Biometrics are "body measurements and calculations related to human characteristics and features". Computing uses them for identification and access control. In finance, they promise strong checks with less friction. They also raise hard questions. Which trait, stored how, with what fallback?
This guide explains how biometric authentication works. It covers standards guidance and exam expectations in plain terms. It is general information, not legal advice. Check the current text of any standard before you rely on it.
Two Modes, One Enrollment
Two modes matter here. Verification makes "a one-to-one comparison of a captured biometric with a specific template". It answers one question. Are you who you claim to be?
The second mode is different. It runs "a one-to-many comparison against a biometric database". The goal is to name an unknown person. Banks mostly need the first mode. This connects to our earlier piece, GDPR Article 22 and Fraud Models: When Automated Decisions Need Human Review in the EU.
Why does this matter for money? Identity errors cost real sums. A strong trait check cuts fraud at the door. It also cuts the cost of fixing mistakes later. Readers following this should also see NIST SP 800-63-4 and Passkeys: Identity Assurance Levels for Regulated Account Onboarding.
Everything starts with enrollment. That is the first capture of a person's trait. It anchors every later match, so quality matters. Storage security matters just as much. The biometrics overview warns that storage and retrieval must be secure, or the system is not robust.
What Makes a Trait Fit for Purpose
Not every trait suits every job. Classic research lists seven factors to weigh. These are universality, uniqueness, permanence, measurability, performance, acceptability, and circumvention. A few deserve plain words. Permanence tracks how a trait drifts over time. Circumvention asks how easily an impostor could fake it. Acceptability asks whether people will enroll at all.
The field's own summary is blunt. "No single biometric will meet all the requirements of every possible application." Fingerprints, face, iris, and voice each trade ease against strength. Pick per use case, and write down why.
Keep the baseline in mind. Unique traits beat tokens and passwords for reliability. Yet "the collection of biometric identifiers raises privacy concerns". Plan for both facts at once.
What NIST Guidance Actually Says
The main United States standards body is NIST. Per the multi-factor authentication overview, "NIST Special Publication 800-63-3 discusses various forms of two-factor authentication". It also "provides guidance on using them in business processes requiring different levels of assurance". That phrase is the heart of it. Stronger actions deserve stronger proof of identity.
Guidance moves with the threats. In July 2016, a NIST draft proposed dropping SMS verification. The final version a year later kept SMS as valid. The lesson is simple. Cite the current version, not a memory of it.
Banking examiners ask for the same rigor. In 2005, the FFIEC told United States firms to run "risk-based assessments", build "customer awareness programs", and set sound security measures. That risk-based habit never left the exam playbook.
What Exams Tend to Probe
Expect questions that mirror those seven factors. How accurate is the match, and how often does it fail? What happens when the sensor misreads a trait? Is there a fallback path, and is it weaker? Where are templates stored, and who can reach them? Did customers consent, and do they know the uses?
None of this needs a laboratory. It needs the same discipline as any control. Define the trait, the threshold, and the fallback. Store templates with care. Keep the file that shows all three.
Conclusion: Match the Trait to the Risk
Biometrics earn their place when they fit the job. Weigh permanence, performance, acceptability, and circumvention before you deploy. Tie the choice to a written risk decision. Then keep watching, because guidance and attacks both move. This article is general information, not legal advice about authentication choices.
