ISO 19092:2023

Overview

ISO 19092:2023 - Financial services - Biometrics - Security framework defines a security framework for using biometrics to authenticate customers in financial services, with a specific focus on retail payments. The standard introduces common biometric technologies, describes representative implementation architectures, and sets out minimum control objectives for secure biometric authentication throughout the biometric lifecycle (enrolment, transmission, storage, verification/identification, termination).

Keywords: ISO 19092:2023, biometrics, financial services, security framework, retail payments, biometric authentication

Key topics and technical requirements

ISO 19092:2023 covers technical and security topics relevant to financial biometric systems, including:

• Biometric modalities - overview of common modalities such as fingerprints, face, voice, iris, signature, vein, palm print and keystroke patterns and their practical properties.
• Biometric lifecycle management - security controls across enrolment, transmission, storage, verification, identification, re-enrolment, refinement, suspension/reactivation, termination and archiving.
• Architectures - conceptual business and technical architectures, registration architectures and representative biometric authentication architectures (including PBP devices - Points of Biometric Presentation).
• Threats, vulnerabilities and controls - presentation attack vulnerabilities (including synthetic attacks), comparison/decision/storage subsystem risks, calibration and fault injection issues, and required mitigations.
• Security requirements - physical and logical security, identity registration controls, data storage and handling (including reference splitting), comparison/decision security, and security compliance verification.
• Usability and performance - recognition performance, performance evaluation, interoperability and presentation attack detection considerations.

Keywords: biometric modalities, biometric lifecycle, presentation attack, PBP devices, recognition performance, data storage

Practical applications and users

ISO 19092:2023 is intended for organizations implementing or governing biometric authentication for retail financial transactions, including:

• Banks, payment service providers and fintechs deploying biometric login or payment authentication
• Vendors and integrators of biometric capture devices and authentication platforms (PBP device manufacturers)
• Security architects, risk and compliance teams defining controls and policies for biometric systems
• Auditors and regulators assessing biometric security in retail payment ecosystems

Adopting ISO 19092 helps improve security posture, reduce fraud risks from biometric attacks, and align implementations with recognized minimum control objectives.

Related standards

ISO 19092 complements broader standards in identity management, payments and information security. For comprehensive compliance, implementers should also consider applicable data protection and payment-industry security requirements alongside ISO 19092:2023.

Keywords: biometric security standard, retail payment authentication, ISO biometrics, financial biometrics security