This document specifies the security framework for using biometrics for authentication of customers in financial services, focusing exclusively on retail payments. It introduces the most common types of biometric technologies and addresses issues concerning their application. This document also describes representative architectures for the implementation of biometric authentication and associated minimum control objectives.

The following are within the scope of this document:

—     use of biometrics for the purpose of:

—     verification of a claimed identity;

—     identification of an individual;

—     biometric authentication threats, vulnerabilities and controls;

—     validation of credentials presented at enrolment to support authentication;

—     management of biometric information across its life cycle, comprising enrolment, transmission and storage, verification, identification and termination processes;

—     security requirements for hardware used in conjunction with biometric capture and biometric data processing;

—     biometric authentication architectures and associated security requirements.

The following are not within the scope of this document:

—     detailed specifications for data collection, feature extraction and comparison of biometric data and the biometric decision-making process;

—     use of biometric technology for non-financial transaction applications, such as physical or logical system access control.