Back to All Articles

VerifyNow guide

What are Biometric Liveness Checks & Why South African Businesses Need Them

Passive liveness checks whether a face photo appears live. Learn what the result means, where it fits in KYC, and what FICA and POPIA require.

Start verifyingView services
What are Biometric Liveness Checks & Why South African Businesses Need Them

A biometric liveness check assesses whether a face capture appears to come from a real, present person rather than a printed photo, screen replay or other presentation attempt.

That is useful in remote onboarding, but the result has a narrow meaning: liveness checks the capture; it does not identify the person. Identity verification, Face Match and liveness answer different questions and should be combined only when the risk requires them.

VerifyNow currently offers Passive Liveness. It does not offer an active-liveness workflow.

What does a liveness check do?

A face image is submitted for analysis. The service returns:

  • a decision status, such as Approved, Declined or In Review;
  • the liveness method;
  • a score;
  • detected face context; and
  • warnings that can be used for manual review.

The score should be treated as a risk signal, not an unquestionable fact. Poor light, blur, an obstructed face, an unusual camera angle or a low-quality device can affect the capture. A sensible workflow sends uncertain results to review or asks for a new image.

Passive liveness vs active liveness

Both approaches try to detect presentation attacks, but the user experience differs.

Passive liveness analyses a face photo without asking the person to complete a challenge. The user does not need to blink, speak, smile or turn their head. This is the method available through VerifyNow.

Active liveness asks the person to perform an action during capture, such as turning their head or following an on-screen prompt. It is a general liveness category, but it is not a VerifyNow service at present.

Passive capture can reduce friction because it uses one photo. That does not mean it should automatically approve every user. Your own risk rules should determine when to accept the result, request another capture or escalate the case.

Liveness, Face Match and ID verification are not the same check

These services answer separate questions:

CheckQuestion answeredWhat it does not prove
Passive LivenessDoes this face capture appear to show a live, present person?The person's identity
Face MatchDo two face images appear to show the same person?Whether an ID record is valid
ID VerificationDo the submitted identity details match an authoritative record?Whether the person submitting the details is in front of the camera

For stronger remote identity binding, a business can run passive liveness on the selfie, compare the selfie with a trusted reference through Face Match, and verify the identity details separately. Not every transaction needs all three checks.

Does Age Estimation include passive liveness?

Yes. VerifyNow Age Estimation returns an estimated age together with a passive-liveness method and score from the same face photo.

This matters for age-gated journeys: you do not need to call the standalone Passive Liveness endpoint again when you already use the Age Estimation response. It would repeat the liveness step and add an unnecessary request.

Age Estimation remains an estimate. It is not proof of age or identity. In a regulated journey, use the ID-backed or document evidence required by your policy and send borderline results to review.

The same approach is reflected in VerifyNow's iGaming verification flow: one selfie provides Age Estimation plus Passive Liveness, Face Match can be added when identity binding is needed, and SA ID verification provides the date-of-birth evidence used for the formal 18+ decision.

Is liveness a FIC Act requirement?

No. The FIC Act does not prescribe passive liveness, active liveness or any named liveness product.

The Financial Intelligence Centre's revised Guidance Note 7A explains a risk-based approach to customer due diligence. An accountable institution chooses the information and verification methods appropriate to the risks in its business relationships and documents those controls in its Risk Management and Compliance Programme (RMCP).

Liveness can support that control environment where remote impersonation or presentation attacks are a relevant risk. It does not, by itself, complete customer due diligence or make a business FICA compliant.

The practical questions for an accountable institution are:

  1. What impersonation risk exists in this channel or transaction?
  2. What evidence is needed to establish and verify the customer's identity?
  3. Does liveness add useful assurance at this point in the journey?
  4. What happens when the result is declined, uncertain or inconsistent with other evidence?
  5. How are the decision, evidence and review outcome recorded in the RMCP process?

Use the FIC's Revised Guidance Note 7A and compliance guidance as the primary regulatory sources. Legal or compliance advice should be obtained for your organisation's particular obligations.

What does POPIA require for biometric data?

POPIA treats biometric information as special personal information. A face image and the biometric result therefore require more care than an ordinary onboarding field.

The organisation that determines why and how the information is processed remains the responsible party. It should establish the applicable lawful basis or statutory exception, tell the person what is being collected and why, limit use to that purpose, apply appropriate security, control access, set a defensible retention period and manage any operator or cross-border arrangements.

Consent may be relevant, but it is not accurate to describe explicit consent as the only possible legal basis in every case. Sections 26 and 27 of POPIA set out the prohibition and exceptions for processing special personal information.

The Protection of Personal Information Act and the Information Regulator's guidance on processing special personal information are the appropriate starting points.

A practical remote-onboarding flow

A layered flow can look like this:

  1. Capture one clear selfie. Tell the person why the image is required and collect only what the process needs.
  2. Run Passive Liveness. Use the status, score and warnings to accept, retry or review the capture.
  3. Add Face Match when identity binding is required. Compare the selfie with a submitted ID portrait or another trusted reference.
  4. Verify identity details. Use the appropriate ID or document check for the customer and jurisdiction.
  5. Apply risk rules. Add AML/PEP screening, bank-account verification or enhanced due diligence only where your RMCP and risk profile require them.
  6. Keep an auditable decision. Record the check, result, reviewer action and reason for the final outcome.

This separates the signals instead of treating a single biometric score as the whole KYC decision.

Where passive liveness is useful

Passive liveness can add value in:

  • digital account opening;
  • iGaming and age-gated signup;
  • account recovery;
  • high-risk profile changes;
  • remote employee or contractor onboarding; and
  • marketplace, fintech or telecommunications journeys where a selfie is already captured.

The correct placement depends on risk and user impact. Running liveness on every low-risk interaction may add unnecessary friction and biometric processing. Omitting it from a high-risk remote flow may leave an obvious presentation-attack gap.

Limitations to plan for

No liveness system should be described as foolproof. Results can be affected by capture quality, camera conditions and new attack methods. A successful result does not prove that the person owns the identity being presented, and a declined result does not automatically prove fraud.

Production workflows should include:

  • clear capture instructions;
  • retry limits;
  • manual review for uncertain outcomes;
  • an alternative route for users who cannot complete the capture;
  • thresholds tested against the organisation's own risk and user population; and
  • periodic review of false accepts, false declines and abandonment.

Frequently asked questions

Does VerifyNow offer both active and passive liveness?

No. VerifyNow currently offers passive liveness only. Active liveness is explained here so buyers can distinguish the two categories.

Can Passive Liveness replace Face Match?

No. Passive Liveness evaluates whether the capture appears live. Face Match compares the face with a reference image. Use both only when you need both live presence and identity binding.

Can I call Passive Liveness through the API?

Yes. The endpoint accepts a Base64-encoded face image in JSON and returns the status, method, score, face context and warnings. See the Passive Liveness API documentation.

Does Age Estimation need a separate liveness request?

No. Age Estimation already returns a passive-liveness method and score from the same photo. Do not repeat the standalone liveness call unless you are running a separate workflow for a specific reason.

Does a liveness check make us FICA or POPIA compliant?

No technology creates compliance on its own. Under FICA, the check should sit inside a documented, risk-based RMCP. Under POPIA, the responsible party must meet the requirements for processing personal and special personal information.

Add Passive Liveness to your workflow

Use the Passive Liveness service page to review the product scope, then follow the API documentation to test the JSON request in sandbox.

If your journey also needs an age signal, use Age Estimation so one selfie returns both the estimate and passive-liveness signal. For a complete player-onboarding example, see iGaming verification.

Create a VerifyNow account when you are ready to test the workflow.

Official sources