Central Bank of Tunisia Issues Circular on Electronic Client Onboarding
The Central Bank of Tunisia (BCT) published Circular No. 2025-06 on February 28, setting out the minimum rules governing electronic client onboarding by banks. This decision aims to regulate the use of technological processes for collecting, verifying, and storing customer data, while strengthening security and compliance in the face of money laundering and terrorist financing risks.
The circular, which came into effect after the opinion of the Compliance Control Committee, complements previous regulations and provides a precise framework for the development of digital banking services. It is part of a legislative framework protecting customers' personal data and meets modern requirements for information system security. Banks will now have to establish formalized procedures and devices ensuring data security throughout the onboarding process, including for remote customer identification.
Enhanced Electronic Identification Process
The circular defines strict requirements for electronic customer identification, providing for the use of automated or semi-automated technologies. It stipulates that banks must ensure the verification of customer identities with a level of security equivalent to that of a physical meeting. Among the criteria to be respected, the use of facial recognition and biometrics is particularly highlighted to guarantee the authenticity of identification.
Banks will also have to ensure a low rate of "false positives," i.e., cases where an identity is accepted when it should have been rejected. The circular specifies the methods for calculating this rate, as well as the implementation of incident management devices in case of fraud attempts.
Rigorous Measures to Protect Data
Customer data security remains a top priority in this new regulation. Banks will have to implement encryption systems for storing "KYC" (Know Your Customer) identification files and identity documents, which must be stored securely with regular verification of the integrity of the information.
Banks will also be responsible for conducting performance tests before implementing new technologies, to ensure they meet security standards. Furthermore, a performance register will have to be kept to measure the effectiveness of the electronic onboarding process.
