A computer-implemented method performed by a mobile device comprising a resource provider application and an authentication application, wherein: the resource provider application comprises an authentication request module, a biometric sampling module and a resource provider matching module, and the authentication application comprises a biometric matching module and credentials data, the method comprising: initiating, by the authentication request module of the resource provider application (308, 408) of the mobile device (302, 402), an authentication process for authenticating the user of the mobile device; sending, by the resource provider application (308, 408), a user identifier to an authentication gateway computer (314, 414); receiving, by the authentication request module of the resource provider application (308, 408), user enrollment information from the authentication gateway computer (314, 414), the user enrollment information comprising an indication of enrollment and one or more identifiers managed by the authentication gateway computer (314, 414); obtaining, by the biometric sampling module of the resource provider application (308, 408) on the mobile device (302, 402), a biometric sample captured by the mobile device (302, 402); generating, by the resource provider matching module of the resource provider application (308, 408), a biometric authentication template of a user of the mobile device (302, 402) from the biometric sample; obtaining from the authentication program based on the one or more identifiers received from the authentication gateway computer, by the resource provider application (308, 408), biometric matching information related to the biometric authentication template, the biometric matching information comprising a biometric enrollment template or an obfuscated matching circuit configured to provide an output from which a match between the biometric authentication template and a biometric enrollment template is identifiable; authenticating, by the biometric matching module of the authentication application and/or the resource provider matching application of the resource provider application (308, 408), the user of the mobile device (302, 402) based on the biometric authentication template, the biometric matching information, and a cryptographic comparison protocol for determining matching of the biometric authentication template and the biometric enrollment template comprising at least one of secure multi-party computation and homomorphic encryption; and executing, by the resource provider application (308, 408), at least one operation in response to the user being authenticated. initiating, by the authentication request module of the resource provider application (308, 408) of the mobile device (302, 402), an authentication process for authenticating the user of the mobile device; sending, by the resource provider application (308, 408), a user identifier to an authentication gateway computer (314, 414); receiving, by the authentication request module of the resource provider application (308, 408), user enrollment information from the authentication gateway computer (314, 414), the user enrollment information comprising an indication of enrollment and one or more identifiers managed by the authentication gateway computer (314, 414); obtaining, by the biometric sampling module of the resource provider application (308, 408) on the mobile device (302, 402), a biometric sample captured by the mobile device (302, 402); generating, by the resource provider matching module of the resource provider application (308, 408), a biometric authentication template of a user of the mobile device (302, 402) from the biometric sample; obtaining from the authentication program based on the one or more identifiers received from the authentication gateway computer, by the resource provider application (308, 408), biometric matching information related to the biometric authentication template, the biometric matching information comprising a biometric enrollment template or an obfuscated matching circuit configured to provide an output from which a match between the biometric authentication template and a biometric enrollment template is identifiable; authenticating, by the biometric matching module of the authentication application and/or the resource provider matching application of the resource provider application (308, 408), the user of the mobile device (302, 402) based on the biometric authentication template, the biometric matching information, and a cryptographic comparison protocol for determining matching of the biometric authentication template and the biometric enrollment template comprising at least one of secure multi-party computation and homomorphic encryption; and executing, by the resource provider application (308, 408), at least one operation in response to the user being authenticated.