Welcome to ID Tech’s digest of identity industry news. Here’s what you need to know about the world of digital identity and biometrics today:
Hong Kong Police to Add AI Facial Recognition to SmartView CCTV Network This Month
The Hong Kong Police Force is preparing to activate AI facial recognition across its SmartView CCTV network as early as November, equipping officers with retrospective search capabilities and real-time tracking alerts for criminal suspects and high-risk missing persons. Currently operating 10,000 police cameras and integrating feeds from 10,000 additional government and public sites, the network is projected to expand to 66,500 cameras by 2031, with senior officers requiring inspector-level sign-off before utilizing the technology, which retains facial capture data and metadata for 180 days in accordance with internal privacy impact assessments.
FINRA Fines Webull $4.2 Million Over Identity Failures, Including Accounts Approved on Landscape Photos
The Financial Industry Regulatory Authority has fined Webull Financial $4.2 million after discovering the brokerage firm approved over 120,000 new accounts between January 2020 and September 2023 without reasonably verifying customer identities. Utilizing third-party verification vendors during a period of rapid growth, Webull’s deficient compliance programs approved accounts for foreign nationals sharing IP addresses, customers flagged as deceased in internal systems, and more than 50 individuals who uploaded photos of scenic landscapes instead of government-issued ID, while concurrently failing to detect 473 unauthorized ACH transfers totaling over $1.5 million.
Spain’s Electoral Board Clears MiDNI Digital ID for Nov. 29 Vote After Interior Promises QR Readers
Spain’s Central Electoral Board has officially authorized the use of the MiDNI digital identity app for the November 29 general election following commitments from the Interior Ministry to equip all 60,000 polling stations with dedicated QR code readers. Lifting a prior suspension imposed over security concerns, the mandate requires postal operator Correos to deliver verification devices so polling staff can authenticate temporary, National Police-signed QR codes generated on voters’ smartphones, prompting the Iustitia Europa party to file an urgent Supreme Court appeal questioning technical contingencies in the event of connectivity or hardware failures.
DigiCert Discloses Unauthorized Access to Customer Data, Including Some Passports and Driver’s Licenses
Certificate authority DigiCert has confirmed a data exposure incident where an unauthorized read-only account accessed archived customer information, including driver’s licenses, passports, and utility bills submitted by customer representatives for identity validation. The breach stemmed from a February 2025 infrastructure migration that inadvertently exposed an internal registration system without multi-factor authentication requirements, allowing external access to business contact details and validation documents between June 27 and July 2, 2026, though DigiCert maintains that no certificates were issued or revoked and its CertCentral services remain secure.
Canada’s Budget Funds Traveller Biometrics Strategy and Facial Images for eTA Applicants
Canada’s 2026 federal budget allocates significant funding to modernize border security, including C$4.3 million for Transport Canada to develop a comprehensive Traveller Biometrics Strategy utilizing digital credentials alongside a new Special Advisor. The budget also proposes C$90 million for Immigration, Refugees and Citizenship Canada to mandate remote facial image submissions for visa-exempt travelers applying for electronic Travel Authorizations, and C$192.5 million for the Canada Border Services Agency to stabilize critical border technology infrastructure, measures strongly supported by the Canadian Airports Council following successful e-gate pilots at Toronto Pearson.
Mexico’s Digital Economy Law Takes Effect, Recognizing CURP Digital for Financial Services
Mexico has enacted the Digital Economy Law for Digital and Electronic Payments, establishing the biometric CURP Digital as a legally recognized trust mechanism for onboarding financial services online. Mandating that financial institutions—including banks, credit unions, and fintechs—accept the new Citizen Digital File containing government-held personal data, the legislation aims to reduce cash reliance and streamline verification processes, requiring citizens to register fingerprints and photographs with population authorities to activate their official digital identity through the Agency for Digital Transformation and Telecommunications.
New Lawsuits, Hearings and Bills Show Social Media Age Limits Are Far From Settled
Global legislative efforts to restrict underage social media access face escalating legal and technical friction, highlighted this week by Meta, Google, and TikTok suing California over Assembly Bill 1709’s mandate to verify user ages via operating systems before providing addictive features. The lawsuits coincide with the Australian High Court reserving judgment on challenges to a federal under-16 ban, Kenya publishing an Online Safety Bill threatening 10 percent global turnover fines for platforms lacking highly effective age estimation, and UK regulator Ofcom confirming that Snapchat expects to implement robust age checks for under-18 users by the end of the year.
New Launches Split AI Agent Trust Into Three Checks: The Agent, the Human and the Action
The cybersecurity industry is actively fragmenting the challenge of authenticating autonomous software, as evidenced by three distinct AI agent verification launches addressing identity, human oversight, and authorization constraints. Arkose Labs expanded its Agent Trust Manager to assign stable identifiers to evasive bots across network rotations, Sardine introduced a merchant protocol linking agent cloud browsers to a human customer’s IP address and device fingerprint at checkout, and stealth startup Kihan debuted a Constitutional Computing architecture that requires verifiable cryptographic permits before an agent can execute consequential protected actions.
Dominican Republic Bars Mass Biometric Identification in Public Spaces Without a Court Order
Dominican Republic President Luis Abinader has signed Decree 787-26, establishing an Artificial Intelligence Ethics Code that strictly prohibits public-sector deployment of mass biometric identification in public spaces without a specific court order. Governing all centralized and decentralized state institutions, the UNESCO-aligned rules ban indiscriminate facial, voice, and gait recognition alongside predictive criminal profiling, requiring independent Ethical and Rights Impact Assessments for any high-impact AI systems affecting civil rights, while mandating that government procurement contracts guarantee sovereign data control and reject unauditable “black box” algorithms.
BankID to Join Sweden Connect as State-Issued SverigeID Prepares for December Launch
Sweden’s leading commercial e-identification service, BankID, has agreed to integrate directly with the Sweden Connect national infrastructure, enabling municipalities and government agencies to access multiple digital credentials through a single OpenID Connect connection. Coordinated by the Agency for Digital Government (Digg), the integration simplifies technical onboarding for public bodies just weeks before the Swedish Police Authority launches the state-issued SverigeID on December 1, a high-security mobile credential tied strictly to new national physical ID cards for citizens and residents aged nine and older.
–
By the ID Tech Editorial Team