Personal Identification: What It Is, How It Is Carried Out, and When the Law Requires It

Personal identification is establishing a person’s identity: the person names themselves, and the organization confirms it with a document or a state system. In business, it determines whether an account can be opened, a signature issued, a SIM card sold, or a guest checked in. In psychology and forensics, the term has a different meaning — here we are talking about the identification of a customer or user. Let’s look at what personal identification is, how it differs from authentication and verification, how it is carried out, and where the law requires it and where a company checks a customer under its own rules.

What Personal Identification Is

The everyday meaning: the answer to the question “who are you?” — linking a person to a set of information about them (full name, date of birth, document) and making sure that this information is correct.

From these two definitions it follows that:

1. identification involves two actions: establishing information about a person and confirming it;
2. the method of confirmation is decided by the law;
3. an identifier is a “key” to which information about a person is linked: a document number, SNILS (individual insurance account number), an account (Article 2(6) of 572-FZ). In everyday usage, a set of such keys of a person is called a “citizen identifier”: SNILS, TIN, passport series and number.

In banking practice, identification is called KYC — “know your customer”; more in the article “KYC in 2025: How Customer Identification Works”.

Identification and Authentication: What the Difference Is and Where Verification Fits In

Identification and authentication are different procedures, and they are often confused.

Identification is “who are you?” — once, at the first contact. Authentication is “is it you again?” — at every login or transaction: verifying that identifiers belong to a person by matching them with the information the verifying party holds, and establishing that the person lawfully holds them by means of authenticating factors (Article 2(2) of 572-FZ) — for example, a password, a code, a signature, biometrics. Verification is “are the data and the document genuine?”. The term has no provision of its own: it does not appear in 115-FZ; in practice, it refers to checking the authenticity of a document and data and that the person is who they claim to be. Within identification, verification is usually part of it, while where the law does not require identification — on a marketplace, in sharing services — it may be a stand-alone procedure.

What Information Is Established During Identification

For an individual, 115-FZ (Article 7(1)(1)) requires establishing:

• full name;
• citizenship;
• date of birth;
• the details of the identity document;
• for foreigners — the details of documents confirming the right to stay, if they are mandatory under international treaties and Russian law;
• the address of the place of residence or stay;
• TIN — for a digital record-keeping agreement and a number of transactions with digital currencies and digital rights; in other cases — if available.

The exact list is at the link to consultant.ru (in Russian). Phone number and email are not on the list.

In simplified identification, less is established: only the full name and the series and number of the document, and they are confirmed by one of the three methods provided by the law.

Identification documents and information are kept for at least five years from the day the relationship with the customer ends (Article 7(4) of 115-FZ).

More on verification levels in the article “Three-Level KYC Model: How Simplified, Full, and Enhanced Checks Work”.

Methods of Personal Identification

There are six methods, and each is permitted by a provision. A company chooses from those the law has given specifically to it.

In Person by Document

The classic method: a person comes with a passport, an employee compares the face with the photo and enters the information. The law speaks of using original documents and/or duly certified copies (Article 3 of 115-FZ).

Besides the photo, it is worth checking the validity of the passport against the MVD database, signs of a forged passport blank, and the TIN by passport.

More: checking passport validity and data against databases, document recognition.

Without Personal Presence via ESIA and EBS

Banks and other organizations supervised by the Bank of Russia — except branches of foreign banks — are entitled to identify an individual without personal presence via the Unified Identification and Authentication System and the Unified Biometric System (Article 7(5.8) of 115-FZ; Article 9(1) of 572-FZ). The EBS reports the degree of match of the face to the vectors, and the ESIA transmits information about the person (Article 9(1)(1)–(2) of 572-FZ).

Other organizations identify via the EBS in the cases established by federal laws, acts of the Government, and other regulations adopted in accordance with them (Article 9(1) of 572-FZ) — Part 2 of the same article establishes only the technical conditions for connecting to the EBS and contains no independent ground for identification.

Among the conditions of Article 7(5.8): the customer is not on the lists of persons involved in extremism and terrorism or on UN Security Council lists.

A bank with a universal license that meets the criteria of Article 7(5.7), paragraphs 2–4, and opens accounts and extends ruble loans through a website or app is required to give customers this path (Article 7(5.8-1) of 115-FZ).

More: remote identification via the EBS, “Unified Biometric System (EBS)”.

Simplified Identification

Three methods (Article 7(1.12) of 115-FZ):

1. in person, using original documents and/or duly certified copies;
2. the customer provides the organization with their full name, passport series and number, and SNILS (and/or another identifier from the list), and the organization confirms the information via state information systems;
3. authorization in the ESIA with an enhanced qualified or simple electronic signature whose key was issued at an in-person appointment.

These methods are available only for the transactions of Article 7(1.11) — transfers without an account up to ₽100,000, issuing an electronic means of payment, and the other cases listed there — subject to all the conditions of Article 7(1.11), among them the absence of suspicion and of an unusual nature of the transaction. In case of doubt, the organization is required to carry out full identification.

Microfinance organizations (MFOs) are not entitled to issue consumer loans on the basis of simplified identification (Article 7(1.12-1), paragraph 2, introduced by Federal Law No. 41-FZ of 1 April 2025); for microcredit companies, the provision applies from 1 March 2027.

More: simplified identification online.

On a Bank’s Instruction

A credit institution is entitled, under an agreement, to delegate the identification of a customer to a federal postal service organization, a mobile network operator, or an accredited certification authority — for the purposes of transferring funds without opening a bank account and of providing an electronic means of payment (Article 7(1.5) of 115-FZ). The delegating organization is responsible for the result (Article 7(1.6)).

Organizations under Article 7(1.5-9) and (1.5-10) — among them pawnshops, leasing companies, jewelers, real estate agents — are entitled to delegate identification to a credit institution; who may be delegated what is covered on the page on remote identification.

By Qualified Electronic Signature

A certification authority issues a qualified certificate only after identifying the applicant (Article 18(1)(1) of Federal Law No. 63-FZ “On Electronic Signatures”), so behind the signature stands an identification of the owner that has already been carried out.

Other methods are also based on this: logging into the ESIA with a valid qualified electronic signature is one of the methods of simplified identification (Article 7(1.12)(3) of 115-FZ), and a communications services agreement can be concluded online using a UKEP (Article 44(1) of Federal Law No. 126-FZ “On Communications”).

More: identification for certification authorities.

By an International Passport With an Electronic Chip

When issuing a qualified certificate to a Russian citizen, a certification authority may carry out identification without personal presence using data from the electronic medium in the international passport, including biometrics (Article 18(1)(1) of 63-FZ) — the chip is read via the phone’s NFC. For banks, this method is not named by law: it is not in Article 7(1.12) or (5.8) of 115-FZ.

More: passport NFC chip check.

The method is assigned by the law, not by the company. First you need to determine the applicable provision, then build the process.

Digital and Electronic Identification: What These Terms Mean

Digital identification is a general name for identification via digital channels: a person confirms their identity through an app, a website, or a state system. In the eight relevant laws — 572-FZ, 115-FZ, 149-FZ, 152-FZ, 63-FZ, 273-FZ, 135-FZ, and the Banking Law (395-1) — there is no such term: 115-FZ, 572-FZ, and 63-FZ say “without personal presence.”

Electronic identification is a term of the EU eIDAS regulation: the process of using person identification data in electronic form uniquely representing a natural or legal person (Article 3(1) of Regulation (EU) No 910/2014). In Russian texts, the word is used as a synonym for digital identification.

Identification is a procedure. Digital identity is a person’s set of data and accounts online; more on the Digital ID platform page.

The Russian infrastructure for identification without personal presence is the ESIA (the Gosuslugi (State Services) account) and the EBS. Both are state systems, and businesses connect to them under the rules of the law.

Where Personal Identification Is Mandatory by Law

The obligation arises for specific organizations under specific laws — not for everyone who works with people.

Among communications operators, the obligation applies only to mobile network operators, not to any communications operator. More on what 115-FZ requires of businesses in the article “115-FZ: What Businesses Are Required to Do and How to Meet the Law’s Requirements”; on checking in guests — “Check-In by Documents”, on communications operators — “Subscriber Identification by Communications Operators”.

Limitations: Biometrics, Consent, and Voluntariness

In their own information systems, organizations are prohibited from processing, collecting, and storing biometrics used for identification — except for collecting biometrics for placement in the Unified Biometric System in accordance with federal laws (Article 15(1)(1) of 572-FZ).

Submitting biometrics is not mandatory (Article 3(11) of 572-FZ): refusing biometric identification may not be a ground for refusing a service (Article 3(13)). The customer must still have a path without biometrics — an office, simplified identification, delegation to a bank.

Consent to the processing of biometrics must be in writing, except in the cases of Part 2 (Article 11(1) of Federal Law No. 152-FZ “On Personal Data”).

A one-time match of a selfie with the photo in the presented document and a liveness check during verification are carried out without storing a template for repeated recognition.

More on liveness checks in the article “Liveness Detection: What It Is and How Liveness Checks Work”. More on matching: “Verification by Passport and Selfie”.

How to Set Up Identification in an Online Service: 5 Steps

More: “Online Identity Verification: How e-KYC Works”, “KYC Provider Requirements”.

Glossary of Terms

FAQ

What Is Personal Identification in Simple Terms?

<p>Establishing who a person is and confirming it: the person provides their full name and document details, and the organization checks them against the original passport, a certified copy, or via state systems. The law defines identification as establishing information about a person, verifying it, and matching it with an identifier (Article 2(7) of 572-FZ) — an identifier can be a document number, SNILS, or an account. In banking practice, the same thing is called KYC — “know your customer.”</p>

How Does Identification Differ From Authentication?

<p>Identification answers the question “who are you?” and is carried out once, at the first contact. Authentication answers the question “is it you again?” at every subsequent login or transaction: by password, code, signature, or biometrics — for example, when logging into a personal account or confirming a payment. Verification stands next to them — it is checking the authenticity of a document and data, a term of practice, not of law.</p>

Can Identification Be Completed Without Visiting an Office?

<p>Yes, but only by the methods provided by the law: via the ESIA and the EBS — for banks and organizations supervised by the Bank of Russia, with the conditions including that the customer is not on the lists of persons involved in extremism and terrorism; simplified identification — subject to the conditions of Article 7(1.11) of 115-FZ; on a bank's instruction — by the post office, a mobile network operator, or a certification authority, but only for the purposes of a transfer without opening an account and of providing an electronic means of payment. Certification authorities may also identify an applicant by a valid qualified signature, or a Russian citizen — by the international passport chip.</p>

What Is Simplified Identification?

<p>Establishing only the full name and the passport series and number, with confirmation by one of three methods: in person by document, using information from state systems (SNILS, TIN, and others), or via login to the ESIA with an electronic signature. It is available only for transfers without an account up to ₽100,000 and other transactions under Article 7(1.11) of 115-FZ — in case of doubt, the organization is required to switch to full identification. Microfinance organizations are not permitted to use simplified identification for consumer loans (for microcredit companies — from 1 March 2027).</p>

Is My Company Required to Identify Customers?

<p>Yes, if the company is on the list of Article 5 or 7.1 of 115-FZ (banks, MFOs, insurers, real estate agents, lawyers, and others), is a mobile operator (126-FZ), a certification authority (63-FZ), or a hotel (Rules No. 1912). If the company is not on this list, identification under the law is not needed: the customer may be checked under the company's own rules and the contract — that is, verified. Organizations under Articles 5 and 7.1 of 115-FZ keep documents and information about the customer for at least five years from the day the relationship ends (Article 7(4)).</p>

Can a Customer Be Identified by a Selfie?

<p>Storing and using biometrics for identification in one's own system is not allowed — except for collecting biometrics for placement in the Unified Biometric System in accordance with federal laws (Article 15(1)(1) of 572-FZ). A one-time match of a selfie with the passport photo and a liveness check in the moment — that a live person is in front of the camera, not a photo, a screen, or a mask — help make sure that the document is presented by its owner.</p>