Regulatory Audit | eKYC | Remote Customer Onboarding
Electronic Customer Identification & Verification Compliance Audit
Independent assessment against the National Bank of Georgia's Order №104/04, covering electronic identification and verification technologies, information security, operational and cyber risks, outsourced service providers and internal controls.
Why an Independent Audit Matters
Before introducing or changing the electronic due diligence process, an accountable entity must seek written NBG consent and submit the Annex №2 form with an independent audit conclusion. Article 3(8) separately requires annual independent information security process audits and penetration testing; these are distinct activities with separately agreed scopes.
- Identity fraud, impersonation and weak liveness detection
- Forged documents or inaccurate verification
- Uncontrolled vendor access and customer-data retention
- Cyber incidents, operational disruption and insufficient audit evidence
Who Is This Service For?
The rule may apply to NBG-supervised accountable entities using electronic customer due diligence. Applicability depends on each organization's regulatory status and activities; being a FinTech alone does not establish that the rule applies.
- Commercial banks and microbanks
- Microfinance organizations
- Payment service providers
- Virtual asset service providers, where applicable
- Other NBG-supervised accountable entities
Electronic Identification Audit Scope
We map the applicable provisions of Order №104/04 to the agreed process, technology, evidence and outsourced dependencies. Technical testing is selected by risk and scope; this audit does not certify biometric software.
- 01
Regulatory compliance and governance
Articles 1–3; applicability, procedures, responsibilities, approval, change management and confirmation documentation.
- 02
Customer identification and verification
Articles 2 and 4; identity checks, liveness, biometrics, document authenticity, OCR/NFC, integrations, failed attempts and accuracy evidence.
- 03
Remote onboarding security
secure channels, session continuity, workflow integrity, impersonation defenses and interrupted sessions.
- 04
Operational risk
Annex №3; fraud, outages, human error, outsourcing, likelihood, impact, mitigations and residual risk under the applicable model.
- 05
Cybersecurity risk
Annex №2; confidentiality, integrity, availability, threat scenarios, security controls and treatment priorities.
- 06
Outsourcing and third parties
Article 3 and Annex №2; vendor diligence, contracts, independent evidence, access, retention, deletion and continuity. Entity duties and vendor evidence are assessed separately.
- 07
Information security
agreed mapping of access, encryption, logging, storage, monitoring, vulnerabilities, incident response, recovery and change controls.
- 08
Personal data and retention
Article 3 and Annex №2; minimization, storage, vendor-side retention restrictions, deletion, confidentiality and transfers.
- 09
Process testing and quality assurance
Article 4; sampled liveness and document checks, manual review, four-eyes controls, training and session evidence.
- 10
Continuity and termination
Articles 3, 4 and 6; availability, interruptions, escalation, suspension, notification and recovery arrangements.
Types of Audit Engagements
The evidence and deliverables depend on the selected engagement. Penetration testing is a distinct activity and is included only when separately scoped.
- 01
Pre-implementation audit
independent assessment before introducing the process or regulatory submission.
- 02
Change-related assessment
review of material changes to technology, providers, process or controls, where applicable.
- 03
Annual information security audit
independent review of information security processes under Article 3(8).
Our Audit Approach
- 01
Planning and scope
identify requirements, systems, providers and boundaries.
- 02
Compliance mapping
connect applicable requirements to policies, processes and controls.
- 03
Evidence review
inspect documents, risk assessments, configurations and technical records.
- 04
Technical and operational testing
test selected controls and verification workflows.
- 05
Gap and risk assessment
document non-compliance, weaknesses and residual risks.
- 06
Report and recommendations
issue the independent report and prioritized actions.
Audit Deliverables
Final deliverables are agreed for the engagement and may differ between compliance, information security and follow-up assessments.
- 01
Independent regulatory compliance audit report
assessment against applicable requirements.
- 02
Article-by-article compliance matrix
controls and supporting evidence.
- 03
Information security findings register
technical and organizational deficiencies.
- 04
Operational and cyber risk results
assessment or review under the agreed scope.
- 05
Third-party assessment
outsourced providers and contractual dependencies.
- 06
Corrective action plan
prioritized recommendations and proposed ownership.
- 07
Executive summary
material findings and management decisions.
- 08
Optional follow-up
independent check of remediation progress.
Why IO Consulting?
Our work combines financial-sector regulatory analysis, technical controls and operational risk. We document evidence, distinguish audit findings from recommendations and communicate priorities to management. We do not represent an official NBG approval or accreditation.
- Independent, evidence-based procedures
- Regulatory and technical perspective
- Risk-based corrective actions
- Management-level reporting
Business Value
The assessment supports better decisions and preparation for supervisory review; it cannot guarantee NBG approval or remove every regulatory risk.
- Find compliance gaps before launch
- Improve identity and fraud controls
- Understand outsourced technology and cyber risk
- Strengthen evidence and operational resilience
- Prioritize remediation investments
Regulatory Reference
National Bank of Georgia President's Order №104/04 of 29 April 2025, approving the rule on electronically performing preventive measures by accountable entities. Requirements must be checked against the applicable consolidated text before an engagement begins.
Official regulation — Legislative Herald of GeorgiaFrequently Asked Questions
What is electronic customer identification and verification?
It is a remote process for establishing and checking customer identity using approved electronic procedures and supporting controls. The applicable rule governs how accountable entities may carry out relevant due diligence measures electronically.
Who is subject to Order №104/04?
Applicability depends on whether an organization is an accountable entity under NBG supervision and uses the regulated electronic process. It must be assessed against its status and activities.
When is an independent audit needed?
Article 3(1) requires an independent conclusion with the Annex №2 form when an accountable entity seeks written NBG consent before introducing or changing the process. The precise evidence follows the current rule and the organization's situation.
Is the annual information security audit separate?
Yes. Article 3(8) addresses an annual independent audit of information security processes. Its scope is agreed separately from the pre-implementation compliance assessment.
Does this audit automatically include penetration testing?
No. Penetration testing is distinct from compliance and information security auditing. It may be included or commissioned separately under an explicit scope.
Which technical controls are reviewed?
Depending on scope, we review identity checks, liveness, document verification, access, encryption, logging, monitoring, incident response, continuity and supporting evidence.
What vendor evidence is considered?
Relevant contracts, due diligence, security assurance, testing reports, access logs, retention and deletion controls, and continuity evidence are considered where applicable.
What happens to customer data held by a vendor?
We review applicable storage and retention restrictions, access, deletion and data-flow evidence. The exact obligation depends on the vendor arrangement and current rule.
How are operational and cyber risks assessed?
We review the applicable Annex №3 operational risk model and Annex №2 cyber-risk evidence, then assess scenarios, likelihood, impact, mitigations and residual risk within the engagement scope.
What is in the final report?
The agreed report records applicable criteria, tested evidence, findings, risk ratings and prioritized corrective actions. Other deliverables depend on the engagement.
Can the audit take place before launch?
Yes. A pre-implementation engagement evaluates the proposed process, its controls and supporting evidence before launch or regulatory submission.
What if gaps are identified?
We document the finding and propose risk-based remediation. The organization owns corrective action and any required regulatory interaction; an audit does not guarantee approval.
Assess Your Electronic Customer Identification Compliance
IO Consulting provides independent audits against NBG Order №104/04, covering remote identification technology, information security, operational and cyber risks, and outsourced service controls.
Request an Audit