Why should I use Spotlite to perform identity checks?
Spotlite helps you collect evidence of compliance and meet basic control standards. In doing so, it provides an impressive user experience that is quick and easy to use, reducing time spent photocopying, form filling and filing documents whilst most importantly, helping you achieve compliance.
Spotlite’s Client Portal produces robust MI, providing evidence and traceability that standards are met and maintained. It helps your organisation demonstrate regulatory and risk control throughout your business, which can be measured, evidenced and understood.
What level of assurance can I have that Spotlite is validating identity?
Spotlite comprises different Services which provide varying Levels of Assurance. Which Service is right for you depends on the Level of Assurance (LoA) you require.
The LoA definitions we use are based on the UK Government’s Good Practice Guide to Identity Proofing and Verification of an Individual which seeks to align national and international standards.
However, because we use biometrics in our app and we are supporting you, the user, our level of validation exceeds these standards in some cases. The details of the Control Standards applied to our Services can be seen within the Spotlite app.
The principles we apply to create these Control Standards are as follows:
Our Document Checks provide a Basic ID check that meet both LoA1 and LoA2 standards that the Applicant or customer is, on the balance of probabilities, the rightful owner of the Claimed Identity. This is evidenced by the Applicant taking pictures of two identity documents as required by regulation and confirming to us they are two original identity documents.
In addition, we collect biometric evidence (the selfie) from the Applicant and compare that to the captured Photo ID.
Our KYC Checks provide the LoA3 standard in that the Applicant’s identity is a real person and they are the rightful owner of the Claimed Identity. We do this by performing basic Document Checks combined with a check with two external databases to evidence of economic activity and evidence of a resident address (including historical addresses if they have only been at their current address for a short time). We also include a mortality check and sanctions check as part of the package.
Our more advanced Services meet the LoA4 standard for high risk identity validation. These include Politically Exposed Person Checks, Adverse Media, Enhanced Due Diligence, DBS and Reference Checking. Details of our more advance Services can be found on our website and within the app.
How does an applicant complete their screening?
The Agent can either meet the Applicant face-to-face and scan the documents or can send the Applicant an invitation so they can scan their documents themselves.
Details required to send an invitation are name, email address, mobile phone number and the type of phone the user has, Android or IOS. The Applicant receives an SMS message providing them with a username and invite code for logging into the Spotlite app with a prompt to download the app from the app store or google.
The Applicant is asked to follow the on-screen instructions for taking a selfie, scanning Photo ID and a proof of address before submitting.
The certificate is produced and sent to the Applicant for downloading and is available to you within the Client Portal.
Why does an Applicant need two documents to prove their identity?
Currently within UK regulation, two forms of ID are required for employment and KYC checks with regulated institutions like banks, building societies, estate agents, solicitors, etc. The Photo ID, i.e. a Passport, National ID Card or Driving Licence, is evidence of Claimed Identity and we conduct biometric checks against the Selfie and the picture on the Photo ID. The Proof of Address is recent evidence of the Applicant’s place of residence.
What do I do if on some documents it captures the scan but some of the captured details have recorded incorrectly?
That’s ok. We are supporting the user in doing their job, not testing their ability to take good pictures.
If the document has an MRZ Code, a Bar Code or a QR Code, we will pick up details from that code – in these cases you will not be able to edit the document. But if we are simply reading the document using OCR, then you can edit the details as necessary. The app will prompt you to do this.
Anything that is changed from the scanned document is recorded and shown on the certificate. We also run analytics and spot checks behind the scenes to ensure the system is tuned and there is no systematic abuse. In the case of biometric alerts, we always double check the documents on behalf of our clients.
What if I don’t think the documents presented to me are genuine?
You should progress in line with your internal procedures. In the meantime, click here for the UK Government Advice on detecting fraudulent documents. If the documents are fraudulent, click here to report your concerns to Action Fraud.
Can the same Identity document be used for both the photo ID and proof of address scans?
No, under the regulations one document cannot be used twice. This all about helping to reduce fraud and criminal activity within our economy. That’s why the regulations exist. For these reason’s Applicants are required to provide two separate documents – one for identity and one to demonstrate recent activity at their residential address. Whilst this may seem inconvenient, it is better than letting criminality continue unchecked – we must all play our part.
Taking a Selfie
Applicant is having problems getting the selfie to work
Okay, let’s check the settings first: On the device, go to Settings. Scroll down until you see the Spotlite entry Press the little arrow in the row for the app, they should then see the Allow Access settings. Spotlite needs access to the Camera, Face ID and Mobile Data. Siri can also be switched on to read the screens.
Next check that the camera lens is clean and free from obstruction. Good data or internet connection and sufficient battery power is also required to complete the process.
Now, if that’s all good, here is what the Applicant needs to get the best results:
The Applicant has refused to take a selfie – what can I do now?
Well, that’s fair enough. Applicants have a right to withhold their consent under GDPR. Depending on the circumstances you may be obliged to offer an alternative manual approach for the Applicant to proceed. Check with your compliance officer. You can also click here to find out why gaining consent is important for both you and your Applicant.
Taking a Photo ID
Why does the Applicant need to provide a Photo ID?
Asking the Applicant to provide a government issued Photo ID is a straightforward way to link an individual with their claimed identity whilst at the same time creating a significant barrier for others trying to claim to be somebody they are not. This is why we face match the Applicant’s selfie with the photo on the Photo ID.
Spotlite says that there is a mismatch between the selfie and the Photo ID
A mismatch can take place for several reasons.
The biggest reason is that the person in the Selfie and on the Photo ID are not the same person. If you get a mismatch, double check the Applicant is the same person as on the Photo ID. If someone is using a false identity, be aware of your safety and follow your internal procedures. Click here for the UK Government Advice on detecting fraudulent documents. If the documents are fraudulent, click here to report your concerns to Action Fraud.
A mismatch can also occur if the Applicant’s physical appearance is different to that on the Photo ID. This can happen for several genuine reasons, such as:
So, what do you do if Spotlite is just plain wrong? Well, Spotlite is about helping you collect evidence of compliance and setting basic control standards. If the machine is wrong, you simply override. This will create an Amber warning and will be highlighted on the certificate. We will also double check that the system is not being abused. This will be invisible to both you and the Applicant. We will not put you at risk in front of a potential fraudster but give you confidence that we are working with you to help prevent fraud. If we do detect fraud, we will report our suspicions and may monitor your account for a while.
Verifying Proof of Address
The A4 document fails to scan
If there is a fold or creases in the paper this may create a shadow that confuses the camera. If Spotlite doesn’t recognise the A4 document, it won’t take a picture. Our machine learning algorithms our continually updating to recognise more documents and their format, so in the meantime, here are some other things to watch out for:
However, given the right light, Spotlite will take a snap of the document, although if the quality is bad you may have to input some information manually.
The name has not been scanned correctly, the address cannot be found and/or the date is not found on the document
We are continuously looking to improve where machine learning doesn’t do things very well – such as read ‘O’ for ‘0’ or ‘l’ for ‘1’. , However, you can correct any offending items by pressing the Edit button after the document has been scanned and Spotlite will tell you if there’s anything it doesn’t like the look of. Things to watch out for are:
You can reduce these errors by using passport for the Photo ID and a Driving Licence as Proof of Address. Also ensure the A4 document is good quality, has no folds or shadows and is not creased. Otherwise follow best practice.
Best practice is to use Spotlite in an environment where light is evenly diffused and there is no direct strong light source causing glare or reflections on the document. Even the best cameras cannot out-perform the human eye in uneven or extreme bright or dark lighting conditions. Beware low light conditions which can the cause unpredictable results.
The moving in date will always be required to be added once the Proof of address document has been scanned.
Spotlite says the document is out of date when it isn't
The issue date can be amended by selecting change before confirming the captured information.
Can I rescan if a document isn't captured correctly?
Yes, it’s very easy, just tap the retake button at the top left of the picture – you can do this at any time prior to submission.
Understanding the Certificate
The Applicant has asked for a copy of the certificate, what do I tell them?
A link to the certificate will be forwarded to the e-mail address provided by them and the Applicant will be able to download it and save a PDF copy to their device.
How will I know when an Applicant has completed their screening?
The certificate will be presented in the Client Portal once completed and the Client Portal can be configured to send an email, with the certificate for downloading, to the Applicant. You also have the option in the settings on the Client Portal to receive a copy of the certificate via email.
The Applicant has asked who retains the document and for how long?
The certificate will be deleted from our CDD Management systems after 15 days.
You must advise the applicant of your business policy for retention of such records.
Can the Applicant store a copy of the certificate on their phone?
They can download the certificate in PDF format for saving.
What happens if an alert is received following a search?
If any alerts are received following a search, these will be discounted on 3 core levels: – Date of Birth, Citizenship and Location. If the alert cannot be discounted, we will advise you via email and you must carry out further investigation in line with your internal procedures – or you can request assistance from our Investigations Team.
Data & System Issues
The battery ran out half way through the process – what happens to the information already collected?
The information will be lost and the Applicant will need to restart the Applicant process.
The screen dims during the scanning process
In Settings, Display & Brightness – amend your Auto-Lock to 1 minute or above.
Reception failed half way through the process – what happens to the information already collected?
The information will be lost and the Applicant will need to start the process again.
How do I report an issue with the system?
Please contact us via email at firstname.lastname@example.org or via the feedback option in the menu of the app or client portal, providing as much detail as possible including date and time.
If the Applicant starts the screening process can they save it and come back to it later?
No, if the process is not completed to submission within 30 minutes the app will time out and even if the process is completed it will not submit for certification. The Applicant will need to start the process again.
Can the app be customised?
Yes – see the package details for options or contact our sister company, CDD Software Services, who will be happy to discuss your bespoke requirements.
Is the process compliant?
The purpose of the app and portal is to help you comply with your regulatory responsibilities.
Standard Privacy Policies and Terms & Conditions can be found within the menu of the app or via the footer links on this website.
Regulatory checks are carried out in line with the service requested, these are detailed within the Menu of the app.
How is the Applicant’s consent for checks recorded?
The Applicant takes a Selfie and confirms consent at the start of the process – nothing can happen until the Applicant provides this live consent which is also recorded on the final certificate.
I have visual impairments and I would like to hear the content of the screen on my iPhone
Go into Settings, General, Accessibility, Speech, Speak Screen and turn on. When in the app, swipe down with two fingers from the top of the screen to hear the content of the screen.
I have visual impairments and I would like to hear the content of the screen on my Android phone
Go into Apps Icon, Settings, Accessibility, If unavailable, swipe screen left or right or tap the Arrow icon to display all apps. Tap Select to Speak. Tap the Select to Speak to turn on or off.