You Verify Customers Biometrically. You Verified Employees With a Form.

Background Checks Aren't Enough, Employee ID Verification Should Come First

Background checks are critical for financial services, fintech and other regulated industries. Yet many companies don't realize that background checks aren't enough, employee ID verification should happen first.

Financial institutions take their responsibilities regarding identity verification seriously, especially when it comes to their customers. Customer identification is a requirement of the Bank Secrecy Act's Customer Identification Programme rules. Customer controls include authenticating government-issued IDs, biometric liveness checks, screening against watchlists, and continuous transaction monitoring. Customers have to prove that they're a real, live, actual human being, and that they're the exact human being that they claim to be, before they're allowed to open a $500 bank account.

Yet most financial institutions don't apply the same rigor when vetting new hires. When asked how they verify the identity of new hires, HR, risk, and compliance professionals will often say, "we run background checks." In regulated industries, background checks are common and often required. The problem is that most companies don't verify the identity of the applicant, assuming that they're receiving an accurate name from their own hiring team. And that is where background checks can fall short, a criminal or public records check just queries what's on record under a particular name. If a bad actor is applying under a stolen identity, it is quite possible they'll have a squeaky clean criminal and public records report.

ID verification is critical before conducting background checks

Financial services and other regulated industries should be asking, "How can we know that the person sitting across the table, or on the other end of a video interview, is who they say they are?" In addition to confirming criminal history, compliance teams should be seeking to verify the identities of employees. This is a common theme in federal prosecutions of North Korean nationals that have been hiring into US-based financial services companies using stolen identities, many were able to land remote, technology positions backed by a US-based laptop farm because their goals were to learn about moving money at Western-based companies.

So what's the answer? How can hiring and compliance teams verify the identities of employees?

FINRA rules for ID verification

FINRA requires its member companies to follow FINRA Rule 3110(e), which calls for written supervisory procedures for a firm to make reasonable efforts to verify information reported on the Form U4 and investigate the registered representative's character, business repute and qualifications, business experience, financial interests in any firm with which they intend to be associated and civil, criminal, regulatory, disciplinary, bankruptcy, media, adverse media and other pertinent public records within 30 days.

The Form U4 process involves fingerprinting, making it the only biometric background check. This is an improvement, as fingerprints are one of the oldest and most accurate forms of biometrics available. But not all positions within financial services require Form U4 registrations, IT engineers that don't touch customer accounts aren't required to fill out Forms U4. Nor are fintech employees that don't sell securities. Nor are operations employees that aren't registered representatives. Nor are contractors. Which means there is a massive gap in fingerprint-based background checks for financial services, especially given the increased popularity of remote work.

Section 19 of the Federal Deposit Insurance Act prohibits individuals with a history of dishonesty, breach of trust or money laundering from participating in the management of an FDIC-insured bank without the FDIC's consent. The 2024 final rule, which conforms the FDIC's rules with the Fair Hiring in Banking Act, took effect on October 1, 2024. But unlike Form U4s, these checks are records-based only. There's no biometric component.

So who verifies the identity of non-U4 financial services employees? No one, unless the hiring or compliance team implements additional controls.

Employee ID verification is a gap that companies need to fill

Cerebrum is a leader in identity verification technology and has worked with financial services, fintech, digital assets and many other industries that require strict employee verification.

Cerebrum's vID product is an employee verification tool that verifies employee identity through government-issued IDs and liveness checks. Cerebrum's Synapse product automates the background and compliance screening that follows a verified identity. Cerebrum's Wallet provides a single place for consumers to store and manage their credentials.

Cerebrum is not a registration or background check filing entity and is distinct from companies that offer background checks.

Contact us to learn more →

Why background checks alone leave you exposed

If your organization has anything to do with money, chances are, you're required to background check new hires. Whether it's a requirement imposed by a regulator like FINRA for broker-dealers, a partner such as a payment network for merchant acquirers, or best practice to prevent fraud and ensure trustworthiness, financial services is full of background check requirements.

We want to highlight an element missing from most companies' background check processes: identity verification. Without first verifying the identity of an applicant, background check results may be inaccurate, leaving your organization exposed.

How can this be?

Most background checks are records-based, they are a series of searches across databases to assemble a history of events. The issue is that background checks simply return the record for whatever identity you provide. If you give them Jane Doe's identity, you'll get Jane's record. If the person you're hiring isn't Jane, then that check did little to protect your organization, it is an accurate report on Jane, but has little bearing on the person you're hiring.

Sound like something that shouldn't happen? It happens more than you'd think, especially now that hiring has gone remote and North Korean nationals are setting up laptop farms to apply to any job at Western organizations that facilitate money movement, because it is not salary they're after.

How does identity verification fix this?

Before pulling records-based reports, identity verification uses government-issued ID and biometrics to prove who someone is. Financial services already knows the value of identity verification, your organization would never onboard a customer without first using ID and biometrics to verify who they are. So why accept "we run background checks" as good enough for employees?

Implementing identity verification has other advantages:

• Don't waste money: If someone tries to pose as Jane, you'll know right away, saving any subsequent costs associated with a background check, fees, credit report costs, filing costs, etc.
• Look past registered reps: Many financial services companies limit their use of identity verification to registered representatives. But aren't those the lowest-risk hires? What about anyone with access to production environments, customer PII/financial information, or ability to initiate payments?
• Verify contractors & vendors: Don't settle for attestations, specify verification steps and ensure that those steps are being followed. Keep track of staff turnover within vendors.

Regulatory Background Checks for Financial Services

FINRA, Form U4

FINRA's Supervision of Registered Persons rule (Rule 3110(e)) requires broker-dealers to make reasonable efforts to verify the accuracy of all information provided on the U4 and make a reasonable inquiry into an individual's background and character. This may include searching readily-available information.

FDIC, Section 19 Determinations

Section 19 of the FDI Act prohibits certain people from working at an IDI without the FDIC's prior consent. These include any person convicted of a crime involving dishonesty or a breach of trust or money laundering, and any person that was removed from a position of responsibility. The FDIC's 2024 final rule went into effect on 1 October 2024, in response to the Fair Hiring in Banking Act.

How Fintechs Are Different

Fintechs may not fall under the purview of the FDIC or FINRA, leaving them without the above regulations, however, many are held to similar requirements by partners. Those that operate as neither broker-dealers nor banks should research which of the above apply to them.

Cerebrum Solutions

Cerebrum offers two main solutions for employee verification: vID for identity verification, and Synapse for compliance automation (background checks). We encourage organizations to verify identity via ID + biometric match + liveness detection before moving on with background check workflows.

• Cerebrum vID — Verify employee identity at the start of your onboarding process. Cerebrum can be integrated into existing workflows to verify the applicant's claimed identity, linking them to a government-issued document with ID + biometric match + liveness detection. We're happy to be used as a standalone identity verification step, no background check necessary.
• Cerebrum Synapse — Streamline compliance workflows like background checks with identity verification included. Synapse is built to automate compliance workflows around hiring. We can be engaged before, after, or without vID, however, we recommend using Cerebrum for identity verification so you're checking the right records.

Cerebrum can be used to verify the identity of all new hires or a subset of your workforce such as those with authority to initiate payments. We encourage financial services organizations to think about who else has access to sensitive information or ability to move money and ensure that all of those people's identities have been verified. We encourage employers to specify acceptable identity verification procedures for vendors/contractors, then use Wallet to manage the resulting credentials. Wallet allows us to package verification events as a credential that lives with the worker.

Learn more →

Important Distinctions: What Cerebrum Doesn't Do

We can integrate into existing processes to verify identity before running fingerprinting, U4 filing, Section 19 determination, and/or sanctions screening, we don't conduct these processes ourselves. We don't file U4s or make Section 19 determinations, etc.