Banks notify customers about data transfer to the Unified Biometric System

Bank customers who had previously submitted biometrics began to be notified about the transfer of data to the state Unified Biometric System (GIS EBS). In total, as part of the import, the state system can receive 75 million samples. However, customers have the right to refuse to transfer their data, it is not yet possible to estimate how many people will use this.

As Kommersant found out, Sberbank, the largest in terms of the amount of biometrics collected on its own, began notifying customers last week about the transfer of data to the EBS GIS. Banks must transfer data from their systems to the state system by September 30, 2023, and notify the client 30 days before transferring the data.

“This will not affect banking services, and access to government services will be simplified,” the Sberbank notice says. He began informing clients on June 22, clarified “Kommersant” in the press service: “Clients are sent SMS or push notifications informing about the transfer of data to the EBS, and if the client does not mind, after 30 days the data will be transferred to the EBS via a secure channel in automatic mode”. A citizen has the right to refuse to transfer data to the EBS, for this it is necessary to notify the bank. If the client does not approve the transfer of data, they will be deleted from the Sberbank system, the bank specified.

Now it is forbidden for banks and other organizations to collect biometrics in commercial systems. You can submit data to the EBS in 13.1 thousand branches of 177 banks. It is also possible to submit biometrics through the State Services Biometrics mobile application. In the future, it is planned to provide the possibility of submitting biometrics through the MFC.

According to the Center for Biometric Technologies (CBT, acts as the EBS operator), published in April, about 75 million samples have been accumulated in commercial systems (these are exclusively facial images). More than 30 million of these records belong to Sberbank.

As Vladislav Povolotsky, general director of the CBT, explained to Kommersant, each of the exporters has its own schedule for the transfer of biometrics. According to him, the center has been working with banks and other organizations since last year to prepare imports. “Interested organizations have already connected or are in the process of connecting to the EBS GIS test environment. They carry out tests of the functionality and technical feasibility of transferring samples. As part of the tests, real customer data is not processed or transmitted, ”explains Mr. Povolotsky.

“Currently, banks are finalizing their own information systems in the part necessary for transferring citizens’ biometric data to the EBS GIS, testing vector interaction with the state system, completing the development of services that are needed to notify customers about the transfer of biometric data and obtaining their consent, and other preparatory work,” the Central Bank said.

In VTB and RSHB, Kommersant reported that they were participating in the work on testing the transfer of casts to the EBS. “The notification and the possibility of refusal starts 30 days before the transfer to the EBS GIS, this process will be launched after testing,” VTB explained. The RSHB added that “with the successful and complete completion of all established tasks at the testing stage, both the bank and the EBS operator will have to prepare biometric systems for an industrial solution and check its performance before starting the main transfer of impressions.”

The RSHB believes that it is now difficult to predict the potential number of objections from customers to the placement of their biometric casts in the EBS. Positive Technologies information security consultant Aleksey Lukatsky draws attention to the fact that the only convenience of the EBS is that all data will now be stored in one place, but this is also “the weak link in this whole scheme.” “Everyone refers to the fact that no one hacked the EBS. But there were few customers within the EBS – hundreds of thousands. When there are tens of millions of data in the EBS, the situation can change dramatically,” the expert explains.

Mr. Lukatsky clarifies that initially it was assumed that there would be a state system and a commercial one, and the client himself would choose between them. However, the approach has changed after the statement by Russian President Vladimir Putin in the fall of 2021 that biometric data must be stored in a single state system. According to Mr. Lukatsky, the banks themselves have not previously discredited themselves with any leaks of customer biometrics.

Olga Sherunkova