence of compliance and setting basic control standards. If the machine is wrong, you simply override. This will create an Amber warning and will be highlighted on the certificate. We will also double check that the system is not being abused. This will be invisible to both you and the Applicant. We will not put you at risk in front of a potential fraudster, but it gives you confidence that we are working with you to help prevent fraud. If we do detect fraud, we will report our suspicions and may monitor your account for a while.

Spotlite says that there is a mismatch between the selfie and the Photo ID

A mismatch can take place for several reasons.

The biggest reason is that the person in the Selfie and on the Photo ID are not the same person. If you get a mismatch, double check the Applicant is the same person as on the Photo ID. If someone is using a false identity, be aware of your safety and follow your internal procedures. Click here for the UK Government Advice on detecting fraudulent documents. If the documents are fraudulent, click here to report your concerns to Action Fraud.

A mismatch can also occur if the applicant’s physical appearance is different to that on the Photo ID. This can happen for several genuine reasons, such as:

  • there is a significant age difference between the Applicant and the Photo ID. If this is the case, ask the candidate if they have a more recent Photo ID.
  • the Applicant is wearing glasses in the selfie but is not wearing glasses in the Photo ID. If this is the case, restart the Application and ask the Applicant to take off the glasses for the selfie.
  • the Applicant has grown or removed a beard since the Photo ID was taken! Tough one this! Spotlite is a computer not a human – you will always be a better judge. Artificial intelligence is not the same as real intelligence!

So, what do you do if Spotlite is just plain wrong - it happens! Well, Spotlite is about helping you collect evidence of compliance and setting basic control standards. If the machine is wrong, you simply override. This will create an Amber warning and will be highlighted on the certificate. We will also double check that the system is not being abused. This will be invisible to both you and the Applicant. We will not put you at risk in front of a potential fraudster but it gives you confidence that we are working with you to help prevent fraud. If we do detect fraud, we will report our suspicions and may monitor your account for a while.

Verifying Proof of Address

The A4 document fails to scan

If there is a fold or creases in the paper this may create a shadow that confuses the camera – we are good, but not that good! If Spotlite can’t see an A4 document, it won’t take a picture As our machine learning algorithms get better our document recognition will improve. In the meantime, here are some other things to watch out for:

  • The typed name, address and date must be clear and legible
  • If the document is of poor quality or print resolution it may fail to scan, try taking the scan in improved lighting conditions or where there is not so much glare or contrast
  • However, given the right light, Spotlite will take a snap of the document, although if the quality is bad you might have to make some adjustment.

The name has not been scanned correctly, the address cannot be found and/or the date is not found on the document

One of the on-going things we are looking to improve is where the machine learning doesn’t do such things very well – such as read 'O' for '0' or 'l' for '1'. This is a pain, but we are not alone in this one! As our machine learning algorithms continue to run it will get better, so please bear with us. In the meantime, you can correct any offending items by pressing the Edit button after the document has been scanned and Spotlite will tell you anything it doesn’t like the look of. Things to watch out for are:

  • Check that the Post Code has been recorded correctly e.g. 'O' for '0' or 'l' for '1'
  • The first line of address contains numbers where it should have letters and letters where it should have numbers
  • We can’t find the date on the document or we find the wrong date
  • Move in date – actually you are always going to have to tell us this one. Mind reading is for a future release!

Things you can do to reduce these errors is to use a passport for the Photo ID and a Driving Licence as Proof of Address. Also ensure the A4 document is good quality, has no folds or shadows and is not creased. Otherwise follow best practice ….

Best practice is to use Spotlite in an office or other environment where light is evenly diffused and there is no direct strong light source causing glare or reflections on the document. Even the best cameras cannot out-perform the human eye in uneven or extreme bright or dark lighting conditions. Beware low light conditions can cause unpredictable results!

Spotlite says the document is out of date when it isn't

The issue date can be amended by selecting change before confirming the captured information.

Can I rescan if a document isn't captured correctly?

Yes, it's very easy, just tap the retake button at the top left of the picture - you can do this at any time prior to submission

Understanding the Certificate

The customer has asked for a copy of the certificate, what do I tell them?

A link to the certificate will be forwarded to the e-mail address provided by them

The customer has asked who retains the document and for how long

The certificate will be deleted from our CDD Management systems after 15 days. You must advise the customer of your business policy for retention of such records

Can I store a copy of the certificate on my phone?

You cannot store a copy of your certificate on your phone. It will be sent to the registered e-mail address. Please note it is your responsibility to ensure the confidentiality of the document once downloaded

What happens if an alert is received following a search?

If any alerts are received following a search, these will be discounted on 3 core levels:- Date of Birth, Citizenship and Location. If the alert cannot be discounted you will be advised and you must carry out further investigation in line with your internal procedures - or you can request assistance from our Investigations Team

Data & System Issues

My battery ran out half way through – what happens to the information already collected?

The information will be lost and you will need to restart the applicant process

My screen dims during the scanning process

In your Settings, Display & Brightness - amend your Auto-Lock to 1 minute or above

My reception failed half way through – what happens to the information already collected?

The information will be lost and you will need to start the process again

How do I report an issue with the system?

Please contact us via email at support@cddmanagement.services or via the feedback option in the menu of the app, providing as much detail as possible including date and time

If I start a registration can I come back to it later?

No, if the process is not completed to submission within 30 minutes the app will time out and even if you complete the process it will not submit for certification. You will need to start the process again

Is there an option to save and come back to the process?

No, if the process is not completed to submission within 30 minutes the app will time out and even if you complete the process it will not submit for certification. You will need to start the process again

General

Can the app be customised?

Yes – see the package details for options or contact our sister company, CDD Software Services, who will be happy to discuss your bespoke requirements

Is the process compliant?

The purpose of the app is to help you comply with your regulatory responsibilities.

Standard Privacy Policies and Terms & Conditions can be found within the menu of the app or via the footer links on this website.

Regulatory checks are carried out in line with the service requested, these are detailed within the Menu of the app.

The applicant takes a Selfie and confirms consent - Nothing can happen until the Applicant provides this live consent which is also recorded on the final certificate

I have visual impairments and I would like to hear the content of the screen on my iPhone

Go into Settings, General, Accessibility, Speech, Speak Screen and turn on. When in the app, swipe down with two fingers from the top of the screen to hear the content of the screen

Still have not found an answer to your question?

Please contact support@cddmanagement.services

Contact Us