S.L. 426.4 Art. 5Risk assessment and risk management.

(1) Prior to the adoption of a remote identification procedure a qualified trust service provider shall:

(a) carry out and thoroughly document a risk analysis in accordance with Article 19(1) of the eIDAS Regulation with regard to the implementation of the identification of individuals through remote identification procedures. Such risk analysis shall in particular identify:

(i) the risk of mistaken identification and impersonation,

(ii) the risks related to the presentation of falsified or counterfeited documents, and

(iii) the risks related to the tampering of image capturing systems or of communication channels; and

(b) carry out tests of the effectiveness and of the safety of the implemented remote identification method;

(c) carry out an internal assessment of the adequacy of the remote identification method used to mitigate the risks identified in the risk analysis:

Provided that within the context of any such assessment, efficiency of identifying the aforesaid risks shall be at least equivalent to the physical presentation of the identity document.

(2) Any analysis, test or opinion however so described made under this regulation shall be recorded and logged for a minimum period of three years or any such longer period as the Authority may consider appropriate in the circumstances.