Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p2
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 2/17)
Character Range: 142734–145751

credential—ensure visual verification is conducted only by personnel who have been appropriately trained to conduct such verification; and
 (b) not use visual verification if source verification or technical verification has been conducted and the result indicates that the document or other credential is not legitimate.

Subdivision B—Verification using biometric information

5.15  Application
  This Subdivision:
 (a) applies to an ISP conducting identity proofing at levels IP2 Plus, IP3 or IP4; and
 (b) sets out the requirements for biometric binding when conducting identity proofing at those levels.

5.16  Requirements for biometric binding
 (1) Biometric binding must be conducted by using either:
 (a) online biometric binding; or
 (b) local biometric binding.
 (2) Source verification of a photo ID that will be used for biometric binding must be completed before starting the biometric binding process.
 (3) If the photo ID used is a foreign passport, including a foreign ePassport, the following requirements apply:
 (a) the passport must be linked to a visa that has been source verified; and
 (b) the biometric binding process must not be conducted until the linking of the visa and passport is verified.

5.17  Requirements for online biometric binding
 (1) Online biometric binding must capture an acquired image and conduct at least one of the following on the image:
 (a) technical biometric matching;
 (b) source biometric matching; or
 (c) for identity proofing at level IP2 Plus only—eIDVT biometric matching.
 (2) An acquired image must not be used for biometric binding unless:
 (a) an image quality profile of the acquired image has been created; and
 (b) a quality threshold for the acquired image has been applied and the threshold takes into account possible fraud risks and cyber security risks.
 (3) Online biometric binding must take into account the characteristics of biometric image quality described by ISO/IEC 29794-5 when generating the image quality profile of the acquired image.
 (4) An ISP must record evidence of the characteristics used in generating the image quality profile and quality threshold for the acquired image (as required by subrule (2)).
Example: Evidence of the characteristics may include image format, image resolution, contrast exposure or noise, colour depth and background characteristics.
Note: Details may be recorded in technical documents or third-party service level agreements and may include demonstrations of the biometric capability of the accredited service in action and internal quality assurance processes for acquired image capture, including how a system determines meeting an image quality score threshold.
 (5) An ISP must implement automated quality controls in its biometric capability and have appropriate user-interface instructions that direct an individual to capture an image using the biometric capability that meets the image quality profile for the acquired image.
 (6) An ISP must comply with the following requirements when