Facial recognition is being used to speed up border crossings, reinforce passkeys and support digital financial services. At the same time, companies are linking biometric data with access rights, risk assessments and government screening systems. Developments in the first half of October 2026 point to a change in the role of biometrics: the question is no longer only whether a system can recognise a face, but who controls the decision that follows.

At an airport, a face scan may shorten the passage through a checkpoint. In a workplace, it can help confirm that the person at a shared computer is the authorised employee. In digital finance, identity checks can influence whether a transaction proceeds. The underlying technology may be similar; its function is changing. Biometric systems are increasingly linked to decisions about access, movement and authority to act.

That shift runs through developments across the sector in early October. Companies are integrating biometrics into broader identity services, public authorities are expanding their use and regulators are tightening evaluation requirements. At the same time, security reviews underline that a strong recognition score alone cannot guarantee reliable operation.

Identity becomes a continuous service

In financial services, identity verification is moving closer to the transaction itself. A check at account opening cannot establish that the authorised customer is still the person accessing the account or initiating a payment months later. Socure is integrating its RiskOS platform into Arc, the blockchain developed by payments company Circle. The initial integration covers users acquiring the digital currency USDC with fiat money through Arc Onramp. Depending on the provider and risk scenario, the process can involve document verification, biometric checks and other controls. RiskOS is intended to bring identity verification, fraud prevention and risk assessment into a common workflow.

The approach treats identity as a continuing requirement rather than a one-off onboarding step. Bringing signals together from different stages of a customer relationship could help identify fraud earlier. It also raises questions about how identity information is linked across services, who can access those connections and what control individuals have over the use of their data.

Seventh Sense is addressing a different problem: a passkey can confirm that a registered device is being used, but not necessarily who is holding it. Its SenseCrypt platform combines a passkey with on-device face verification and a cryptographic proof. The company says it does not retain face images, biometric secrets or reusable facial templates. Instead, the server checks a signed response. The system is intended to verify that the authorised person is present when, for example, a sensitive account change is requested through a company helpdesk.

The approach is aimed in particular at shared workstations in hospitals, factories and retail environments. It could connect a digital login with the physical presence of an employee. The company also acknowledges a limitation: on an unsecured device, a modified browser could imitate a live camera feed. Security therefore depends not only on the biometric process, but also on the integrity of the device and the image-capture path.

Not every development in access management uses biometrics. HID describes an employee credential that can control access to rooms, authenticate a workstation session and release secure print jobs. Permissions should change when an employee moves into a new role and be revoked when that person leaves. The credential itself is not biometric. It illustrates, however, how identity verification is becoming closely connected to access rights: the question is not simply who someone is, but what that person may access and when.

Digital credentials are evolving along similar lines. The 11 member states of ASEAN are working towards interoperable digital identities and verifiable credentials that can be checked across borders. These credentials are designed to allow specific attributes to be shared without disclosing a person’s full identity each time. Thailand is emerging as a regional frontrunner. Demonstrations have shown credentials issued in one country being verified in another within minutes. Open standards including OpenID and mdoc are also being piloted in European countries, US states, India, Japan, Australia and New Zealand.

Technology alone cannot deliver interoperability. Governments must agree on trust frameworks, identity proofing and assurance levels. NIST has launched an implementation hub for its Digital Identity Guidelines, with FAQs, structured conformance criteria and guidance on digital wallets. The hub does not create new requirements or certify providers. It is intended to help agencies and suppliers translate existing requirements into operational systems.

Border controls become more mobile

The expansion of biometrics is particularly visible in air travel. SITA has reached an agreement with RTX to acquire Collins Aerospace Airport Solutions. Collins would bring passenger processing, baggage handling and airport operations systems into SITA’s portfolio, which already includes biometric solutions. The proposed transaction could enable SITA to coordinate more stages of the passenger journey through a broader technology offering. Completion is expected in the first half of 2027, subject to customary conditions; the financial terms have not been disclosed.

New processes are also being tested at land borders. US Customs and Border Protection (CBP) is trialling facial recognition systems from NEC, Paravision and AiFi for pedestrian crossings in Texas. The technology is intended to allow travellers to pass through without stopping at every checkpoint. CBP says its biometric Entry-Exit System has screened the faces of one billion travellers since its launch. Pedestrian crossings nevertheless remain a gap in the system.

Other initiatives show the breadth of deployment. Idemia plans to bring its multi-person facial recognition corridor technology to the Asia-Pacific region; its PaXpress SmartLanes are already being trialled there. Updated e-gates at UK airports are expected to allow returning travellers to use facial recognition without presenting their passports. India plans to require facial recognition checks for airline and airport staff following a recent terrorist incident. In West Africa, the Economic Community of West African States is preparing for mutual recognition of biometric ENBIC identity cards for cross-border travel, with a target set for December.

Government use of biometric information is also extending beyond conventional border checkpoints. In the United States, data collected by Homeland Security Investigations agents, including facial recognition results gathered while observing ICE operations, are being passed to border agents through Palantir software. Agents can use the information for enhanced screening when investigators consider a person a potential operational or safety concern. The International Biometrics and Identity Association has called for expanded biometric screening at land borders while also seeking enforceable limits on profiling. The US House Intelligence Committee has recommended that CBP develop traveller profiles, making the scope and oversight of such profiles a central policy question.

In the UK, the Home Office has set rules for Immigration Enforcement’s use of live facial recognition. Watchlists must relate to a defined purpose, location and period. Deployments must be necessary and proportionate, and a human decision is required before a person is approached or enforcement action is taken. Images of people who do not trigger an alert are to be automatically and permanently deleted. The rules allow deployments not only at ports of entry but also at transport hubs, along travel routes and at events. The Home Office says the false alert rate should generally be no higher than 0.1 per cent in most scenarios. That benchmark alone cannot show how errors are distributed in a specific operating environment or what consequences they may have for individuals.

Online age assurance is also acquiring a firmer legal framework. A US appeals court has overturned a preliminary injunction against Florida’s social media law, allowing it to be enforced while litigation continues. The law bars certain platforms from allowing children under 14 to open accounts and requires parental consent for 14- and 15-year-olds. It does not expressly prescribe a biometric method for age verification. The case nevertheless touches on a broader question for digital identity: how can age be established reliably without collecting more personal data than necessary?

Testing starts before and beyond the camera

The US Department of Homeland Security’s RIVR programme demonstrates the difficulty of reliable document verification. It tests whether software can distinguish genuine identity documents from counterfeits using smartphone images. One evaluation used 2,032 genuine state-issued IDs provided by volunteers, alongside fraudulent documents from investigative sources. The IDs were photographed using devices including an iPhone 14, Google Pixel 7 and Samsung Galaxy S22.

DHS measures false acceptances and rejections as well as processing failures. Results varied according to the smartphone and the issuing state. The test was limited to visible light; specialist document readers and ultraviolet or infrared features were outside its scope. Some high-quality fraudulent documents, DHS says, can be bought for between US$50 and US$100. The department initially used an error rate of 10 per cent or lower as a high-performance benchmark, with a longer-term goal of reducing errors below one per cent. It does not publish a named vendor ranking, although suppliers can use the government-curated test data to identify weaknesses in their systems.

NIST is introducing new entry requirements for its 1 face recognition evaluation. From 30 November, a new participant must first achieve a minimum result in 1:1 verification: on the Visa-Border dataset, the false non-match rate must be no higher than 2.5 per cent at a false match rate of one in a million. This is a prerequisite for entering the evaluation, not a guarantee of strong identification performance. Comparing two faces is a different task from searching a large gallery, and NIST will continue to assess the two separately.

The institute is also adding datasets covering a wider range of cameras, image quality and longer intervals between enrolment and search images. Submissions to both the 1:1 and 1 tracks will be subject to a template-generation limit of less than two seconds per image. NIST plans to pause 1 submissions on 30 October and reopen the evaluation on 30 November with the updated requirements.

In Europe, qualified trust service providers (QTSPs) conducting remote identity proofing must complete biometric testing by the end of 2026 under ETSI TS 119 461. The requirements cover three distinct risks: presentation attacks in front of the camera, manipulated or injected biometric data behind the camera, and the accuracy of the biometric matcher itself. The specification refers to ISO/IEC 19989-3, CEN/TS 18099 and ISO/IEC 19795-1 for the relevant testing. It does not set a single numerical performance threshold for every provider; providers must define and substantiate their performance objectives.

Security extends beyond the recognition score

Two reviews of the US Transportation Security Administration (TSA) draw attention to the organisations operating biometric systems. An inspector general’s audit found weaknesses in the management of privileged user accounts, service accounts created without required approval and delays in disabling accounts belonging to former employees. A separate review had previously identified gaps in oversight of a contractor able to access passenger data in connection with biometric screening equipment. The audits do not establish that the vulnerabilities were exploited or that data were compromised. They do show that biometric protection depends on access management, logging and independent oversight as well as technical performance.

Control of the technology supply chain is becoming a strategic issue, too. US provider ROC aims to bring biometric identification, access control, video analytics and digital evidence together on a single platform. An eight-year US Department of Justice contract, worth up to US$64.3 million, will support a digital evidence review platform operating in the department’s Microsoft Azure environment. ROC CEO Scott Swann is also arguing for greater US technological sovereignty in biometrics. His claims about reliance on foreign suppliers represent a market participant’s position, but they reflect a wider debate over supply chains and control of security-critical AI.

The market is not moving in one direction. SITA is seeking to expand through its proposed acquisition of Collins Aerospace Airport Solutions. Prove has sued start-up KYXStart, alleging patent infringement and interference with contractual relations. Prove accuses former employees of using protected technology in competing identity verification and fraud prevention products. Those claims have not been established by a court. Sensor provider Next Biometrics, meanwhile, announced plans to file for bankruptcy after failing to secure funding for its strategic pivot. The company said it still intended to take its fingerprint technology for display integration to the prototype stage.

The next benchmark is a controllable decision

The direction is clear: biometrics is moving from isolated face checks into interconnected identity services, financial workflows and public screening systems. As these systems become more integrated, the central question is no longer whether an algorithm can recognise a face accurately.

The next phase will depend on three tests. First, independent evaluations such as RIVR, NIST’s programmes and the European ETSI requirements must become meaningful procurement and operational criteria. Second, digital wallets and verifiable credentials must show whether they can establish identity with less repeated data collection; that will require common trust frameworks between governments and providers. Third, control of the infrastructure will matter more: who holds the data, manages permissions, reviews software changes and accepts responsibility when a system fails?

Airports are integrating more stages of the passenger journey, employers are linking physical and digital access, and financial platforms are embedding identity checks in ongoing transactions. Integration alone does not create trust. Trust depends on decisions remaining reviewable, errors being contained and the handling of personal data being subject to effective control. [CN]