- Afghanistan
- Albania
- Algeria
- Andorra
- Angola
- Argentina
- Armenia
- Australia
- Austria
- Azerbaijan
- Bahamas
- Bahrain
- Bangladesh
- Belarus
- Belgium
- Belize
- Bolivia
- Bosnia and Herzegovina
- Brazil
- British Virgin Islands
- Brunei
- Bulgaria
- Cambodia
- Cameroon
- Canada
- Chile
- China
- Colombia
- Costa Rica
- Croatia
- Curaçao
- Cyprus
- Czech Republic
- Denmark
- Dominican Republic
- Ecuador
- Egypt
- El Salvador
- Estonia
- Eswatini
- Ethiopia
- Finland
- France
- Georgia
- Germany
- Ghana
- Greece
- Guatemala
- Guyana
- Haiti
- Honduras
- Hong Kong
- Hungary
- Iceland
- India
- Iraq
- Ireland
- Indonesia
- Isle of Man
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Lithuania
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Monaco
- Mongolia
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Poland
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Saudi Arabia
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Suriname
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- UAE
- Uganda
- Ukraine
- UK
- Uruguay
- USA
- Uzbekistan
- Vanuatu
- Venezuela
- Vietnam
- Zambia
- Zimbabwe
Scale Identity Verification and KYC Operations in Iceland
Verify customers through Icelandic electronic ID, chip-enabled national ID cards and 10,000+ foreign ID document types, run KYB on registered companies and their real owners, and monitor transactions and sanctions lists. One platform runs compliance and fraud prevention across the full customer lifecycle for Central Bank- and Skatturinn-supervised firms.
Operational Performance for Iceland KYC
Our Numbers Speak Volumes
90.91%
Pass
Rates
Under 5 secs
IDV
Verification
99.67%
eIDV
Coverage
Iceland IDV/KYC Challenges
Foreign Residents Often Onboard Without Icelandic Electronic ID
KYC services in Iceland lean heavily on electronic ID, yet foreign citizens made up 17.9% of the population in mid-2026, and self-activating the Auðkenni app requires an Icelandic passport. Shufti routes these customers to document, chip and liveness checks in the same flow.
National ID Cards Issued Before March 2024 Are No Longer Valid
Every national ID card issued before 1 March 2024 had expired by 31 December 2025, yet older cards still turn up at onboarding. Shufti checks the card generation and expiry date, reads the new card's chip and matches the holder through biometric liveness.
Scam Calls Target Electronic ID Approvals
Capital Region police reported that fraudsters took around ISK 100 million in two and a half months of 2025, and they warn customers never to approve an electronic ID request they did not start. Shufti's behavioral biometrics flag active calls and coached sessions.
Ownership Discrepancies Must Reach the Register Within Two Weeks
Act 82/2019 requires companies to report ownership changes within two weeks, and obliged entities must report any discrepancy they find against the register in the same window. Shufti's perpetual KYB flags registry, director and ownership changes as they happen.
Documents and Languages
Individual Documents Shufti Verifies in Iceland
Shufti verifies Icelandic identification documents across 4 core document types, plus passports and ID cards from other countries. The cards below cover the core documents Iceland onboarding relies on, with the full list on the supported documents page.
View All Supported DocumentsIcelandic Electronic ID (Rafræn Skilríki)
Issued by state-owned Auðkenni through its app, SIM cards and cards, and used to log in to Ísland.is, banks and public services. Shufti runs the login through your firm's Auðkenni service agreement, records the verified name and kennitala, and stores the result in the case file.
Icelandic National ID Card (Nafnskírteini)
Issued by Registers Iceland under Act No. 55/2023 since 1 March 2024, with a microchip holding the facial image and fingerprints. Shufti reads the chip, runs forensic tamper checks and matches the holder through biometric liveness, with population register checks available through your firm's authorised access.
Residence Permit Cards
Issued by the Directorate of Immigration to non-EEA nationals staying more than three months, while EEA citizens register their domicile with Registers Iceland. Shufti verifies the card's authenticity and expiry, then links it to the holder's passport and selfie in one session.
Icelandic Passport (Vegabréf)
Issued by Registers Iceland under Act No. 136/1998 and valid for ten years for adults. Shufti reads the chip and runs nine forensic detection layers, from MRZ checksum validation to hologram analysis, so a cloned or altered passport fails before onboarding.
Foreign Passports and National ID Cards
Shufti actively processes 10,000+ ID document types from 240+ countries and territories, and its zero-shot AI learns new document formats in minutes. Foreign workers, students and non-resident investors onboard with these documents in the same flow as Icelandic citizens.
Iceland Driving Licence (Ökuskírteini)
Issued by District Commissioners on behalf of the National Commissioner of Police, with a digital version in the Ísland.is app valid in Iceland alongside the plastic card. Shufti checks the card's authenticity, expiry and photo match for car rental, insurance and delivery onboarding.
Proof of Address
The residence certificate (búsetuvottorð) from Registers Iceland confirms a customer's registered legal domicile, alongside utility bills and bank statements. Shufti extracts the address and matches it against the ID in one step, with docless address checks for customers without paperwork.
Entity Identity
Register of Enterprises Certificate (Fyrirtækjaskrá)
Skatturinn runs the Register of Enterprises under Act No. 17/2003 and issues certified registration certificates for ehf., hf., sf. and slf. entities. Shufti's live registry call confirms the company's kennitala, status and registered details at every check.
Articles of Association (Samþykktir)
Filed with the Register of Enterprises at formation, they set out share capital, ownership and signing authority. Shufti's AI-OCR reads these terms and flags GAN-generated or edited pages before they shape a KYB decision.
Business Address Proof
The registered address filed with the Register of Enterprises. Shufti cross-checks it against lease agreements and utility bills for the trading address, so the place the business operates matches its filings.
Tax Identity
Legal Entity Kennitala
Skatturinn assigns every company and other legal entity a ten-digit kennitala under Act No. 17/2003, used across tax, banking and registry records. Shufti extracts it, validates its format and cross-checks the entity name against the Register of Enterprises.
VAT Registration (VSK-númer)
Businesses with taxable sales above ISK 2,000,000 in 12 months must register for VAT under Art. 4 of Act No. 50/1988. Shufti reads the VAT number and matches it to the kennitala, and also handles foreign tax registrations and FATCA/CRS self-certification.
Ownership and Control
Register of Beneficial Owners
Kept by Skatturinn under Act No. 82/2019 and open to the public for each owner's name, nationality and the nature of their interest. Shufti extracts everyone who owns or controls more than 25%, screens them and flags any mismatch with the register.
Shareholder Register and Ownership Chart
Shufti maps ownership through intermediate companies to the natural person in control and screens every owner against sanctions, PEP and adverse media lists, so layered holding structures do not hide who benefits from the account.
Directors and Authorised Signatories
Board members and managers recorded in the Register of Enterprises sign for the company. Shufti verifies each one's identity document, screens them for sanctions and PEP exposure, and raises an alert when the board changes.
Languages We Cover
Icelandic and Expat Document Parsing
Icelandic documents use Latin script with þ, ð, æ and accented vowels, while foreign residents bring many other scripts. Shufti's OCR reads 150+ languages and scripts at 99.7% accuracy and averages 93% against Google Vision's 78.4% across its published benchmark. Zero-shot document intelligence reads layouts it has never seen on first sight, so a foreign resident's document needs no template.
Icelandic Patronymic Name Matching
Most Icelanders carry a name ending in -son or -dóttir taken from a parent instead of a family surname, and þ and ð often become th and d abroad. Shufti's phonetic matching handles both in sanctions and PEP screening.
Cross-Document Consistency Checks
Names, dates of birth and kennitala are reconciled across the national ID, passport, driving licence, electronic ID result and beneficial ownership register, so a mismatch surfaces before an analyst approves the customer.
Independent Validation
Shufti's Recognition Across Independent Evaluations
Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Top Vendor for Product Execution in the Liminal Index for KYC 2026
View Report
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader in G2 Fall 2026 reports
Read More
Regulatory Update
Every Verification Route Iceland Regulators Recognize, in One Platform
Identity verification for Iceland rests on Art. 3 of Act 140/2018, which recognises passports, driving licences, national ID cards and electronic ID carrying a qualified certificate on a qualified signature device. Shufti supports each, plus chip, database, document and video routes for non-residents and customers without Icelandic electronic ID.
Icelandic Electronic ID Authentication
LiveThe customer approves a login in the Auðkenni app or on their SIM, and Shufti receives the verified identity and kennitala through approved routes and stores the result in the case file. It is the fastest route for residents who already use electronic ID every day.
Docless Database (eIDV)
LiveThe customer enters a kennitala and personal details, and Shufti matches them against permitted Icelandic data sources, including population register records, through your firm's authorised access, with a decision in seconds. It suits returning customers and step-up checks.
NFC Chip Verification
LiveShufti reads the chip in the new national ID card, the Icelandic passport and most foreign biometric passports, checking the signed data against the printed page. It is the high-assurance route for residents without electronic ID.
Document and Face Biometric
LiveThe customer photographs an ID and takes a selfie, and Shufti matches the two with iBeta Level 3 certified liveness. It is the route most non-residents take, with on-screen guidance that cuts failed captures.
Fraud Prevention Across the Iceland Customer Journey
Reduce fraud losses and protect customer trust across onboarding, account access, and payments. Shufti connects identity, behavioral, device, network, and transaction intelligence to help Iceland businesses act on risk while keeping legitimate customers moving.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer Avoidable Re-submissions
Capture guidance for the chip ID card, passports and documents carrying þ, ð and accented characters cuts glare, crop and blur rejections at the first attempt.
Cleaner Audit Trails
Shufti's case management records sources, results, timestamps, evidence, analyst notes and decision history, packaged as report-ready bundles for STR filing through goAML.
One Workflow, One Back Office
Unify KYC, KYB, AML screening and transaction monitoring in one case file, with perpetual KYC/KYB tracking ownership, director and transaction behavior changes across the lifecycle.
Electronic ID and National ID-First Flow Design
Residents authenticate through Icelandic electronic ID or the chip ID card first, while non-residents move to passport verification in the same flow.
Shufti's IDV/KYC Solutions for Iceland
KYC Solutions
Iceland's customers range from residents who log in with electronic ID every day to foreign workers, students and visiting investors. One Shufti flow routes each by risk, so nobody faces checks they don't need.
Explore More
Face Verification
Remote onboarding without a branch visit needs proof that the person matches the ID. Shufti matches the selfie to the document photo at a false match rate below 0.001, so impostors fail while genuine customers pass first time.
.
Age Verification
Art. 18 of the Alcohol Act No. 75/1998 bars selling or handing alcohol to anyone under 20. Shufti estimates age from a selfie in under 5 seconds and falls back to the document's date of birth, blocking 99.8% of underage attempts.
.
Bank Account Verification
Payouts and direct debits go wrong when the account belongs to someone else. Shufti validates Icelandic IBANs, including the check digits, and matches the account-holder name in real time, so funds reach the verified customer.
.
Address Verification
Customers move often, and the domicile on file can lag behind. Shufti's layout-aware extraction and fuzzy matching read residence certificates, bills and statements at a 99.3% pass rate, with docless checks in under 3 seconds.
.
Document Verification
Forged and altered IDs remain a common route into accounts. Shufti checks Icelandic ID cards, passports and licences within seconds, flagging GenAI edits, screenshots, replays and print-and-scan copies before the customer is approved.
.
Identity Verification
Some customers need more than one check. Shufti combines document, biometric, NFC, address and eIDV checks in one API session, so a firm can step a customer up from electronic ID to a full check without restarting onboarding.
.KYB Solutions
Icelandic companies register with the Register of Enterprises at Skatturinn, and many sit inside holding structures. Shufti pulls registry data at every check, maps ownership to the beneficial owner test in Act 140/2018 and ties each owner to a verified identity.
Explore More
Business Verification
Onboarding an Icelandic company means confirming its registration, kennitala, board and everyone who owns or controls more than 25%. Shufti's live registry call pulls that picture together in one check, putting corporate onboarding under two minutes.
.
Enhanced Due Diligence
PEPs and customers linked to high-risk countries need enhanced checks under Arts. 13 and 17 of Act 140/2018, including source of wealth and funds. Shufti's branching due diligence questionnaires collect those answers, score them and send UBO verification links.
.AML Screening
A customer who is clean at onboarding can land on a list next week. AML screening for Iceland's financial services firms runs on Shufti's perpetual KYC, which rescreens customers against 4,000+ watchlists, including sanctions applied under Act 68/2023 and UN Security Council lists, refreshed every 15 minutes.
Explore More
Business AML Screening
Sanctions exposure often sits with an owner or director rather than the company itself. Shufti screens every entity, owner and director against sanctions applied in Iceland, UN lists, PEP data and 50,000+ adverse media sources, and perpetual KYB rescreens the whole portfolio.
.
Transaction Monitoring
Payments move instantly between Icelandic banks, apps and cards. Shufti's library of 500+ pre-built rules covering structuring, smurfing, and mule activity flags unusual transactions with 60% fewer false positives, and builds report-ready case bundles for goAML.
.
Travel Rule
Crypto-asset service providers in Iceland must send originator and beneficiary data with every crypto-asset transfer they handle. Shufti's single integration connects to major Travel Rule networks, exchanges IVMS101 data and supports four wallet ownership methods for unhosted wallets.
.
AI Compliance Co-Pilot
One common name can return 140+ screening hits. Shufti's AI Compliance Co-Pilot reviews every hit, assigns a 0 to 100 confidence score with a written reason and logs each override, while the MLRO keeps the final call on every match.
.Built To Fit Iceland's Compliance Landscape
KYC and AML requirements in Iceland start with Act 140/2018 and the FIU, while the Central Bank and Skatturinn each supervise their own group of obliged entities. Shufti maps its KYC, KYB, AML screening and transaction monitoring controls to every regime below, so one platform covers each licence your group holds.
Act No. 140/2018 on Measures against Money Laundering and Terrorist Financing
Iceland's primary AML law requires customer due diligence with recognised identification (Art. 10), identification of anyone owning or controlling more than 25% (Art. 3), regular monitoring of business relationships (Art. 10), enhanced checks for PEPs (Art. 17) and records kept for at least five years after the relationship ends (Art. 28).
Central Bank of Iceland (Financial Supervisory Authority)
The Financial Supervisory Authority within the Central Bank supervises AML compliance of banks, insurers, pension funds, payment and e-money institutions, currency exchanges and crypto-asset service providers under Art. 38 of Act 140/2018. Art. 46 allows fines of up to ISK 800 million or 10% of turnover.
Financial Intelligence Unit (Skrifstofa fjármálagreininga lögreglu)
Operating under the District Prosecutor, the FIU receives suspicious transaction reports through goAML. Art. 21 of Act 140/2018 requires obliged entities to report every suspicious or unusual transaction, and Art. 22 requires them to hold back from a suspect transaction until the FIU has the report.
Skatturinn (Iceland Revenue and Customs)
Supervises the AML compliance of accountants, lawyers, real estate agents, car dealers, art and jewellery dealers, trust and company service providers, cash businesses and lottery licence holders under Art. 38 of Act 140/2018, and registers several of these sectors under Art. 36. It also runs the Register of Enterprises.
Act No. 82/2019 on Registration of Beneficial Owners
Requires legal entities to register their beneficial owners with Skatturinn and keep each entry current (Art. 6). Art. 15 allows administrative fines of up to ISK 80 million or 10% of turnover, and an entity that stays non-compliant for three months can be removed from the Register of Enterprises (Art. 17).
Act No. 101/2025 on Markets in Crypto-Assets
In force since 1 January 2026, the Act makes the Central Bank the competent authority for crypto-asset service providers, which need authorisation to operate (Art. 5). These firms remain obliged entities under Act 140/2018, whose Art. 57a gives the Travel Rule force of law.
Act No. 68/2023 on Implementation of International Sanctions and Freezing of Funds
Replaced Act 93/2008 and applies UN Security Council sanctions and other international measures through regulations issued under the Ministry for Foreign Affairs. Art. 10 requires firms to freeze the funds of designated persons and report each freeze, while the Central Bank and Skatturinn supervise compliance (Art. 26).
Registers Iceland (Þjóðskrá)
Issues the kennitala to individuals under Act No. 140/2019, national ID cards under Act No. 55/2023 and passports under Act No. 136/1998, and keeps the population register that records each resident's legal domicile. Its ID cards and passports count as recognised identification under Art. 3 of Act 140/2018.
Lotteries Act No. 38/2005
Lotteries and money games need a District Commissioner licence or a special statute, and licences go only to bodies raising funds for public-benefit causes (Arts. 2 and 3). Licence holders are obliged entities under Act 140/2018, which requires customer due diligence on prize payouts of EUR 2,000 or more (Art. 8).
National Commissioner of the Icelandic Police (Ríkislögreglustjóri)
Prepares Iceland's national money laundering and terrorist financing risk assessment at least every four years (Art. 4 of Act 140/2018) and published an update in December 2025. A ministerial steering group coordinates AML policy (Art. 39), and the FATF ended Iceland's increased monitoring in October 2020.
Iceland Data Residency and Deployment
Shufti offers on-premises deployment inside Icelandic infrastructure, including air-gapped setups, or hosting in EEA cloud regions. The agreement defines hosting locations and transfer arrangements, in line with Central Bank outsourcing guidance that favours keeping supervised firms' data within the EEA.
Iceland Data Protection Act (Act No. 90/2018)
Enforced by Persónuvernd, the Act treats biometric data as sensitive (Art. 3), sets extra conditions for processing it (Art. 11) and requires breach notice within 72 hours (Art. 27). Shufti applies encryption, role-based access and configurable retention to identity and biometric data.
Kennitala Handling
Art. 13 of Act 90/2018 allows use of the kennitala only for an objective purpose where it is necessary for secure identification, and Persónuvernd can prohibit or order its use. Shufti stores the kennitala with the verification record and limits who can view it through role-based access.
Digital Operational Resilience and Outsourcing
Act No. 78/2025 brought digital operational resilience rules into force for Icelandic financial firms on 1 January 2026, under Central Bank supervision. Shufti supplies security documentation, prompt incident notices and contract terms that support each firm's ICT third-party risk reviews.
Retention Controls
Retention is configurable by client and licence. The five-year minimum in Art. 28 of Act 140/2018 is a floor, not an automatic deletion date, and supervisors or the FIU can require up to five more years, with legal holds to match.
Encryption and Security
Data is encrypted in transit and at rest, with role-based access and audit logging throughout. Shufti holds ISO 27001:2022 certification and SOC 2 Type 2 reports and shares them with banks and payment firms during vendor due diligence.
Automated Decisions and Biometric Data
Art. 22 of Act 90/2018 gives customers the right not to face a decision based solely on automated processing with significant effects. Shufti returns verification results and supporting details through the API and back office, so teams can explain outcomes and escalate disputed results.
Scope of Our Role
As a provider of identity verification services in Iceland, Shufti acts as processor on each firm's instructions, while the firm stays the controller responsible for its lawful basis. Shufti's privacy notice identifies any activities where it acts as an independent controller.
Data Residency and Privacy Controls in Iceland
Iceland AML Sources That Strengthen Decisions
Ministry of Justice
Central Bank of Iceland
Financial Intelligence Unit (Skrifstofa fjármálagreininga lögreglu)
Skatturinn (Iceland Revenue and Customs)
Ministry for Foreign Affairs
National Commissioner of the Icelandic Police (Ríkislögreglustjóri)
District Prosecutor (Héraðssaksóknari)
Financial Action Task Force (FATF)
EFTA Surveillance Authority (ESA)
Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA)
European Banking Authority (EBA)
International Monetary Fund (IMF)
Egmont Group of Financial Intelligence Units
United Nations Security Council
Basel Committee on Banking Supervision (BCBS)
Turn Iceland Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.
INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.
Certified to Global Standards
PROVEN WORKFLOWS
Identity Verification Built Around Your Industry in Iceland
Faster Account Opening On Electronic ID
KYC verification for Iceland's banks combines electronic ID logins with Central Bank supervision under Act 140/2018 and strong customer authentication under the Payment Services Act No. 114/2021. Shufti runs electronic ID, chip ID and passport checks, liveness, corporate KYB, sanctions screening and transaction monitoring in one case file per customer.
Frequently Asked Questions
Does Shufti support Icelandic electronic ID (rafræn skilríki), and what happens when customers cannot use it?
Yes. Customers approve a login through the Auðkenni app or SIM, and Shufti receives their verified name and kennitala through your firm's Auðkenni service agreement. Customers without Icelandic electronic ID, often foreign residents, move to chip, document and selfie or video checks within the same onboarding flow.
Is scanning an Icelandic national ID card enough, or should verification include its chip?
Reading the chip is stronger. The card issued since March 2024 stores the holder's facial image and fingerprints on a microchip, and Shufti checks the signed chip data against the printed card and a liveness-backed selfie, so cloned or edited cards fail.
Can Shufti verify foreign documents or identity formats it has not encountered before?
Yes. Shufti's zero-shot document intelligence reads unfamiliar layouts and checks them for tampering, so foreign workers, students and investors onboard without waiting for a template. Act 140/2018 recognises foreign passports, ID cards and driving licences as identification alongside Icelandic documents.
How does Shufti OCR compare with Google OCR for Icelandic identity documents?
Icelandic documents use Latin script with þ, ð, æ and accented vowels, which Shufti reads at the accuracy it publishes across all supported languages. Its public benchmark against Google Vision shows an average of 93% accuracy to Google's 78.4%, a gap that matters on the many expat documents Icelandic firms receive.
How does Shufti verify ownership when an Icelandic company has several corporate layers?
Shufti pulls the company's record from the Register of Enterprises, reads shareholder registers and filed beneficial owner information, and traces each corporate shareholder to the natural person in control, applying the more-than-25% test in Act 140/2018 and flagging any mismatch with the register.
Does Shufti's ongoing monitoring cover more than sanctions screening?
Yes. Art. 10 of Act 140/2018 requires regular monitoring of business relationships and up-to-date customer information. Shufti compares transactions with each customer's profile, rescreens sanctions, PEP and adverse media data, and flags registry, director and ownership changes for analyst review.
How does Shufti keep screening current and handle Icelandic name variations?
Watchlists, including UN Security Council lists and sanctions applied in Iceland under Act 68/2023, refresh every 15 minutes. Native phonetic models across 80+ languages match patronymic surnames, transliterated letters and reordered names, so listed persons are caught without flooding analysts with false hits.
Can we choose Iceland hosting or run verification inside our own infrastructure?
Yes. Shufti can run on-premises inside your Icelandic infrastructure, including fully air-gapped deployments, or in EEA cloud regions. The agreement records the hosting location and transfer arrangements, so your outsourcing records under Central Bank guidance and Act 78/2025 stay complete.
What controls help us protect identity and biometric data?
Encryption in transit and at rest, role-based access, audit logs and configurable retention protect identity and biometric data, which Act 90/2018 treats as sensitive. Shufti's independent certifications support vendor reviews, and its consent capture records how each customer agreed to biometric checks.
Can we configure different retention periods for different Iceland licences?
Yes. Retention is set per client, product and licence, so a bank, a payment institution and a crypto-asset firm in one group can each keep records for their own required period, with the five-year minimum in Act 140/2018 as the floor and legal holds where needed.
What does Shufti provide when our compliance team needs to prepare a goAML report?
Shufti assembles a report-ready bundle with the customer's verification results, screening hits, transaction history, analyst notes and decision trail, so the MLRO can review the evidence and submit the report to the FIU through goAML while the related transaction is on hold.
Can we add verification checks without rebuilding our onboarding journey?
Yes. Shufti's AI Journey Builder adds or reorders checks such as electronic ID, NFC, address or EDD questionnaires by product and risk tier through the same API and SDK, so existing journeys keep running while new steps go live for the customers who need them.
How does Shufti make verification queries easier for our customer support team?
Support agents see each verification result in the back office with the reason behind it, the documents captured and the checks that passed or failed, so they can explain an outcome, request a resubmission or escalate a dispute without involving engineering.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
24 August, 2026
Qualified Electronic Signature: EU & EEA Country Guide
A country-by-country view of where a Qualified Electronic Signature is legally enough across the EU and EEA, checked against each country's primary law.
Product Guide
