Consent that is plain enough for a real customer
A guided video verification session should not feel vague to the customer. The person needs to know that their face, ID document images and session record are being collected for identity verification, and that the process forms part of onboarding. Clear wording helps the agent too, because the same script can be used whether the client is opening a bank profile, a trading account or a service account.
For POPIA, the consent conversation is better when it is specific. Avoid broad phrasing that leaves the customer wondering what happens to the video. The cleaner route is to explain the purpose, the type of data captured, the parties that may access it and the period for which it is retained.
- Tell the customer the session is recorded for verification and audit purposes.
- State that ID document images and face comparison results may be stored with the record.
- Keep the wording short enough for an agent to read without stumbling.
- Make sure the customer can stop if they do not agree to the capture.
What gets captured during the session
In a remote video onboarding flow, the useful record is usually more than the live call itself. A trained agent may capture a photo of the ID document, a live face comparison, a short liveness check and notes from the interaction. Those items help a business show that it took reasonable steps to confirm identity before account opening.
The practical point is to limit capture to what is needed for the verification task. Do not widen the collection just because the system can store more. Extra footage or unnecessary personal detail creates handling overhead, more internal access risk and more admin when retention periods are reviewed.
- Capture the document image only where it is needed for the check.
- Use live facial comparison to match the person to the document holder.
- Record the outcome of the verification decision in a controlled system.
- Keep background material out of the record if it serves no business purpose.
Records that can be explained later
Verification records matter when a business must show how a decision was reached. That is not only about proving that the session happened. It is also about keeping enough detail to trace the workflow from consent, to document capture, to the final verification outcome. If a customer queries an account opening later, the record should still make sense to the people who review it.
Good record keeping is practical, not decorative. Keep the files labelled properly, limit who can open them and make sure notes are readable. A messy archive is not a privacy control, it is just a messy archive.
- Store verification notes with the related customer record.
- Use access controls so only authorised staff can review session data.
- Separate training material from live customer records.
- Review retention rules so old records are not kept without reason.
A Johannesburg example with a national footprint
A Rosebank team working for clients in Johannesburg, Pretoria, Cape Town, Durban and Gqeberha may run the whole verification flow remotely. A customer can join the guided session from home or from an office, show the ID document to the camera and complete the face check while an agent follows a standard script. The verification outcome then moves into the client’s onboarding process without the customer having to travel across town.
That kind of setup only works cleanly when the moving parts are clear. Integration planning matters, agent script design matters, and staff training matters just as much as the technology. If a client’s internal team does not understand who captures what, the process becomes inconsistent and records get treated casually.
- Map the workflow before live sessions start.
- Train agents on document handling and customer consent wording.
- Set escalation steps for blurred documents or failed face matches.
- Keep a written process for exceptions and manual reviews.
Where POPIA and FICA meet in practice
Remote identity verification often sits inside a wider customer due diligence process. For many businesses, the aim is to open accounts with enough confidence that the person on screen is the same person named on the document. POPIA shapes how the personal information is handled, while the onboarding process itself may also need to satisfy internal FICA checks and related controls.
The most useful approach is to align the privacy handling with the operational task. Staff should know why the data is collected, how long it stays active in the system and what happens when the result is unclear. If a customer fails the session, the file should be handled with the same care as a successful one.
- Use a defined purpose for each data element collected.
- Keep verification records tied to the onboarding decision.
- Train staff to escalate doubtful checks, not improvise them.
- Review scripts when the business changes its onboarding flow.
The practical habits that cut down privacy friction
The best privacy habits are ordinary ones done properly. They include short consent wording, disciplined file naming, limited access, decent training and a clean escalation route. A business does not need dramatic language to do this well. It needs people who know what belongs in the record and what does not.
At PersonVideo ID, that usually means helping client teams with workflow mapping, integration planning, agent script design, quality monitoring and refresh training. The point is not to collect more data, it is to handle the verification record in a way that can stand up inside an ordinary South African onboarding operation.
- Keep the customer informed at the start of the session.
- Only retain records that serve a real verification purpose.
- Check that staff can explain the process in plain language.
- Make sure escalation notes are specific, not vague.
