Portugal

Identity Verification & KYC For Portugal

Q: What is KYC verification and why is it required in Portugal?

Know Your Customer (KYC) verifies customer identity, financial profile and source of funds. Lei 83/2017 mandates KYC for all financial institutions and VASPs. KYC prevents money laundering and terrorist financing by creating audit trails of identity and beneficial ownership.

Q: What documents are accepted for identity verification in Portugal?

Shufti accepts Cartão de Cidadão, passports, driving licences and residence permits. Business entities submit Certidão Permanente, NIPC registration and beneficial owner documents. Secondary documents include utility bills and banking statements for address verification.

Q: What is eKYC and how does it differ from manual verification?

eKYC automates verification using selfie, document scanning and biometric matching in under 5 seconds. Manual verification requires in-person inspection. eKYC reduces friction and cost whilst maintaining audit-ready decision logs required by Lei 83/2017.

Q: How do I ensure my organisation complies with Lei 83/2017 AML requirements?

Lei 83/2017 requires Know Your Customer, beneficial owner capture, sanctions screening and suspicious activity reporting. Shufti automates customer due diligence, extracts beneficial owner data, screens against PEP lists and maintains audit logs for compliance examinations.

Q: What is beneficial ownership verification and when is it required?

Beneficial ownership verification confirms the natural persons who ultimately own, control or benefit from a business. Required for all companies under Lei 89/2017 RCBE registration. Shufti extracts RCBE data and screens beneficial owners against PEP databases.

Q: Are non-face-to-face identity verification methods permitted in Portugal?

Yes. Lei 83/2017 permits non-face-to-face KYC using document verification, eIDV from Cartão de Cidadão chips and liveness detection. Residence verification via utility bills supports remote onboarding. Enhanced due diligence required for Politically Exposed Persons.

Q: What are politically exposed persons (PEPs) and what extra verification is required?

Politically Exposed Persons hold significant public office or are close family members. Lei 83/2017 requires enhanced due diligence for PEPs, including source of wealth questioning, additional sanctions screening and ongoing transaction monitoring.

Q: How long must Portuguese financial institutions retain customer verification records?

Lei 83/2017 Article 51 mandates minimum 5-year retention post-relationship termination. Shufti's configurable retention settings enforce 5-year holds, automate scheduling and maintain audit logs certifying compliance for regulatory inspection.

Shufti delivers compliant identity verification and KYC, KYB and AML screening supporting Lei 83/2017. Verify Portuguese nationals and beneficial owners in seconds with audit logs.

Operational performance for Portugal KYC

Our Numbers Speak Volumes

97.85%

Pass rates

< 5 sec

Verification
Time

60%

EIDV
Coverage

Evidence-Ready Checks Across People & Businesses

Individual Documents We Verify

Shufti supports 17 Portuguese document types used in KYC, including Portuguese citizen IDs, passports, and Portuguese residence documents and EU residence evidence used in onboarding flows.

View All Supported Documents

Cartão de Cidadão

Primary ID for Portuguese citizens. Supports chip-based document security, with a new design introduced on 11 June 2024 and older cards remaining valid until expiry or renewal.

Passaporte Eletrónico Português

Used mainly as travel and cross-border identity evidence rather than a primary domestic ID. Strong fallback photo ID for non-resident journeys and cross-border onboarding policies.

Título de Residência

Core ID document for non-EU residents. Include controlled exception handling for legacy renewal backlogs and time-bound validity rules, rather than treating expired-looking cards as a standing norm.

Cartão de Residência Para Familiares De Nacionais Da União Europeia

Residence document for non-EU family members of EU nationals living in Portugal. Relevant for foreign-national onboarding where residency rights must be evidenced through an official card.

Certificado de Registo de Cidadão da União Europeia

Common residency evidence for EU nationals. It is not a primary photo ID and usually appears alongside a passport or national ID in account updates and ongoing due diligence.

Carta de Condução

Supplementary identity and age evidence for residents, including replacement flows and data updates. Digital versions can exist in gov.pt wallet contexts with legal value in local use cases.

Business Entity Identity

Certidão Permanente do Registo Comercial

Registry extract for legal existence, representation powers, and registered facts, accessed via a certidão access code.

Cartão da Empresa Or Cartão de Pessoa Coletiva

Fast evidence of core identifiers and registered seats, including NIPC and classification codes.

Articles Of Association And Management Body Evidence

Supports KYB reviews where you need current constitutional terms, director or signatory authority visibility, and sector-authorisation context such as a Banco de Portugal operating licence where relevant.

Business Tax Identity

NIPC

Core entity identifier used to connect registry facts, screening, and KYB workflows, with related tax-linked records captured where applicable.

VAT Number

Presented as PT plus nine digits in cross-border VAT contexts. Validate as part of KYB data hygiene.

Certidão De Não Dívida Tributária Or Declaração De Situação Contributiva

Supporting evidence of tax regularity or social-security contribution status used in higher-risk counterparty reviews and payout-related onboarding checks.

Ownership & Control (UBO)

Registo Central do Beneficiário Efetivo

Beneficial ownership declaration source designed to identify the individuals who control the entity, including cases where direct or indirect ownership or voting rights reach the 25% threshold.

UBO Declaration And Supporting Corporate Evidence

Use a structured UBO capture pack to reconcile ownership with registry facts and screening outputs, and keep it audit-retrievable for seven-year retention.

Languages We Cover

Document Text Handling

Portuguese-language artefacts and registry evidence are handled as standard. Shufti keeps extracted fields consistent across KYC and KYB evidence packs.

Name Matching Controls

Controls tolerate diacritics and compound surname structures and connectors, reducing false mismatches across IDs, UBO declarations and screening datasets.

Evidence Consistency

Identity is joined across steps so the same person or controller remains consistent from document checks through screening and escalation workflows.

GOVERNANCE & CONTROLS

Audit-Ready Decisions, Lower Operational Drag

Compliant KYC Automation

Auto-populate customer data from documents. Trigger UBO capture. Reduce manual review 65% with Lei 83/2017 audit logs.

Rapid Sanctions Screening

Real-time EU sanctions and Lei n.º 97/2017 screening in 5 seconds. Flags high-risk individuals automatically.

Evidenced Beneficial Ownership

Capture UBO identity, controlling interest and acquisition date per RCBE standards. Supports supervisory inspections.

eIDV Document Extraction

Extract civil, tax, health and social security identifiers from Cartão de Cidadão chips. Reduce errors and forgery risk.

Cross-Border Residency Confirmation

Verify Portuguese residence via EDP, Galp, Vodafone, NOS and MEO utility bills. Enable non-face-to-face onboarding.

Enterprise-grade compliance infrastructure

Portugal IDV/KYC Challenges

Cartão Complexity

Dual-interface chip (June 2024) increases fraud surface. Systems need continuous updates to detect evolving security features and spoofed presentations.

Diaspora Verification

Dual-nationality and multiple valid IDs complicate confirmation. Shufti resolves ties via EU database cross-reference and heritage-language support.

Fintech Regulatory Flux

VASPs must register with Banco de Portugal under Lei 83/2017; MiCA regime ongoing. Crypto compliance changes monthly. Shufti tracks regulatory evolution.

Lei 83/2017 Complexity

AML obligations span internal controls, customer due diligence, UBO verification and suspicious activity reporting. Shufti automates evidence capture.

Shufti’s IDV/KYC Solutions for Portugal

KYC Solutions

Face Verification

Selfie-based biometric match to document photo. Liveness detection prevents deep fakes, masks and printed-photo fraud. Audit-ready cryptographic proof.

Age Verification

Selfie-based age estimation plus document verification fallback when needed. Machine learning detects forged or altered documents for compliance and audit.

Address Verification

Verify any address-bearing document. Accept real utility providers: EDP, Galp, NOS, MEO. Partner banks include CGD and Millennium BCP for confirmation.

Document Verification

Country-specific document types: Cartão de Cidadão, passports, residence permits. Capture reality and script variants with machine-readable zone validation.

KYB Solutions

Business Verification

Query Portuguese Commercial Registry and RCBE registers in real-time. Extract company name, NIPC, office location, structure and beneficial ownership details.

Enhanced Due Diligence (EDD)

Verify ultimate beneficial owners from RCBE with controlling interest and acquisition dates. Cross-reference against PEP databases and sanctions lists.

AML Screening

Business AML Screening

Real-time verification against Portuguese PEP databases, Banco de Portugal executives and international registers. Flags high-risk individuals pre-activation.

Transaction Screening

Ongoing monitoring patterns relevant to Portugal. Screen controllers and beneficial owners against evolving sanctions and PEP lists. Maintains audit logs.

REGULATORY ALIGNMENT

Built to Fit Portugal's Compliance Landscape

Banco de Portugal (BdP)

Central bank overseeing credit institutions and payment systems in Portugal. Shufti aligns to BdP customer due diligence standards with audit-ready verification logs.

Comissão do Mercado de Valores Mobiliários (CMVM)

Securities Market Commission supervising securities and investment firms in Portugal. Shufti delivers KYC audit trails and sanctions screening for CMVM-regulated entities.

Autoridade de Supervisão de Seguros e Fundos de Pensões (ASF)

Supervises insurance, reinsurance, pension funds and insurance mediation in Portugal. Shufti automates KYC for insurance intermediaries to meet ASF due diligence requirements.

Comissão Nacional de Proteção de Dados (CNPD)

National Data Protection Authority enforcing GDPR and Lei 58/2019 across all sectors. Shufti implements data minimisation, encryption and retention controls per CNPD guidance.

Unidade de Informação Financeira (UIF)

Financial Intelligence Unit handling suspicious activity reports under Lei 83/2017. Shufti helps institutions identify reportable transactions and supports MLRO filing workflows.

Inspeção-Geral de Finanças (IGF)

General Inspectorate of Finance auditing AML controls across public and private sectors. Shufti maintains decision records and audit logs supporting IGF compliance examinations.

Conselho Nacional de Supervisores Financeiros (CNSF)

Coordination body of BdP, CMVM and ASF setting macroprudential policy across Portugal. Shufti aligns verification parameters to CNSF guidance across banking and securities sectors.

Deployment Choice

Shufti serves Portuguese clients via EU infrastructure. AWS Direct Connect at Lisbon (March 2025) and Irish region. On-premise deployment for entities.

Regulatory Alignment

Aligned to GDPR and Lei n.º 58/2019. CNPD enforces standards. Shufti delivers Data Processing Agreements certifying lawful entity processing compliance.

Retention controls

Configurable retention aligned to Lei n.º 83/2017 five-year minimum post-transaction. Automates archival and purge scheduling. Confirms regulatory compliance.

Encryption posture

Strong encryption for personal and financial data in transit and at rest per GDPR Article 32. AES-256 for records, TLS 1.2+ for transit, tokenisation.

Data Controls & Privacy for Portugal

BUILT FOR COMPLIANCE TEAMS

Portugal AML Sources That Strengthen Decision

National Assembly of Portugal

Caixa Geral de Depósitos

Portugal OSAE

Banco Português de Gestão (BPG)

TSF Rádio Notícias

Público

Jornal de Notícias

Expresso

National Assembly of Portugal

Caixa Geral de Depósitos

Portugal OSAE

Banco Português de Gestão (BPG)

TSF Rádio Notícias

Público

Jornal de Notícias

Expresso

National Assembly of Portugal

Caixa Geral de Depósitos

Portugal OSAE

Banco Português de Gestão (BPG)

TSF Rádio Notícias

Público

Jornal de Notícias

Expresso

Frequently Asked Questions

What is KYC verification and why is it required in Portugal?

Know Your Customer (KYC) verifies customer identity, financial profile and source of funds. Lei 83/2017 mandates KYC for all financial institutions and VASPs. KYC prevents money laundering and terrorist financing by creating audit trails of identity and beneficial ownership.

What documents are accepted for identity verification in Portugal?

Shufti accepts Cartão de Cidadão, passports, driving licences and residence permits. Business entities submit Certidão Permanente, NIPC registration and beneficial owner documents. Secondary documents include utility bills and banking statements for address verification.

What is eKYC and how does it differ from manual verification?

eKYC automates verification using selfie, document scanning and biometric matching in under 5 seconds. Manual verification requires in-person inspection. eKYC reduces friction and cost whilst maintaining audit-ready decision logs required by Lei 83/2017.

How do I ensure my organisation complies with Lei 83/2017 AML requirements?

Lei 83/2017 requires Know Your Customer, beneficial owner capture, sanctions screening and suspicious activity reporting. Shufti automates customer due diligence, extracts beneficial owner data, screens against PEP lists and maintains audit logs for compliance examinations.

What is beneficial ownership verification and when is it required?

Beneficial ownership verification confirms the natural persons who ultimately own, control or benefit from a business. Required for all companies under Lei 89/2017 RCBE registration. Shufti extracts RCBE data and screens beneficial owners against PEP databases.

Are non-face-to-face identity verification methods permitted in Portugal?

Yes. Lei 83/2017 permits non-face-to-face KYC using document verification, eIDV from Cartão de Cidadão chips and liveness detection. Residence verification via utility bills supports remote onboarding. Enhanced due diligence required for Politically Exposed Persons.

What are politically exposed persons (PEPs) and what extra verification is required?

Politically Exposed Persons hold significant public office or are close family members. Lei 83/2017 requires enhanced due diligence for PEPs, including source of wealth questioning, additional sanctions screening and ongoing transaction monitoring.

How long must Portuguese financial institutions retain customer verification records?

Lei 83/2017 Article 51 mandates minimum 5-year retention post-relationship termination. Shufti's configurable retention settings enforce 5-year holds, automate scheduling and maintain audit logs certifying compliance for regulatory inspection.

Build a Portugal-ready KYC, KYB & AML programme with Shufti

Check Pricing Request Demo

INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.

Certified to Global Standards

PROVEN WORKFLOWS

Use Cases for Regulated Growth in Portugal

Fintech

Forex

Banking

Gaming

Gig Economy

Crypto

Marketplace

Fintech

Forex

Banking

Gaming

Gig Economy

Crypto

Marketplace

Fintech

Forex

Banking

Gaming

Gig Economy

Crypto

Marketplace

Accelerate Growth, Eliminate Friction

Onboard users in seconds, not days. Deploy tiered address verification flows that maximise completion rates for genuine users while filtering out synthetic fraud.

Learn More Try Now

Onboard Global Traders in Real-Time

Verify investors across 250+ countries & territories. Ensure compliance with international financial regulations while preventing identity theft and high-risk chargebacks.

Learn More Try Now

Secure Trust at Every Transaction

Automate KYC and AML workflows to reduce manual onboarding costs. Strengthen residency checks while delivering the frictionless digital experience modern customers expect.

Learn More Try Now

Power a Fair & Secure Player Experience

Reduce bonus abuse and multi-accounting rings at the door. Enforce location rules and trigger step-up checks without disrupting the player journey.

Learn More Try Now

Build a Trusted, Verified Workforce

Screen freelancers and drivers at scale. Verify residency and reduce onboarding friction while maintaining trust between users.

Learn More Try Now

Scale Your Exchange with Confidence

Balance anonymity with compliance. Instantly verify user jurisdiction to meet Travel Rule obligations and help stop abuse without slowing down legitimate trading volume.

Learn More Try Now

Reduce fraud without blocking growth

Shufti supports marketplace integrity by verifying seller and buyer identities, enabling age-gated journeys where needed, and preserving evidence to support investigations, disputes and risk-led enforcement actions.

Learn More Try Now