Step 1
Consent and photo
Svyatoslava signs the consent as a separate document and has her photo taken at the desk. Liveness checks that a live person is in front of the camera — a photo from a screen will not get onto the list.
Face lists: white, black and VIP
Managing face profiles in one dashboard: an access list for employees and contractors, a blacklist of faces for onboarding and a site stop list, and VIP guests who asked to be recognised. Every entry has a reason, an expiry and an author. On a match the system shows the employee the frame and the photo from the list, and the decision is made by the employee — or by the Unified Biometric System (EBS).
Face lists
Only your database The employee decides Cloud in Russia or your own environment
Managing face profiles: one database, different rules for each list
The list suggests, a person decides
A face matching a list is neither a pass nor a refusal but a candidate on the employee’s screen: the frame, the photo from the list and the reason for the entry.
- 01
The person profile is the main object
A photo or several face crops, full name, group, source and custom fields: the reason for adding, the expiry, who added it. One person — one profile, which can be moved from list to list rather than copied.
- 02
Each list has its own purpose and its own owner
The access list is run by the security service, the KYC blacklist by anti-fraud, the VIP list by customer service. Who sees a list and who can change it is set by dashboard user roles.
- 2 photos the frame and the list photo side by side
- 1 reason in every entry
- 1 expiry after it, the entry is reviewed
White, black, VIP and three more: the face lists people set up
The mechanics are the same for every list — the face is matched against profiles. What differs is who gets onto the list, on what grounds, and what happens on a match.
White list: employees and contractors
People let through the checkpoint, into a workshop or a hazardous area. A profile holds a photo taken with written consent, the zone and the access expiry; anyone who has not given consent goes through with a card. The guard opens the way after comparing the frame with the photo, or EBS does — details on the page about face-recognition turnstiles.
Consent · Zone · Expiry
Temporary list: guests and one-off contractors
A guest presents a document, the face is matched once against the photo in the document, and the guard confirms access. The entry lives until the end of the visit or the contract and is deleted on expiry; a face template is not kept for the next visit without consent.
Document · Liveness · Until the end of the visit
VIP list: guests who asked to be recognised
Club members, hotel guests and clients of a premium office sign a consent, and at the desk the administrator gets a hint: the frame, the photo and the name. They confirm it is that guest and greet them by name. In a shop floor, shoppers are not recognised.
Consent only · At the desk
KYC blacklist: confirmed fraud
An employee adds the face from a session where fraud is confirmed to the blacklist in one click. If the face shows up in a new session, the session gets the flag “User is on the blacklist” and goes to an operator for a decision — even if the passport and phone number are new. How the search works — on the page about face search.
Onboarding · Operator decides
Site stop list: rule breakers
People the site owner has refused access: those dismissed for theft, safety violators. They are added only on a lawful basis — consent or a case named directly in the law. On a match the guard gets the frame and the photo and decides themselves whether to approach and check documents.
Basis · Guard decides
Repeat-customer list: past KYC sessions
Matching against faces from your account’s past sessions shows that a person has already been checked under different details. The session gets the status “suspicious” and goes to manual review: a repeat customer is not always a fraudster.
Duplicates · Manual review
A list entry lives by rules: added, checked, matched, deleted
The example is the VIP list of the Rotonda business club. Club member Svyatoslava Romashina asked to be recognised at reception without a pass.
Step 2
A profile with a reason and an expiry
The administrator creates a profile in the “VIP · Rotonda” list: reason — “club member”, expiry — end of membership, added by N. Rozhnov.
Step 3
A hint for the administrator
Svyatoslava approaches reception. The administrator’s screen shows the camera frame and the list photo side by side. They confirm “It’s her” and greet the guest by name; if unsure, they ask for the club card.
Step 4
Deletion on expiry or withdrawal
The membership ended or Svyatoslava withdrew her consent — the profile is removed from the list and the data from the system. The log keeps a note of who deleted it and when.
Who decides on a match: administrator, security, KYC operator or EBS
-
VIP — the administrator at the desk
They see the frame and the list photo, confirm it is the guest and greet them by name. A mistake costs an awkward moment, not a refusal: if in doubt, they ask for a card or a name.
-
White list — the guard at the checkpoint
They compare the frame and the photo, see the zone and the access expiry, and press “Let through” or “Detain”. The second lawful way to pass — through EBS, without your template database.
-
KYC blacklist — the verification operator
A session flagged “User is on the blacklist” goes to an operator: the selfie, the list photo, the documents from both sessions. A refusal is their decision, noted in the card.
-
Site stop list — security
The alert arrives at the post with the frame and the reason for the entry. The guard approaches, checks documents and decides under the site’s instructions; the system does not call a patrol and does not write “identified”.
Blacklist alerts and a VIP-list hint work the same way: the system finds a candidate and shows it to a person. The decision is theirs. Who that person is depends on the list.
The page does not offer an automatic decision on your own list — open, refuse, block: the law expressly allows recognition outside EBS only with an employee involved. How passing through EBS works — on the page about “Identification through the UBS”; cameras on site — video analytics for security.
Face lists and the law: consent, the basis for a stop list and Federal Law 572
A face in a list is biometric personal data: it is used to establish who is in front of you. Below is what the law expressly allows for each kind of list and what to arrange in advance. A summary of the rules as of October 2026 — a guide for your lawyer, not a legal opinion.
- Biometrics are processed with the person’s written consent, except in the cases of Art. 11(2) of Federal Law 152
- Since 1 September 2025 consent is given separately from other documents (Art. 9(1) of Federal Law 152 as amended by Federal Law 156)
- Service cannot be refused because a person declines biometrics — they keep a card, a document or a name at the desk (Art. 11(3) of Federal Law 152)
- Federal Law 572 does not apply to matching that is not automatic but done with an authorised official involved (Art. 1(2)(2) of Federal Law 572)
- The powers of the administrator, guard and operator — in an internal act or a contract
- The system picks a candidate and shows the frame and the photo; the decision is written to the log
- Biometrics are processed without consent only in the cases of Art. 11(2) of Federal Law 152 — for example, under the laws on transport security, counter-terrorism and operational investigations. If your company has no such basis, only people who gave consent are added to a face stop list — for example, a customer who went through a KYC session with consent for this purpose
- For everyone else, the stop list is kept by document or phone number — without a face
- Biometric authentication — by EBS vectors through the information system of an accredited organisation, with the person’s consent (Art. 15(1)(2), Art. 16(3–4) of Federal Law 572). More — through the UBS
- After authentication, biometrics are kept only to handle complaints — for no more than 10 days (Art. 15(1)(3) of Federal Law 572)
- Data is not kept longer than the purpose requires; once it is achieved or consent is withdrawn, it is deleted (Art. 5(7), Art. 9(2) of Federal Law 152)
- The profile is removed from the list, KYC session data — on request; a blacklist record may be kept with its reason — this is set out in your policy
- Organisations are prohibited from collecting and storing biometrics for identification outside EBS (Art. 15(1)(1) of Federal Law 572). Whether your scheme falls under the ban depends on where the list is stored and who makes the decision — a lawyer gives the qualification before launch
- A decision with legal consequences cannot be made solely on the basis of automated processing without the person’s written consent (Art. 16(1) of Federal Law 152)
- Federal Law 152 — as amended on 26.07.2026, Federal Law 572 — of 28.12.2024. The summary is simplified; check the current versions in ConsultantPlus.
Reason, expiry, author: what to keep in a person card
Managing person profiles starts with fields. A card without a reason and an expiry turns, a year on, into a list of people nobody remembers the purpose of.
-
Reason for adding
Short and verifiable: “access to workshop 2”, “club member”, “confirmed fraud, session no. 48213”. The employee sees it on a match — and understands how to act.
-
Valid until
Until the end of the contract, visit or membership, or for the period the purpose needs. On expiry the entry is reviewed or deleted.
-
Who added it and on what basis
The dashboard user, the date, a link to the consent or the supporting document. This answers a person’s question “why am I on the list”.
-
Custom fields and source
Department, zone, contract number, photo source — camera, file or KYC session. Fields are set as person properties and come back in the API response.
An old photo, a duplicate entry, a forgotten expiry: mistakes that spoil lists
-
A small or old photo
A side-on shot, one in dark glasses or ten years old gives both false hints and misses. Faces below a set size or strongly turned are not added to the list; photos are refreshed on expiry.
-
One person — two entries
An employee is added twice from different sources, and the hints get confused. The “Find similar persons” function shows duplicates, and the extra entry is merged or deleted.
-
A forgotten expiry
A contractor left six months ago, yet their profile is still in the access list. An expiry in the card and a regular review close both the risk of access and the excess data storage.
-
A photo from a screen at enrolment
If a photo from a phone rather than a live person was added to the list, the mistake lives for as long as the entry. Liveness at the enrolment step keeps a screen, a printout or a mask out of the list.
A list is only as good as the care taken over it. Most false hints come not from the algorithm but from what is in the list itself.
The match threshold and how it affects false hints are covered on the page face search in a database. The main rule here: a doubtful match is a reason for the employee to ask for a document, not grounds for a refusal.
Where white, black and VIP lists are kept
Wherever one person comes back — for access, money or attention — and it matters who they are.
-
Banks and MFIs
- A face blacklist after confirmed fraud
- A repeat application under a different passport
- The operator decides Learn more
-
Manufacturing and warehouses
- An access list by workshop and zone
- Temporary contractors with an expiry
- A stop list after safety violations Learn more
-
Hotels and business clubs
- VIP guests with consent
- A hint for the receptionist
- Deletion after checkout or the end of membership Learn more
-
Bookmakers and online games
- Re-registration after a block
- One account per person
- Matching within a KYC session Learn more
-
Events and venues
- Accredited participants and staff
- Organiser’s stop list
- An entry check with security Learn more
-
Contractor platforms
- A removed contractor will not return under a new name
- Repeat KYC
- A moderator decides Learn more
How to run lists: dashboard, file upload, API or your environment
- Person lists in the console and via API
- Search across several lists
- Upload by files
- Cloud or your own perimeter
Terms
Free test — 1 month. Cloud in Russia or your server. Pay per check.
How much face-list management costs
In KYC, the blacklist and the repeat-customer search are included in the session price. Access, guest and VIP lists for sites are priced by the number of people, entries and the place of work — cloud or your server.
-
The “Document + liveness” package: document, selfie, Liveness, face-to-document match, face-list search and the blacklist.
- Calculate lists
Lists for a site
on request
Person lists, employee alerts with the frame and photo, dashboard and API. Pay per check.
- Calculate installation
In your perimeter
on request
Lists, templates and search — on your servers with no internet access.
The first month is a free test. Cameras, terminals and installation are not included. KYC session pricing by volume — in price matrix.
Glossary: white list, stop list, person profile and Personex
Terms from a conversation with security, anti-fraud and your lawyer.
- Person profile
- A record of a person in a list: a photo or face crops, full name and custom fields — reason, expiry, source.
- person profile
- Person list
- A set of profiles with one purpose and one owner: access, guests, VIP, stop list.
- person list
- White list
- People allowed access or service without extra checks.
- whitelist
- Face blacklist
- Faces from sessions with confirmed fraud; a match is a signal to the operator.
- face blacklist
- Stop list
- People the site owner has refused access on a lawful basis.
- stop list
- VIP list
- Guests who gave consent to be recognised and greeted by name.
- VIP list
- The candidate
- A profile from a list that resembles the face in the frame; an employee makes the decision on it. More — face search.
- match candidate
- Match alert
- A message to an employee with the frame, the list photo and the reason for the entry.
- match alert
- Biometric template
- A numeric face vector used for comparison; the photo need not be stored. More — face recognition.
- face template
- UBS
- The Unified Biometric System — a state system holding citizens’ biometrics. More — identification via EBS.
- Unified Biometric System
- Personex
- A NeuroVision module for managing person profiles and face lists.
- Personex
Licences and certificates
The project «Development of a multimodal system using artificial intelligence "Neuromed" for managing the diagnostic processes of a clinic on the basis of the "Neurovision" computer vision platform» is supported by the Innovation Promotion Foundation within the federal project «Domestic Solutions»
The Neurovision computer vision platform is registered with Rospatent (certificate No. 2023661508) and included in the Russian Software Registry (entry No. 19972 of 13.11.2023)
The right to use the Platform is granted under a licence agreement concluded by Neurovision with its customers
We will set up face lists for your site or onboarding
Tell us which lists you need — access, guests, VIP, stop list or a KYC blacklist — how many people are in them and who will decide on a match. We will propose a scheme and a one-month test.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a call
The company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
Read also
Materials on face recognition, algorithm accuracy and protection against deepfakes — in our blog.
178 25
KYC, AML and Digital Identification
Liveness Detection: What It Is, How Liveness Checks Work, and Where Businesses Need It
187 18
KYC, AML and Digital Identification
Unified Biometric System (EBS): What It Is, How to Enroll Your Biometrics, and Where It’s Used
174 23
KYC, AML and Digital Identification
Face Recognition System: How It Works, Its Accuracy, and Where It’s Used
397 23
KYC, AML and Digital Identification
Local or cloud KYC: how to choose a biometric data storage model
Frequently asked questions about white, black and VIP lists
It is keeping lists of people with a face photo and fields — reason, expiry, author of the entry. Recognition matches the face in the frame against the profiles of chosen lists and shows the employee a candidate.
A white list — people allowed access: employees, contractors, guests. A black one — faces from sessions with confirmed fraud or people who broke site rules. In both cases an employee decides on a match.
No. A session with a match gets the flag “User is on the blacklist” and goes to an operator, who sees the photos from both sessions and makes the decision. A match is a signal, not a verdict. How the search works — face search in a database.
We do not recognise shoppers on a shop floor. The VIP list is for guests who gave written consent themselves: a club, a hotel, a premium office. The hint goes to the administrator at the desk, who confirms it is the guest.
A camera or terminal finds a face resembling a stop-list entry and sends the guard the frame, the list photo and the reason for the entry. The guard approaches, checks documents and decides under the site’s instructions. Cameras on site — video analytics for security.
Biometrics are processed without consent only in the cases named directly in Art. 11(2) of Federal Law 152. If your company has no such basis, the stop list for these people is kept by document or phone, without a face. Agree the scheme with your lawyer.
Federal Law 572 does not apply to matching with an authorised employee involved. The law allows automatic biometric recognition through EBS — how it works.
As long as the purpose needs: until the end of the contract, visit or membership. On withdrawal of consent the profile is deleted. The expiry is recorded in the card.
Upload photos as files in the dashboard — each becomes a person in the chosen list — or pass the list from an HR system via the API. Small and strongly turned faces will not get into the list.
Yes. Profiles, templates and search are installed in your environment with no internet access. The cloud option runs on servers in Russia. More — installation in your environment.
In KYC, the blacklist and the repeat-customer search are included in the “Document + liveness” session — from ₽29. Lists for sites and installation in your environment — on request; the first month is a free test. More — price matrix.
