- Australia
- Austria
- Bangladesh
- Belgium
- Brazil
- Bulgaria
- Canada
- China
- Croatia
- Cyprus
- Czech Republic
- Denmark
- Egypt
- Estonia
- Eswatini
- Ethiopia
- Finland
- France
- Germany
- Greece
- Haiti
- Hong Kong
- Hungary
- India
- Iraq
- Ireland
- Indonesia
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Lithuania
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Mongolia
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Poland
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- Uganda
- Ukraine
- UK
- USA
- Vietnam
PORTUGAL KYC, KYB AND AML
Scale Identity Verification and KYC Operations in Portugal
Verify Portuguese customers and businesses through Portugal's notified eIDs, NFC, QES, identity documents, biometrics and KYB. Reduce manual review, maintain consistent audit evidence and run one connected workflow designed to support Lei 83/2017 today and AMLR from 10 July 2027.
Operational Performance for Portugal KYC
Our Numbers Speak Volumes
97.85%
First-pass
verification rate
< 10 sec
Median
verification time
5+
Portuguese ID methods
supported
Portugal IDV/KYC Challenges
Two card designs, one chip rule
A new Cartão de Cidadão design started on 11 June 2024; older cards run to 3 August 2031. Contactless reading also needs the six-digit CAN printed on the card.
Portuguese names break global matching
Portuguese names carry up to four surnames plus optional particles like de and dos, and order is not fixed by law. The MRZ strips diacritics, so matching misfires.
Ownership is harder to see
Decreto-Lei n.º 115/2025 opens RCBE records under Lei n.º 89/2017 only to a demonstrated legitimate interest, logged five years. Article 34(2)(d) of Lei 83/2017 conditions the relationship on registration.
Registry data is not verification
A Certidão Permanente confirms a company exists and who can sign for it, not if those people are sanctioned or politically exposed. KYB needs screening on top.
Regulatory Update
What AMLR Changes for Identity Verification in Portugal
The EU Anti-Money Laundering Regulation (EU) 2024/1624 applies directly in Portugal from 10 July 2027, with no transposition period. It sets the due diligence rules the Lei 83/2017 framework will operate under. AMLA, the EU supervisor in Frankfurt, supervises from 2028.
Timeline
- 24 Dec 2026 Member State wallet issuance deadline
- 10 July 2027 AMLR applies, no transposition
- 24 Dec 2027 Acceptance by private relying parties
- 2028 AMLA direct supervision begins
eIDAS Is Now an Explicit Route
Article 22 names electronic identification at eIDAS assurance level substantial or high, with relevant qualified trust services such as QES, as a route for remote verification. Article 22(6) gives two equal means, so document-based verification under 22(6)(a) stays valid alongside eIDAS under 22(6)(b).
The Ownership Test Tightens
AMLR sets the test at 25% or more, up from more than 25% under Lei 83/2017, and also requires ownership through control, which has no threshold.
Existing Customers Get Re-Checked
AMLR expects existing customer records to be brought up to standard on a risk basis, not just new onboarding. Continuous monitoring keeps back-book files current between reviews.
Accountability Stays With You
Article 18 AMLR keeps due diligence accountable with the obliged entity even when verification is outsourced. Article 41(10) of Lei 83/2017 already does the same.
FOR BANCO DE PORTUGAL-SUPERVISED BUSINESSES
Streamline Banco de Portugal-Supervised Onboarding in Portugal
Connect identity verification, QES, Penny Drop and compliance evidence in one configurable workflow for businesses operating within Banco de Portugal’s supervisory remit. Reduce customer drop-off and manual handovers while giving compliance teams a consistent, review-ready record of every decision.
1. Verify the customer
Verify identity using the configured route, such as Portugal’s notified eIDs, NFC document reading or document and biometric checks.
2. Complete qualified signing
Apply and validate the QES within the same journey, keeping the signed document, verification result and supporting evidence together.
3. Confirm the payment account
Use Penny Drop Verification to confirm the customer’s payment account, supporting the traceable-funds safeguard in Anexo I to Aviso 1/2022.
Shufti's IDV/KYC Solutions for Portugal
KYC Solutions
Onboarding designed to support Lei 83/2017 requirements for Portuguese customers, with age and address checked in the same flow as identity.
Explore MoreIdentity Verification
Shufti confirms every customer is real and present, not a spoofed or synthetic identity. Biometric face matching and liveness detection run against 10,000+ active ID document types.
.Face Verification
Face verification binds the live person to the document with iBeta Level 3 Conformance to ISO/IEC 30107-3 liveness, stopping spoofs, masks and deepfakes.
.Age Verification
Selfie-based age estimation combined with document verification fallback where required for regulated sectors such as online gambling licensed by SRIJ and e-commerce.
.Address Verification
Shufti verifies Portuguese address-bearing documents, including utility invoices, telecom bills and bank statements from major Portuguese issuers. Proof-of-address checks remain common in regulated onboarding.
.Document Verification
Verification of the Cartão de Cidadão, Título de Residência and Portuguese ePassports, including NFC chip reading and Portuguese-language OCR extraction. A remote verification route under AMLR Article 22(6)(a).
.Bank Account Verification
Confirms a Portuguese bank account (PT IBAN) belongs to the customer, returning the registered account holder name for matching against the verified identity.
.KYB Solutions
Lei 83/2017 requires risk-based due diligence on businesses as well as the people behind them. Shufti checks registry records, beneficial ownership, and VAT details in real time, then screens UBOs against 4,000+ global watchlists for sanctions and adverse media exposure.
Explore MoreBusiness Verification
Automated validation of Certidão Permanente data, the NIPC, the PT VAT number and appointed managers. Reduces manual registry lookups and onboarding delays.
.Enhanced Due Diligence (EDD)
Structured risk profiling for complex ownership chains, cross-border entities and high-risk sectors, designed to support the risk-based obligations in Lei 83/2017.
.AML Screening
Shufti screens customers and transactions in 240+ countries and territories, flagging sanctions, PEP, and adverse media matches as they happen. Ongoing monitoring surfaces suspicious activity in time to meet local reporting obligations.
Explore More
AI Compliance Copilot
Helps compliance teams review verification and AML data, investigate alerts, and understand the reasoning behind risk signals. It brings relevant case information together to support faster, more consistent compliance decisions.
.
Transaction Monitoring
Ongoing transaction monitoring calibrated to Portuguese financial flows flags anomalies against AML rules, supporting the controls Banco de Portugal and the UIF expect.
.Supported Verification Methods for Portugal
Every Verification Route Portugal Uses, in One Platform
Shufti supports the full range of remote verification routes used in Portugal, from the EUDI Wallet and the notified eIDs to document and biometric checks. Each method below shows what is live today and what is ready for the 2027 rollout.
EUDI Wallet
Wallet-ready · from 2027AMLR Article 22 recognises eIDAS electronic identification at substantial or high for remote verification. Portugal is developing its gov.pt wallet under the eIDAS 2.0 rollout. Shufti is built to accept wallet verification as it goes live.
Notified eID
LiveeIDAS HighThe Cartão de Cidadão and the Chave Móvel Digital are Portugal's notified eIDs, both at the highest eIDAS assurance level, used through the card chip and the gov.pt app. Shufti verifies both today. No bank or private scheme is notified.
Docless Database (eIDV)
LiveDatabase-driven verification confirms identity in seconds for low-risk onboarding, with no document upload. Shufti confirms which sources are available for Portugal at scoping and escalates as risk rises.
NFC Chip Verification
LiveShufti reads the secure chip in the Cartão de Cidadão, the Título de Residência and the Portuguese ePassport. Contactless reading needs the printed six-digit CAN, and the flow prompts for it.
Document and Face Biometric
LiveA route under AMLR Article 22(6)(a). Document authentication of the Cartão de Cidadão, Título de Residência and ePassport, paired with iBeta Level 3 Conformance to ISO/IEC 30107-3 liveness to confirm a real, present person.
Video Identification
LiveAnexo I to Aviso do Banco de Portugal 1/2022 sets the rules for attended identification by videoconferência, and Article 8 of Regulamento da CMVM 2/2020 allows it for CMVM firms in low-risk cases. A guided real-time session checks the document's security features live, runs a face match and liveness check, and closes with a one-time code.
Qualified Electronic Signature
LiveArticle 25 of Lei 83/2017 accepts the qualified electronic signature and secure State authentication through autenticacao.gov.pt as means of evidencing identity. Shufti runs eIDAS-qualified signing powered by Evrotrust, an EU qualified trust service provider, producing PAdES-LTV signatures. For Portugal the signing check runs through NFC and face biometrics.
Independent Validation
Shufti's Recognition Across Independent Evaluations

Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Top Vendor for Product Execution in the Liminal Index for KYC 2026
View Report
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader in G2 Fall 2026 reports
Read MoreEvidence-Ready Checks Across People & Businesses
Verifications with robust evidentiary support
Individual Documents We Verify
Shufti verifies 17+ individual Portuguese document types.
View All Supported DocumentsCartão de Cidadão (Portuguese Citizen Card)
Primary identity document for Portuguese citizens under Lei n.º 7/2007. Dual-interface chip, ICAO-compliant, and a notified eID at the highest eIDAS assurance level.
Passaporte Eletrónico Português (Portuguese ePassport)
Machine-readable Portuguese passport used mainly as travel and cross-border identity evidence. Biometric and ICAO-compliant, with an NFC chip that supports chip-based checks.
Título de Residência (Residence Permit)
Residence permit for non-EU nationals in Portugal. Issued in the EU uniform format with a contactless chip for remote, high-assurance identity verification.
Cartão de Residência para Familiares de Nacionais da União Europeia
Residence card for non-EU family members of EU nationals living in Portugal. Evidences residency rights through an official card during foreign-national onboarding.
Certificado de Registo de Cidadão da União Europeia
Residency evidence for EU nationals in Portugal. Not a primary photo ID, so Shufti pairs it with a passport or national ID.
Carta de Condução (Portuguese Driving Licence)
Portuguese driving licence, accepted as supporting identity and age evidence. Verified for authenticity through document checks, and available digitally in the gov.pt app.
Entity Identity
Certidão Permanente do Registo Comercial (Commercial Register Extract)
Registry extract from the Registo Comercial kept by the IRN. Confirms legal existence, registered seat and representation powers through an access code.
Cartão da Empresa / Cartão de Pessoa Coletiva (Company Card)
Core entity identifiers from the Registo Nacional de Pessoas Coletivas, including the NIPC, the registered seat and the CAE activity code.
Articles of Association and Management Body Evidence
Current constitutional terms, director and signatory authority, and sector-authorisation context such as a Banco de Portugal operating licence where relevant to the KYB review.
Tax Identity
NIPC (Legal Person Identification Number)
Core entity identifier issued by the Registo Nacional de Pessoas Coletivas. Inside the RNPC regime the NIPC is also the NIF, so one number links registry and tax.
VAT Number
Presented as PT plus nine digits, ordinarily the same nine digits as the NIPC. Shufti validates the format as part of KYB data hygiene.
Certidão de Não Dívida Tributária / Declaração de Situação Contributiva
Evidence of tax regularity from the Autoridade Tributária e Aduaneira or social-security contribution status, used in higher-risk counterparty and payout-related reviews.
Ownership & Control (UBO)
Registo Central do Beneficiário Efetivo (RCBE)
Portugal’s beneficial ownership register under Lei n.º 89/2017. Shufti checks control data against it, with the AMLR ownership test applied at 25% or more for entities.
UBO Declaration and Supporting Corporate Evidence
A structured UBO capture pack that reconciles ownership with registry facts and screening outputs, and stays audit-retrievable for the seven-year retention period.
Languages We Cover
Portuguese-language document parsing
Native European Portuguese parsing keeps diacritics and compound surnames intact across the Cartão de Cidadão, the Certidão Permanente and the RCBE, so checks stay accurate.
Name matching logic
Name and address matching handles four-surname names, optional particles and stripped diacritics, cutting false mismatches against official sources.
Cross-document consistency checks
Cross-document consistency checks reconcile names and identifiers across the Cartão de Cidadão, the Certidão Permanente and the RCBE to catch mismatches.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer avoidable re-submissions
Optimised capture for Portuguese ID formats and the Cartão de Cidadão CAN step cuts avoidable re-submissions and manual review.
Cleaner audit trails
Structured logs aligned to the seven-year Lei 83/2017 retention duty and UIF reporting obligations keep every onboarding decision audit-ready.
Better name matching outcomes
Matching handles four-surname names, optional particles and stripped diacritics common in Portugal, reducing false positives and manual review.
One workflow, one back office
KYC, KYB and AML screening are consolidated in one operational case view, so one back office team works on every customer file.
National ID-first flow design
Cartão de Cidadão and Chave Móvel Digital-first onboarding reflects how identity works in Portugal and how customers actually verify.
Continuous Compliance
Compliance that does not stop at onboarding
AMLR treats customer due diligence as a continuing obligation. Perpetual monitoring keeps the customer picture current between reviews, so risk is caught when it appears, not at the next annual check.
Surface Changes as it happens
DetectPerpetual monitoring flags risk when it appears, not at the next annual review. Behavioural biometrics, background fraud signals, and ongoing sanctions and PEP screening watch every active relationship.
Step up when the signal fires
VerifyWhen a signal fires, re-verification confirms the person or the ownership change using the same live methods above, so a flag turns into a resolved decision.
Keep the file audit-ready
ComplyEvery check and decision is logged to Lei 83/2017 record-keeping standards, so the file is organised and retrievable for supervisory review.
Perpetual KYC
pKYCKeeps individual customer risk current with behavioural biometrics, background fraud signals and ongoing AML screening, so back-book records stay standard-ready.
Perpetual KYB
pKYBMonitors the RCBE and the Registo Comercial for shareholding and control changes, so a shift past the 25% threshold or a change in control is caught.
Built To Fit Portugal’s Compliance Landscape
Banco de Portugal (BdP)
Supervises credit institutions, payment and electronic money institutions and, since Lei 70/2025, crypto-asset service providers. Shufti supports its AML expectations with structured identity evidence, risk classification logs and ongoing monitoring controls.
Comissão do Mercado de Valores Mobiliários (CMVM)
Securities Market Commission supervising investment firms, fund managers and crypto-asset offers. Shufti delivers KYC audit trails and sanctions screening for CMVM-regulated entities.
Autoridade de Supervisão de Seguros e Fundos de Pensões (ASF)
Supervises life insurers, insurance intermediaries and pension fund managers. Shufti automates KYC for insurance intermediaries to support ASF due diligence expectations.
Comissão Nacional de Proteção de Dados (CNPD)
National data protection authority enforcing GDPR and Lei n.º 58/2019. Data minimisation, lawful-basis processing and EU-region hosting keep Portuguese personal data handling compliant.
Unidade de Informação Financeira (UIF)
Portugal’s Financial Intelligence Unit, inside the Polícia Judiciária. Receives suspicious transaction reports under Article 43 of Lei 83/2017 alongside DCIAP. Decision audit trails and escalation logs support that filing.
Inspeção-Geral de Finanças (IGF)
General Inspectorate of Finance, the AML supervisor for the state treasury and debt agency IGCP and the audit body for public financial control. Shufti maintains decision records and audit logs supporting compliance examinations.
AMLA (EU Anti-Money Laundering Authority)
The new EU-level supervisor has been established in Frankfurt since July 2025. Begins direct supervision of selected high-risk cross-border entities from 2028 and shapes technical standards under AMLR.
Deployment Option
Cloud in EU regions, or on-premise, hosts Portuguese customer data in-region and supports GDPR accountability.
Regulatory Alignment
Aligned with Lei 83/2017 due diligence obligations, RCBE verification and record-keeping duties, as well as GDPR and AMLR requirements applying from July 2027. Shufti is a data processor providing verification technology, not legal advice. Due diligence and method choice remain the obliged entity’s responsibility.
Retention Controls
Article 51 of Lei 83/2017 keeps records seven years, from identification, from the end of the relationship, or from execution; Article 59(3) requires deletion after. AMLR Article 77 applies from 2027.
Encryption & Security
Encryption in transit and at rest, with access controls and audit logging, supports Article 32 GDPR and Lei n.º 58/2019 obligations, under ISO 27001 and SOC 2 Type II certification.
Data and Privacy Controls in Portugal
Portugal AML Sources That Strengthen Decisions
We screen against 215+ sanction regimes, 4,000+ watchlists, 100,000+ adverse-media sources, and 6M+ PEPs across Portugal and globally. A few of them are:
Unidade de Informação Financeira (UIF)
Banco de Portugal
Comissão do Mercado de Valores Mobiliários (CMVM)
Autoridade de Supervisão de Seguros e Fundos de Pensões (ASF)
Comissão de Coordenação de Políticas de Prevenção e Combate ao BC/FT
Departamento Central de Investigação e Ação Penal (DCIAP)
Instituto dos Registos e do Notariado (IRN), Registo Central do Beneficiário Efetivo (RCBE)
Financial Action Task Force (FATF)
EU AMLA (Anti-Money Laundering Authority)
EU Consolidated Financial Sanctions List
European Banking Authority (EBA)
UN Security Council Consolidated List
Egmont Group of Financial Intelligence Units
Basel AML Index (Basel Institute on Governance)
SEE SHUFTI IN YOUR PORTUGAL WORKFLOW
Turn Portuguese Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB, QES, Penny Drop and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.
Frequently Asked Questions
Which identity documents can be used for Portuguese onboarding?
Customers can use the Cartão de Cidadão, including its notified eID and NFC chip. EU and EEA identity cards, passports and the Título de Residência are also accepted where they meet applicable Lei 83/2017 requirements. Shufti supports document, eID, NFC and biometric verification within one configurable workflow.
How does Shufti support Banco de Portugal-supervised businesses in Portugal?
Shufti connects identity verification, KYB, AML screening, QES, account verification and decision evidence in one configurable workflow. This helps businesses within Banco de Portugal’s supervisory remit reduce manual hand-offs, standardise compliance records and prepare clearer evidence for internal audit and applicable supervisory review.
What documents are required for KYB in Portugal?
Typically a Certidão Permanente, the NIPC and VAT number, the Cartão da Empresa and beneficial ownership details from the RCBE. Shufti verifies these in real time and screens the UBOs behind them against sanctions and PEP lists.
How are Portuguese name variants handled in screening?
Matching accounts for up to four surnames, optional particles like de and dos, compound surnames such as Castelo-Branco, and diacritics stripped from the MRZ, so false positives on Portuguese names stay low.
How long must AML records be retained in Portugal?
Under Article 51 of Lei 83/2017, identification and transaction records are kept for seven years. The period runs from the moment identification took place or from the end of the business relationship, and transaction records run seven years from execution.
Is EU-region data hosting available?
Yes. Shufti offers EU-based cloud regions, so Portuguese customer data stays in-region in line with GDPR and Lei n.º 58/2019. On-premise deployment is available where residency requirements are stricter.
What changes for Portugal under AMLR from July 2027?
AMLR applies directly, so no Portuguese transposition law is needed. It recognises eIDAS electronic identification at assurance level substantial or high and qualified trust services for remote verification, keeps document plus biometric checks as a lawful route, and sets the beneficial ownership test at 25% or more.
How do QES and account verification work together under Lei 83/2017?
Article 25 of Lei 83/2017 accepts the qualified electronic signature and secure State authentication through autenticacao.gov.pt as means of evidencing identity. Shufti connects QES, account verification and supporting evidence in one workflow, subject to the applicable account and transaction requirements.
When will the EUDI Wallet be usable for onboarding in Portugal?
Under eIDAS 2.0, EU member states target wallet availability from the end of 2026, and regulated businesses must accept wallet-based verification in the period after that. Portugal is developing its gov.pt digital identity wallet under this rollout. Shufti is built to accept wallet-based verification as the Portuguese wallet goes live, so onboarding flows will not need to be rebuilt.
Can we keep using video identification in Portugal after July 2027?
Yes. AMLR recognises eIDAS electronic identification and qualified trust services for remote verification, and video identification stays usable where national rules permit it, with a documented justification for the method choice. Anexo I to Aviso do Banco de Portugal 1/2022 sets those rules today, and Shufti supports both routes.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
10 July, 2026
Identity Verification in Europe: eIDAS 2.0 & EUDI Wallet
A practitioner's guide to verifying identity in Europe, covering eIDAS 2.0, the EUDI Wallet, docless eIDV and how to choose an eID provider for onboarding in the EU.
Product Guide





