Is Remote Biometric Enrollment the Future of Visa Applications?

With trials for a fully remote biometric enrollment solution for visa applications underway that includes fingerprint enrollment, in the first of three articles on visa application outsourcing, Souter Points discusses how remote biometric enrollement technology could impact visa applicants and the visa application outsourcing industry

If you’ve applied for a visa within the last 25 years, the chances are you had to visit a visa application centre (VAC) to do so. Outsourcing the visa application process began with a single visa application centre (VAC) in Mumbai for the US Government in 2001 and has since grown into an industry worth more than USD 4 billion per year globally, with thousands of VACs in virtually every country. 

The way we apply for visas through outsourcers has changed significantly over this time, too.

While there has always been a technology component when applying for a visa, even if that was limited to accessing information on a website or booking an online appointment, for the first half of the visa outsourcing industry’s life, it was still a largely analogue, paper-based process, focused on moving hard-copy documents between visa applicants, visa application centres, and government offices.

Visa applicants would submit their passport and paper copies of supporting documents at a VAC, and the visa application outsourcing company would forward them to government decision-makers for assessment and visa issuance (or rejection). The passport would then come back to the VAC, with the applicant either collecting it in person or paying to have it couriered to their address.

Since the early 2010s, digitisation has played an ever-increasing role in the visa application process, and visa applicants interacting with the United Kingdom’s visa and immigration system have experienced some of the visa outsourcing industry’s world firsts. In fact, it is no exaggeration to say that whatever the UK Government does with its visa application outsourcing approach, the rest of the industry tends to follow around 5-10 years later.

Therefore, if we want to glimpse what the visa application process will look like in the future, it pays to examine what the UK is doing now, particularly regarding remote biometric enrollment. Because, as the below history illustrates, that’s what other major governments will be doing over the next decade.

Where the UK Leads…

The US may have been the first country to outsource the visa application process, but the UK really put the industry on the map and has spearheaded most technological and operating model advancements at scale for almost 20 years, including:

• Outsourcing the visa application process globally;

• Outsourcing the collection of biometric data;

• Introducing fully digital application pathways;

• Outsourcing visa applications domestically;

• Introducing self-service biometric enrollment kiosks;

• Using remote identity verification mobile apps; and

• Introducing e-visas combined with verifying immigration statuses directly using share codes.

And what is currently being trialled by the UK Government in the area of remote biometric enrollment - including fingerprints - looks to be another potential game-changer, especially for visa applicants. But before we get into that, it’s worth considering when the above initiatives were first introduced, and which other national governments followed the UK’s lead.

Global Visa Application Outsourcing and the Outsourced Collection of Biometric Data

The UK was the first national government to outsource the visa application process globally in 2007 (to CSC and VFS Global) and the first to outsource the large-scale collection of biometric data on the same contracts. 

Others followed, with the USA concluding its first global visa application outsourcing contracts in 2009, then Spain in 2011 and Canada in 2012. Today, out of the major destination countries that participate in visa application outsourcing, virtually all outsource on a global scale (notable exceptions being France, Germany, and Italy, although these nations have shifted to regional contracting models), and where biometric data is collected, all governments outsource this process (although the US does so selectively).

Digital Application Pathways

After re-procuring its global visa application outsourcing provision in 2012, in which VFS Global and TLScontact won the contracts, the UK introduced digital application pathways with online visa application forms and online payments for visa and service fees.

Around the same time, Australia introduced a digital application pathway, while the Schengen States, somewhat hamstrung by European legislation that prohibited a fully digital visa application pathway, began to introduce their own digital application routes over the subsequent years. Some of these digital application pathways were provided by national governments (e.g., Germany, France), while others were provided by the visa application outsourcer.

Digital supporting documents were introduced by the UK around 2015 (with some Schengen States, Australia and Canada following), requiring visa applicants to scan and upload their documents to an online portal. The EU Visa Application Portal (EU VAP), due to go live in 2028 (according to industry sources), will fully digitise the Schengen visa application process, aligning all Schengen States with how other countries using fully digital visa application pathways operate the start of their visa application processes.

Domestic Visa Application Outsourcing and Self-service Biometric Enrollment Kiosks

In 2018, two further firsts from the UK were introduced: a nationwide domestic visa application outsourcing contract for in-country visa renewals and extensions, and the use of self-service kiosks for biometric enrollment. 

A network of around 60 VACs was established across the UK for in-country UK visa renewals and extensions, which was, surprisingly, a world first, as all outsourced visa application services contracted by national governments to that point had been based overseas. 

The introduction of self-service biometric enrollment kiosks for visa applications was a significant step towards mitigating the risks associated with unsupervised biometric enrollment in remote scenarios, and the kiosk concept has since been rolled out at the UK’s overseas VACs.

While various national governments have made noises about outsourcing in-country visa renewals, the complexity of the legislation and legacy operating models in many countries makes this considerably more challenging than overseas. And while there is interest in self-service biometric enrollment kiosks, only the UK is using the approach at any meaningful scale.

Remote Identity Verification Mobile Apps

As Brexit approached at the end of the 2010s, the UK Government had to provide a way to issue settled or pre-settled status to European Union nationals under the EU Settlement Scheme. 

Another world-first process was rolled out to capture the identity of EU nationals using a smartphone app, enabling them to enrol in the scheme remotely. It helped that only the individual’s identity required verifying - not their fingerprints enrolling - and the smartphone technology of 2018 was more than capable of verifying their identity, using a general identity verification (GIDV) mobile app, the same type of app used for remote ‘know your customer’ (KYC) verification in financial services.

It’s worth exploring how the GIDV app works, as this technology is likely to form the basis of a fully remote biometric enrollment solution that incorporates fingerprints.

The GIDV app works by deploying a smartphone’s near-field communication (NFC) capability - the same feature used for mobile payments - to scan and read the biographical information and facial image stored on the chip in the user’s biometric passport. 

The app then does two things.

First, it asks the user to undergo a facial liveness check by taking a series of selfies or short videos, and compares the live image with the image extracted from the passport chip to verify that the person applying is the rightful holder of the passport.

Secondly, a similar process is performed on the biographical information (such as name, date of birth, passport number, etc.) extracted from the passport chip, which is cross-referenced against the information entered in the app to verify a match. This biographical data can also be cross-referenced with the information encoded in the machine-readable zone (MRZ) on the passport's biographical details page and, using optical character recognition (OCR), compared with the wording printed on that page.

There are several ways to verify biographical data, and using the immutable data stored on the passport chip as one of the data points provides a high degree of confidence that the passport is genuine and not fraudulent or counterfeit.

After successfully performing these 1:1 matches to confirm that the facial image and biographical details match those stored on the passport chip, the GIDV app binds this information, encrypts it, and securely sends it to the government’s servers.

The same general identity verification (GIDV) process has since been expanded to certain types of UK in-country visa renewals, and some overseas visa applicants known to the UK Government can apply for a UK visa using the GIDV app. 

To date, no other government has introduced remote identity verification at scale for visa applications, as they have either not had a comparable EU Settlement Scheme-type use case upon which to base it, struggle to re-use previously collected biometric identifiers, or don’t apply identity verification to repeat visa applications (e.g. you can apply for as many Schengen visas as you wish but only need to provide your biometric data once every 59 months or if you change your travel document).

The UK’s success with the EU Settlement Scheme, in particular, and the GIDV app, more generally, has given UK government decision-makers the confidence to push remote identity verification and biometric enrollment even further. Especially now that the final piece of the digitisation puzzle has been launched: e-visas and share codes.

E-visas and Share Codes

In the first half of the 2020s, the UK began replacing the Biometric Residence Cards (BRP) issued to foreign national residents with e-visas and introduced ‘share codes’ to enable third parties to verify a visa or immigration status.

If a foreign national resident in the UK now needs to verify their immigration status, either at the UK border or for another purpose, such as renting a flat, applying for a job or opening a bank account, they can do so by obtaining a temporary share code from the UK Government’s gov.uk website and having the requesting party plug it into the same website to check the individual’s immigration status. 

The share code setup is a clever way to ensure that an individual's immigration status or visa is valid, as it is verified directly with the issuing authority, making it more secure than an e-visa issued by email. A similar ‘share code-type’ setup will be used with the new Schengen digital visa when it’s introduced in 2028, using a cryptographically signed QR code issued via email to replace the physical visa vignette, which can be scanned by the requesting authority to verify the individual’s immigration status. 

With such e-visa and immigration status verification processes, the key benefit is that government decision-makers no longer need to see a physical passport, paving the way for an end-to-end remote visa application process.

Which takes us to 2026 and to another potentially game-changing initiative by the UK Government: a trial of remote biometric enrollment, including fingerprints, to determine whether VACs will be needed in the future at all. 

This is where BRET comes in.

Biometric Remote Enrolment Technology

BRET - or Biometric Remote Enrolment Technology - is a trial the UK Government is currently conducting to determine if it’s possible to offer a 100% remote biometric enrollment service that produces an acceptable quality of fingerprint scan while providing a high degree of confidence that the fingerprints captured are indeed the legitimate fingerprints of the user. If BRET is successful, it could mean the end of VACs as we know them, with visa applicants worldwide potentially able to apply via a mobile app from anywhere with an internet connection.

BRET builds on the EU Settlement Scheme mentioned above, in which more than 8.4 million users registered their identity, demonstrating that it is possible to apply for a visa or visa-like status remotely and provide the government with a high degree of confidence that the identity bound to the application is legitimate. 

Furthermore, the decade-long experience with digital application pathways, the trust gained from the widespread deployment of self-service biometric enrollment kiosks, and the shift to e-visas and share codes mean the UK is highly experienced in managing the individual components of a fully remote visa application process and biometric enrollment system. BRET is a continuation of this approach, aimed at solving the final piece of the puzzle - remote fingerprint enrollment.

The Problem with Fingerprints

At this stage, it’s natural to have two burning questions. 

First, “why fingerprints?”

And second, “but my smartphone has used fingerprint technology to let me open it and pay for stuff for more than a decade, surely capturing fingerprints for visa applications can’t be that hard?”

These are two very valid questions, each with a relatively blunt answer.

Why Fingerprints?

When you apply for a visa, your biometric data (including fingerprints) are checked against government databases to see if there are any matches. This may include immigration databases, police records, and databases held by the FBI, Interpol, or similar organisations.

Fingerprints have been used for over 100 years in crime prevention, and by some accounts are the most common type of evidence left behind at a crime scene (you can’t exactly leave an imprint of your ear behind on a fragment of an exploded bomb or the handle of a gun). Therefore, governments want to collect your fingerprints to know if you’ve been implicated in a crime or have overstayed a previous visa.

Smartphone Technology

The “smartphone technology” question is also a good one, but focusing on the technology is a bit of a red herring. 

It’s not the technology that’s the issue - you can obtain passable fingerprint scans from slaps on a smartphone screen and even from images shot with the camera - it’s more to do with the fact that there’s currently no way of an independent party knowing with any degree of confidence that the fingerprints I’m attempting to enrol on my smartphone are actually my fingerprints. I could quite easily use my passport, my biographical information, my facial image, but your hand to enrol my fingerprints, and it’s extremely difficult to know for sure that I didn’t do this in a remote, completely unsupervised environment.

It’s equally hard to be sure that I haven’t tampered with my fingerprints, Mission Impossible-style, using latex coverings or other materials.

Once fingerprints are bound to an identity, they become impossible to unbind (i.e. the point of the identity verification process). And the various organisations that use fingerprints can run into significant problems if Person A’s fingerprints end up on a murder weapon or are found at a terrorist hideout, when in fact they’d been incorrectly bound to Person B’s identity.

GIDV apps also introduce usability challenges, as not everyone owns a smartphone (or one compatible with a GIDV-type app), and many people may lack the required level of digital literacy or trust to use one. 

Then you have use cases for those exceptions that, if used nefariously, can create havoc with the identity verification process. A simple example is how to manage situations where the user is missing a digit - or a limb - and how to prove that fact remotely in a sensible way.

If I’ve been a naughty boy and left my fingerprints behind somewhere I shouldn’t have been, I could simply claim I’m missing my right arm and skip enrolling my dominant hand to avoid a database hit. Remote identity verification needs a way to address this situation sensitively, as some people will have missing digits or limbs that require genuine accommodations.

And what if a user legitimately cannot enrol a digit or limb temporarily due to, say, a broken finger or hand? There are many exceptional use cases to consider.

Therefore, any solution BRET proposes will need to address these challenges comprehensively and to a level of confidence acceptable to the UK Government.

Potential BRET Solutions

The approach taken by the UK Government with BRET is sensible, as it puts these questions back to industry experts to develop solutions. At this stage, the UK Government isn’t procuring anything and hasn’t forced a solution on the industry. It is simply determining whether remote fingerprint enrollment is feasible to a level of confidence acceptable for making a visa application.

The BRET team have been emphatic that they don’t want a visa applicant to have to ‘go anywhere’. The idea is that you can apply for a UK visa 100% remotely - at home, your office, or wherever you choose.

So, what could BRET solutions look like?

Dual Screens

Using dual screens is one possibility. 

Visa applicants could use a GIDV-type app on their smartphone to perform the biometric enrollment while using a second screen - such as a laptop or tablet - to record the process on a webcam. This ensures the user is alone and provides a high level of confidence that the enrolled fingerprints are indeed the applicant's.

Having the user go through a ritual that would evidence any attempt at spoofing before enrollment may also address the ‘Mission Impossible-style latex fingerprint’ issue.

Clearly, such recordings will need to be reviewed. A combination of artificial intelligence and human reviews could flag any anomalies, with an option to call the applicant in to a VAC or other government office if needed.

A dual screen setup is also potentially clunky, having to synchronise what’s happening on a smartphone with a video recording on another device, and it doesn’t exactly scream ‘easy to use’ to those for whom technology can be complicated.

Digital Countersigning

Another way to perform the fingerprint scan remotely, with high confidence in the integrity of the process, is for the applicant to complete the activity in the presence of an authorised individual. 

The UK still accepts countersignatures on documents from individuals who hold certain legal or community positions, such as company directors, physicians, teachers, and others. Fingerprint enrollments could therefore be performed in the presence of such individuals, with a type of ‘digital countersignature’ used to authenticate the enrolment by expanding the functionality of the GIDV app.

The two major drawbacks of this approach are that the visa applicant probably needs to ‘go somewhere’, which runs counter to the BRET aim of being 100% remote, and that there either needs to be a great degree of trust placed in the ‘countersigning’ individual, or another way of verifying their identity and competence. While not showstoppers, this adds to the complexity of the process.

Biometric Enrollment Pods

If we could relax the requirement to not ‘go anywhere’, could we ask the visa applicant to visit a secure ‘biometric enrollment pod’? Cheaper than a VAC and modelled on self-service biometric kiosks already in use, enrollment pods could be located throughout a country, allowing applicants to book a timeslot, enter, and perform a biometric enrollment using their smartphone while under independent CCTV surveillance. The same AI- or human-based video screening outlined above for dual screens could then be used to ensure that enrollment was completed correctly.

This is the solution we proposed in our 2023 report, 'Visa Application Outsourcing - the Impact of Digitisation on Operating Models, Profitability, and Competition'.

It is not a purely biometric remote enrollment technology, but the potential ubiquity of such a network could make biometric enrollment pods as common as passport photo machines.

Self-sovereign Identity

Finally, self-sovereign identity was a popular concept several years ago, with individuals hosting their credentials in a secure digital wallet tied to a blockchain for immutability. Whenever a third party needed to verify any information, the individual could grant that party access to the relevant part of their data. 

In theory, this sounds sensible, but there are challenges, the major one being that any biometric data must be enrolled under environmental and processing conditions acceptable to a government for the purpose of applying for a visa in the first place. This takes us back to square one, forcing us to find a way to do this remotely while maintaining an acceptable level of confidence. Therefore, self-sovereign identity just indirectly creates the same issues that BRET is trying to address directly.

Will BRET Succeed?

Maybe after all is said and done, the BRET trials will indicate that it’s currently not possible to have sufficient confidence in a 100% remote biometric enrollment service that includes fingerprints.

But if the UK Government gets BRET to work, it will revolutionise the global visa application outsourcing industry. 

Physical VAC networks will no longer be required - at least in the number and size as today -  as visa application activities will be completed remotely, online. For incumbent visa application outsourcing companies, the competitive advantage they derive from their VAC networks will evaporate. 

While many major VAC operators can develop GIDV-type apps, they’ll need to compete with other digital technology companies, many of which have years of experience providing similar technologies to the financial services industry. 

And the industry's value will also crater, as average service fee revenue per visa applicant drops from around USD 40 to around USD 5, according to our recent pricing estimates. 

Because where the UK leads, as the above potted history of the visa application outsourcing industry teaches us, other governments will follow.

The Future of Visa Applications?

So will we soon be able to apply for a visa for any country from the comfort of our own home, using nothing but a smartphone connected to the internet? That’s certainly an exciting prospect, and one that could completely upend the way the visa application outsourcing industry has worked for 25 years.

Since 2007, the UK has led the global large-scale adoption of digital technologies and new operating models, and, with the BRET trials for remote fingerprint enrollment, it is poised to do so again.

If BRET works, the visa application experience for users will improve markedly - no more travelling to VACs - and those unable or unwilling to use a mobile app or website will indeed find support in the world of visa agents.

In a world that doesn’t require a global VAC network, the visa application outsourcing industry will look very different from what it does today. Without physical infrastructure in dozens of countries, incumbent VAC operators will see their operating models, revenue models, profits and competitive positioning all significantly impacted. 

If the UK’s BRET trial is successful and commercially deployed in the late 2020s, based on past experience, we expect remote biometric enrollment to become part of other governments’ visa application outsourcing operating models between 2030 and 2035.

With the publication of the first EU Visa Strategy in January 2026 to create a forum for long-term EU/ Schengen visa thinking, and after the EU VAP and digital visa systems come online between 2028 and 2034, this is a sensible timeframe for the likes of the Schengen States to introduce such a technology, Other governments, such as Australia and Canada, could well follow around the same time.

Assuming, of course, that BRET finds a solution to the ‘remote fingerprint enrollment’ conundrum in the first place.

Souter Point provides consulting services to governments and private-sector businesses in the visa and immigration space, including strategic advice, research, and sales support, such as bid management and new market-entry strategy development. We also work with management consultancies, institutional investors and other interested parties to help them gain a clear understanding of how the global visas and immigration industry operates. If you’d like to learn more about what’s happening in the visa and immigration space and where it might lead, please send us an email at gri@souterpoint.com, and we can schedule a call to discuss your needs.