Remote identity verification glossary: 32 terms

Remote identity verification borrows vocabulary from three separate fields at once: regulation, biometrics and software. Vendor decks, regulatory texts and product documentation routinely use different words for the same thing.

This glossary gives the plain meaning of each. Where a term comes from Turkish regulation, the official wording is noted.

Process and roles

Identity verification (kimlik tespiti) Collecting information about a person’s identity and confirming it is accurate. In regulation this is distinct from authentication: verification establishes who someone is.

Remote identity verification (uzaktan kimlik tespiti) Carrying out that verification online, without the person and an institution’s representative being physically in the same place. This is the formal term in Turkish regulation; “remote onboarding” is the commercial equivalent.

KYC (Know Your Customer) The wider compliance obligation that contains identity verification but also covers understanding the customer’s business and risk profile.

Continuous business relationship (sürekli iş ilişkisi) A relationship between institution and customer that goes beyond a single transaction. Opening an account is the classic case, and remote verification obligations usually attach to establishing it.

Customer representative (müşteri temsilcisi) The specifically trained member of staff who conducts remote identity verification. A defined role in the Turkish banking and AML rules.

Video call (görüntülü görüşme) Online, real-time, uninterrupted video contact between the applicant and the customer representative. For a long time this was the only accepted method in Türkiye.

Onboarding flow Every step a new customer passes through, from application to a usable account. Identity verification is one part of that flow, not the whole of it.

Step-up verification Adding a verification step when a risk signal fires — a check you would not apply to a small transaction but would apply at a limit upgrade.

Documents and reading

Identity document In Turkish regulation this means specifically the national ID card as defined in its own regulation. Not every official document qualifies.

MRZ (Machine Readable Zone) The fixed-format, machine-readable block padded with < characters along the bottom of ID cards and passports, formatted to ICAO 9303.

Check digit A digit computed by a fixed algorithm that tests whether an MRZ field was read correctly. A mismatch means either a bad read or altered data.

OCR (optical character recognition) Turning the text in a photo of a document into strings. It speeds up data entry; on its own it proves nothing about whether the document is genuine.

Near-field communication (NFC) The short-range wireless technology that lets devices communicate without contact. Turkish regulation calls it yakın alan iletişimi.

Contactless chip The chip inside an identity document, read over NFC. It carries a digital, signed copy of the details printed on the document.

ICAO 9303 The International Civil Aviation Organization standard for machine-readable travel documents. Turkish ID cards and biometric passports are built to it.

TEKB / YAKB Abbreviations from the Turkish electronic communications rules: an electronic identity document with contact-based communication (TEKB) and one with near-field communication (YAKB).

Visual security features The physical features on a document that are hard to reproduce: guilloche patterns, rainbow printing, optically variable ink, hidden images, holograms, microtext. Turkish regulation groups these as güvenlik ögeleri.

Identity Sharing System (KPS) The Turkish civil registry database against which identity and address details can be checked.

Biometrics and liveness

Biometric data Data that uniquely identifies a person by a physical or behavioural characteristic. A facial image is the common example. Under Turkish law it is a special category of personal data.

Face matching Comparing the applicant’s face against the photo held in the document to decide whether they are the same person.

Liveness detection Establishing that the person in front of the camera is live and present. A separate step from face matching, and neither substitutes for the other.

Passive liveness Liveness detection that asks nothing of the user, analysing texture, depth and lighting consistency instead.

Active liveness Liveness detection that asks the user to act: turn their head, smile, follow a dot on screen.

Presentation attack Showing the camera something fake: a printed photo, a video on a screen, a mask.

Injection attack Bypassing the camera feed entirely — a virtual camera driver, an emulator, or a tampered device feeding fake frames straight into the app. Texture analysis cannot stop this.

PAD (Presentation Attack Detection) The detection of presentation attacks. The standards term for what products market as liveness.

APCER / BPCER The two error rates of liveness detection: APCER is the share of fake presentations accepted as live, BPCER the share of genuine users rejected. They pull against each other, so a single figure never tells the whole story.

False acceptance rate (FAR / FMR) The probability that a system treats two different people as the same person. Turkish regulation places a numerical ceiling on this rate for the AI algorithms used in remote identity verification.

ISO/IEC 30107 The standard defining how presentation attack detection is tested. Part 3 sets out the testing and reporting method.

Regulation and compliance

BDDK The Banking Regulation and Supervision Agency. Regulates remote identity verification by banks.

MASAK The Financial Crimes Investigation Board. Sets anti-money-laundering obligations and the remote identity verification procedures that apply across obliged entities.

SPK The Capital Markets Board. Regulates remote identity verification for brokerages, portfolio management companies and crypto asset service providers.

BTK The Information and Communication Technologies Authority. Regulates identity verification for subscription applications in electronic communications.

KVKK Used for both Turkish data protection law no. 6698 and the authority that enforces it. Biometric data is a special category under that law.

Transparency obligation (aydınlatma yükümlülüğü) The controller’s duty to tell the individual what data is processed, for what purpose, for how long, and who it is shared with. It has to appear before verification starts.

Explicit consent (açık rıza) Informed, freely given consent to a specific matter. Since the 2024 amendment it is no longer the only lawful basis for processing special category data in Türkiye.

---

For how these fit together in practice, see how remote identity verification works, what liveness detection does and does not do, and the difference between MRZ, OCR and NFC.