Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p3
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 3/17)
Character Range: 145479–148382

its biometric capability and have appropriate user-interface instructions that direct an individual to capture an image using the biometric capability that meets the image quality profile for the acquired image.
 (6) An ISP must comply with the following requirements when conducting online biometric binding:
 (a) online biometric binding must be completed in a single continuous workflow;
 (b) liveness detection must be included as part of presentation attack detection;
 (c) presentation attack detection must be used at the point of capture of the acquired image;
 (d) the capture of the acquired image and presentation attack detection must be completed, as part of the same process, before the acquired image is submitted for biometric binding; and
 (e) presentation attack detection technology that incorporates data captured by both the data capture subsystem and through system level monitoring, as described by ISO/IEC 30107-1, must be used.

5.18  Requirements for local biometric binding
 (1) Local biometric binding must be conducted by an assessing officer in the physical presence of the individual and must use one or more of the following processes:
 (a) technical biometric matching;
 (b) source biometric matching;
 (c) for identity proofing at level IP2 Plus only—eIDVT biometric matching.
 (2) However, if those processes are unavailable to the accredited entity for a kind of photo ID, manual face comparison may be conducted.
Note: For manual face comparison requirements, see rule 5.21.
 (3) While conducting local biometric binding, access to biometric information and the biometric capability of the ISP must be restricted to the assessing officers conducting the binding.
 (4) If an acquired image is being captured as part of local biometric binding, an image quality profile must be developed and applied in accordance with rule 5.17.
 (5) Local biometric binding must be conducted only at a location that is named in the ISP's fraud control plan and system security plan as able to be used for that purpose.

5.19  Requirements for technical biometric matching
 (1) Technical biometric matching of an acquired image must only be conducted using an Australian passport or foreign ePassport if that passport has been technically verified in accordance with rule 5.12.
 (2) A biometric matching algorithm must only be used to conduct one‑to‑one biometric matching between the acquired image and the image on the Australian passport or foreign ePassport.

5.20  eIDVT biometric matching
 (1) eIDVT biometric matching must be conducted using only one of the following photo IDs presented by the individual to a biometric sensor (physically presented) at the time the matching is being conducted:
 (a) a driver's licence issued under a law of a State or Territory;
 (b) a proof-of-age card issued by or on behalf of a State or Territory; or
 (c)  an Australian passport.
Note: A