Step 1
Gosuslugi login and consent
The customer opens your app, logs in through a verified ESIA account and signs consent to the processing of personal and biometric data. This is a step of your organisation.
Remote identification through the UBS
Banks and other financial market organisations identify a customer without an office visit through ESIA and the Unified Biometric System. The UBS answers whether the customer’s face matches their vector. The passport, watchlists, sanctions, liveness and the session log are covered by NeuroVision — in a separate KYC session alongside the UBS step, which the organisation connects under a contract with the operator.
Passport and watchlists — in one KYC session Liveness and document anti-fraud Session log and customer profile
What the UBS does in remote identification and what stays with you
The UBS answers one question
“Is this the same person?” — yes. “Can we work with them?” — that is the check of the document, watchlists and sanctions on your side.
- 01
The UBS compares the face with the vector
The customer submits a biometric sample, the UBS matches it against the vector — a mathematical representation of the biometrics the person gave earlier — and returns the degree of match. The organisation does not receive the biometric data itself from the UBS.
- 02
ESIA provides verified data
The second ground for identification under art. 9 of 572‑FZ — data about the person from ESIA: full name, passport, SNILS. A face match and a verified Gosuslugi account together establish identity without an office visit.
- 03
The decision and the customer profile — with the organisation
The UBS does not accept the customer for service. The conditions of cl. 5.8, art. 7, 115‑FZ — not on the watchlists, no freezing decision, no suspicions — are checked by you. The data is recorded in your customer profile and stored under your internal control rules.
- 04
Other routes — without the UBS
Simplified identification, delegation to a bank and checks outside 115‑FZ work without biometrics. Which route is available to your organisation is described on the page about remote customer identification.
- art. 9 572‑FZ: identification through the UBS
- 2 systems The UBS and ESIA in one procedure
- 1 session passport and NeuroVision checks in a single customer visit
Who may identify a customer through the UBS
The law speaks separately about identification and authentication. An organisation may identify a new customer through the UBS where the law provides for it for its activity. Accreditation is needed by others — those who authenticate people by UBS vectors in their own systems.
- May identify an individual customer, a representative and the head of a corporate customer without personal attendance through ESIA and the UBS, if the customer is not on the watchlists and there are no freezing decisions on them (cl. 5.8, art. 7, 115‑FZ)
- A bank with a universal licence that opens accounts and issues loans online must give customers this route (cl. 5.8‑1, art. 7, 115‑FZ)
- Watchlist and sanctions list checks in the NeuroVision KYC session — before the decision on the customer
- Online loans — only after identification through ESIA and the UBS: for microfinance companies from 1 March 2026, for microcredit companies — from 1 March 2027 (cl. 5.8‑2, art. 7, 115‑FZ)
- For microfinance organisations the Bank of Russia has separately defined threats when matching biometrics against UBS vectors (Directive No. 7362-U, in force from 25.07.2026)
- Part 1, art. 9 of 572‑FZ permits identification through the UBS in cases established by federal laws and acts of the Government. If there is no such provision for your activity, there is no right to identify through the UBS either
- An organisation without the right to use the UBS checks the customer under its own rules: document, liveness, databases
- An already known customer can be authenticated by UBS vectors in your own system only after accreditation (part 3, art. 16, 572‑FZ)
- Requirements for an accredited organisation: own funds of at least 500 million ₽, financial security for liability of at least 100 million ₽, foreign participation of no more than 49 %, an encryption licence, connection to GosSOPKA (part 2, art. 17); the procedure — Government Decree No. 810 of 22.05.2023
- Other organisations and sole proprietors may use the system of an accredited organisation for authentication — with the customer’s consent (part 4, art. 16). Login and confirmation of transactions by face — on the page about biometric authentication.
- The summary of the provisions is simplified and is not a legal opinion. An overview of all remote identification routes — on the page about remote customer identification; the bank’s obligations under 115‑FZ — on the page for banks; what the UBS and the CBS are — in the article “The Unified Biometric System”.
Remote identification for banks: what to prepare before the first request to the UBS
-
Personal data protection
What is needed. Confirm to the UBS operator the measures under part 4, art. 19 of 152‑FZ — the protection level of the information system and organisational measures (cl. 1, part 2, art. 9, 572‑FZ).
Where NeuroVision helps. The retention period for session data is set in the scenario, personal data is deleted by an API request. Protection measures for your information system remain with you. -
SKZI and the threat model
What is needed. Apply cryptographic protection tools against the threats defined for the financial market by the Bank of Russia: Directive No. 6540-U of 25.09.2023 and its supplement No. 7362-U (cl. 2, part 2, art. 9).
Where NeuroVision helps. NeuroVision does not replace your SKZI and the channel to the UBS: it covers the document and the checks in the KYC session. -
Technology requirements
What is needed. Meet the requirements for information technologies and technical means set by the authorised body (cl. 3, part 2, art. 9; cl. 1, part 2, art. 6, 572‑FZ).
Where NeuroVision helps. The scenario steps — consent, document, liveness, checks — are configured in the KYC editor, and you set the order of the steps. -
Contract and fees
What is needed. Conclude a contract with the UBS operator — JSC “Biometric Technologies Centre”; the amount and procedure of the fee are set out in the contract under a methodology approved in agreement with the Bank of Russia (art. 12, 572‑FZ).
Where NeuroVision helps. A NeuroVision session is charged separately and does not depend on the fee paid to the operator. -
Customer consent
What is needed. Obtain consent to the processing of personal and biometric data under part 4, art. 9 of 152‑FZ; it can be signed with an enhanced unqualified electronic signature (part 3, art. 9, 572‑FZ).
Where NeuroVision helps. The text of consent to photographing the passport and face is configured in the NeuroVision scenario; consent for the UBS is obtained by your organisation in its own form. -
A route without biometrics
What is needed. Leave the customer another option: refusing biometrics cannot be a reason for refusing service (part 11, 13, art. 3, 572‑FZ).
Where NeuroVision helps. The NeuroVision scenario works without the UBS too: the document and database checks for an office or simplified identification.
Interaction with the UBS starts not with the API but with documents for the operator. Below are six preparation steps taken by a bank, a microfinance company or another financial market organisation. For a bank, biometrics is first of all about protection requirements, and only then about the interface.
Timing and scope of work depend on whether you already have a connection to ESIA and SMEV. The exchange procedure is described in the technical documentation of the UBS operator; the passport and NeuroVision checks run in a separate KYC session and do not replace the channel to the UBS.
How a remote identification session through the UBS runs
One customer — one KYC session. The UBS is one step of the scenario; NeuroVision checks run before and after it. How such a scenario fits into the customer journey — on the page about digital onboarding.
Step 2
Passport and anti-fraud
The customer photographs the passport. The fields are recognised, the machine-readable zone is checked, and photos of a screen, photocopies and traces of an editor are rejected in the NeuroVision KYC session.
Step 3
Watchlists and sanctions
The passport data goes to the checks: the list of terrorists and extremists, sanctions lists. A match is a reason to stop the session. Freezing decisions and the other conditions of cl. 5.8 are checked by your organisation.
Step 4
Liveness and the sample for the UBS
The customer films their face. NeuroVision Liveness rejects a photo, a screen, a mask and a face deepfake. The sample for the UBS is collected and transmitted by your channel to the operator — under its requirements.
Step 5
The UBS response — in your channel
The UBS matches the sample against the customer’s vector and returns the degree of match to your system; ESIA data confirms the full name and passport. This response is received by your organisation.
Step 6
Result and customer profile
Your system combines the UBS response with the result of the NeuroVision session — the recognised fields and the check results — and fills in the customer profile. An employee sees the check results in the dashboard.
Vectors and the degree of match: what the UBS returns and what it does not check
The UBS response is shorter than people expect from “biometric identification”. Here is what it contains, what follows from it for the process and where other checks are needed. Russian passport recognition · Catalogue of database checks
-
A vector instead of a photograph
A UBS vector is the result of a mathematical transformation of a person’s biometrics. It is stored in the UBS; the organisation submits a sample and receives a response, but not the biometrics itself from the system.
-
Degree of match
The UBS reports how closely the sample matches the vector. Which degree is sufficient for identification is determined by the authorised body under approved methodologies, not by each organisation in its own way.
-
No vector — no response
If the customer has not submitted biometrics to the UBS, they cannot be identified this way. Another option is needed: an office, simplified identification or delegation.
-
The UBS does not check the document
The UBS does not look for a forged passport, a photo of a screen or a pasted-in photo. NeuroVision document anti-fraud covers this step in the KYC session.
-
Watchlists and sanctions — not the UBS either
The conditions of cl. 5.8 — not on the Rosfinmonitoring list, no freezing decision — are checked by you. In a NeuroVision session this is Rosfinmonitoring lists and sanctions screening.
-
The sample is not stored with you
Organisations are prohibited from collecting and storing biometrics for identification in their own systems. For authentication, storage is allowed for no more than 10 days to consider a customer dispute, followed by destruction.
Equipment, SKZI and data protection: requirements for a UBS session
The Bank of Russia threat model divides the session into sections: the customer’s device, your infrastructure, the channel to the UBS and requests to the operator. There are requirements for each section.
- The threat model covers individuals’ devices — smartphones, tablets, computers — and the threat of inserting a fictitious sample during collection and transmission (Directive No. 6540-U)
- NeuroVision Liveness in the KYC session rejects photos, video from a screen, masks and face deepfakes
- Protection against unauthorised access — certified to trust level 4 or higher; organisational and technical measures — as specified by the FSB of Russia (6540-U refers to them)
- Access to NeuroVision sessions and data — by token: validity period and user role; results — in the dashboard and via the API
- Threats to the integrity and confidentiality of the degree-of-match response during processing and transmission — are covered by SKZI (cl. 2, part 2, art. 9, 572‑FZ)
- Identification that requires cross-border transfer of biometrics is prohibited (part 21, art. 3, 572‑FZ)
- The retention period for KYC session data is set in the scenario, personal data is deleted by an API request
- Compliance with the requirements for identification and authentication is the subject of federal state control (supervision) (art. 18, 572‑FZ); for financial market organisations the checks under art. 16 are carried out by the Bank of Russia
- The KYC session log records the steps, check results and the outcome — for internal control and for replying to inspectors
- The summary is simplified; the set of measures for your system is determined by your information security team under the acts of the Bank of Russia, the FSB of Russia and the FSTEC of Russia. How to choose a data storage model — in the article “On-premise or cloud KYC”.
What NeuroVision takes on alongside the UBS: document, watchlists, liveness and log
The channel to the UBS — yours
Contract and SKZI — with you
The contract with the operator, SKZI and the request to the UBS stay with your organisation. NeuroVision steps — document, checks, liveness — are embedded in your onboarding alongside this step, and you set the order in the KYC editor.
The passport with no manual entry
16,000+ types, 195+ countries
16 000+ document types from 195+ countries and territories, document anti-fraud in all packages.
Liveness on the customer’s device
Protection against photos, screens and masks
Protection against photos, screens, masks and face deepfakes. In detail — on the page about verification by passport and selfie.
The conditions of cl. 5.8 in the same session
Watchlists and sanctions — in the session
List of terrorists and extremists, OFAC, EU, UK and UN sanctions lists, passport validity, INN by passport.
Log and customer profile
Dashboard and CSV
Check results and recognised fields — in the dashboard and in your system; reports are exported to CSV.
572‑FZ
The rights to the UBS are yours. The document, watchlists, liveness and the trail of each session are ours.
How much identification through the UBS costs together with NeuroVision checks
The cost has two parts: the fee to the UBS operator under your contract with it, and the NeuroVision KYC session — one customer visit with all the steps of the scenario.
- Calculate
Document
from 16 ₽
Passport recognition, anti-fraud, machine-readable zone check.
- Calculate
Document + liveness
from 29 ₽
Everything from the “Document” package plus liveness on the customer’s device.
- Discuss
Extended
on request
Document, liveness and database checks in one package.
Database checks — 5 ₽ each: passport validity, INN by passport, list of terrorists and extremists, sanctions lists. International screening — 36 ₽. Repeated capture attempts are not charged. The fee for requests to the UBS is set by the contract with its operator (art. 12, 572‑FZ) and is not included in the session price. Calculator in the price matrix.
How to connect NeuroVision checks alongside the UBS step: Web SDK, WebView or API
Terms
- Try the demo
- NeuroVision checks — in a separate KYC session
- Support under the contract, via a ticket system
Glossary: UBS, vectors, ESIA and accreditation
- UBS
- The Unified Biometric System — a state information system through which organisations identify and authenticate people by biometrics under 572‑FZ. More — in article about the UBS.
- Unified Biometric System
- UBS operator
- The organisation to which the Government has assigned the operator functions — JSC “Biometric Technologies Centre”. An organisation concludes a contract with it.
- EBS operator
- UBS vector
- Data obtained by a mathematical transformation of a person’s biometrics from the UBS; the customer’s sample is compared against it.
- Biometric template
- Degree of match
- The UBS response on how closely the sample matches the vector; the sufficient degree is determined by the authorised body.
- Match score
- ESIA
- The Unified Identification and Authentication System — the Gosuslugi infrastructure, the second ground for identification through the UBS.
- ESIA
- Identification
- Establishing data about a person and verifying it; through the UBS — for a new customer.
- Identification
- Authentication
- A check that the holder of the identifier is the one making the request — for example, login or confirmation of a transaction by an already known customer.
- Authentication
- Accreditation
- Admission of an organisation to authentication by UBS vectors in its own system (arts. 16–17, 572‑FZ); not required for identification under art. 9.
- Accreditation
- SKZI
- Cryptographic information protection tools; mandatory when interacting with the UBS.
- Cryptographic protection
- Liveness
- A check that a live person is in front of the camera, and not a photo, a screen, a mask or a deepfake.
- Liveness detection
Read also
167 18
KYC, AML and Digital Identification
Unified Biometric System (EBS): What It Is, How to Enroll Your Biometrics, and Where It’s Used
384 16
KYC, AML and Digital Identification
How to ensure the protection of personal and biometric data in KYC processes
380 23
KYC, AML and Digital Identification
Local or cloud KYC: how to choose a biometric data storage model
162 25
KYC, AML and Digital Identification
Liveness Detection: What It Is, How Liveness Checks Work, and Where Businesses Need It
373 13
KYC, AML and Digital Identification
Digital KYC and e-KYC: how real-time remote identity verification works
114 29
KYC, AML and Digital Identification
115-FZ: What Businesses Are Required to Do and How to Meet the Law’s Requirements
Frequently asked questions about identification through the UBS
Submit documents to the UBS operator under part 2, art. 9 of 572‑FZ (personal data protection measures, SKZI, compliance with technology requirements), conclude a contract, obtain the customer’s consent and build the steps into the app: login through ESIA, a biometric sample, a request to the UBS. The bank carries out the document and watchlist checks itself — with NeuroVision these are steps of a separate KYC session.
Through the UBS a customer is identified by biometrics and ESIA data; this is available to banks and organisations supervised by the Bank of Russia. Simplified identification does without biometrics and is allowed only for the operations in cl. 1.11, art. 7, 115‑FZ. A comparison of all routes — on the page about remote customer identification.
For identification under art. 9 of 572‑FZ the law requires documents for the UBS operator, not accreditation. Accreditation under art. 17 is needed by organisations that authenticate people by UBS vectors in their own systems: own funds of at least 500 million ₽, liability security of at least 100 million ₽ and other requirements.
No. Microfinance companies may issue online loans only after identification through ESIA and the UBS from 1 March 2026, microcredit companies — from 1 March 2027 (cl. 5.8‑2, art. 7, 115‑FZ). More — on the page for microfinance organisations.
Offer another route: an office, simplified identification if the operation allows it, or delegation. Refusing biometrics cannot be a reason for refusing service (part 13, art. 3, 572‑FZ).
Yes, this is authentication under art. 10 of 572‑FZ: the organisation uses the UBS so that the customer confirms an action or expression of intent. Your own authentication system based on UBS vectors requires accreditation. More — on the page about biometric authentication.
No. The sample for the UBS is collected and transmitted by your organisation’s channel to the operator; NeuroVision does not transmit it and does not receive the UBS response: organisations are prohibited from collecting and storing biometrics for identification outside the UBS (cl. 1, part 1, art. 15, 572‑FZ). NeuroVision Liveness is processing of a face image: how to classify it alongside the UBS step, agree with your lawyer. The retention period for session data is set in the scenario, personal data is deleted by an API request.
The fee for using the UBS is set by the contract with the operator under a methodology agreed with the Bank of Russia (art. 12, 572‑FZ). A NeuroVision KYC session — from 16 ₽, with liveness — from 29 ₽, database checks — 5 ₽ each.
The platform produces the session result automatically, and your system makes the decision under your internal control rules. Where the law requires human involvement — on the page about automated verification.
NeuroVision KYC session data is stored for the period set in the scenario or by the contract; personal data is deleted by an API request. Where the servers are located — clarify when concluding the contract. Cross-border transfer of biometrics during identification is prohibited (part 21, art. 3, 572‑FZ). More — KYC service in Russia.
We will assemble the checks alongside the UBS step in your onboarding
Tell us what stage of UBS connection you are at and where the customer goes through the process — in an app, on a website or in a branch. We will show a scenario with a passport, liveness and database checks and give you test access.
Can't put your request into words? Book a call and our team will contact you at a convenient time
Book a call
The NeuroVision platform is listed in the Russian software registry, entry no. 19972. Rospatent certificate no. 2023661508.
Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.
