6.3 RON Identity Proofing, KBA, Audio-Video Standards, Recordings & Audit Trails

In a remote session, the notary cannot hold the ID card or look the signer in the eye across a desk. Missouri replaces those steps with technology-assisted identity verification and a recording of the whole act. The statute sets the framework in Sections 486.1145 and 486.1180-486.1205; the details are in the Secretary's rules, 15 CSR 30-110.040 to 30-110.080, which took effect February 28, 2021.

Satisfactory Evidence in a Remote Session (Section 486.1145)

A remote online notary has satisfactory evidence of a person's identity if the notary confirms it by:

1. personal knowledge of the identity;
2. each of the following, if approved by rule:
   • remote presentation of an identification credential, such as a passport or driver's license, that contains the person's photograph and signature;
   • credential analysis; and
   • identity proofing of the person;
3. any other method that complies with the Secretary's rules; or
4. a valid certificate that complies with the Secretary's rules.

Credential analysis is a process or service meeting the Secretary's standards, through which a third person affirms the validity of an ID credential. Identity proofing is a process or service operating under standards the Secretary sets by rule (Section 486.1100(3), (8)).

What Approved Software Must Provide (15 CSR 30-110.040)

RON software must:

• allow at least two of these authentications: (1) credential analysis of government-issued ID, (2) dynamic knowledge-based authentication (KBA), and (3) biometrics;
• provide a live session using audio-video communication integrated with electronic document processing;
• capture the details the notary needs to keep an accurate record; and
• provide an audit trail for each session.

Credential Analysis Standards (15 CSR 30-110.050)

• Providers must use automated software processes to help the notary verify each principal's identity.
• The credential must pass an authenticity test that checks visual, physical, or cryptographic security features, confirms the credential is not fraudulent or improperly modified, uses issuing-source data where available, and gives the result to the notary.
• The notary must be able to visually compare the credential's information and photo with the principal as seen live on video.
• The credential must be a government-issued document that can lawfully be imaged and analyzed.
• Image capture must confirm the principal possesses the credential at the time, the image is not manipulated, and it matches the credential in hand.
• All needed images must be captured, for example the identity page of a U.S. passport, or the front and back of a driver's license.

Knowledge-Based Authentication (15 CSR 30-110.050(7))

Biometric sensing technology includes, but is not limited to, facial, voice, and fingerprint recognition.

Audio-Video Quality (15 CSR 30-110.060)

• The session should have continuous, synchronous audio and video feeds clear enough that all participants can be seen and understood throughout the act.
• Because bandwidth varies, the rule relies on the notary's judgment about whether communication is adequate, and the notary should terminate the session if it is not.
• The recording must include the person-to-person interaction required for the act, be logically associated with the audit trail, and be playable on broadly available audio-video players.
• Video capture of documents or credentials containing non-public personal information is not required.

The Recording and Its Retention (Section 486.1195; 15 CSR 30-110.070)

• The remote online notary must create an audio and video recording of the performance of each notarial act.
• The recording must be kept at least ten years after the date of the transaction (the rule says at least ten years after the recording is made).
• The recording must be in an industry-standard audio-visual format and must not include images of any electronic record on which the remote signer signed.
• The notary may designate a custodian for the recording and the electronic journal: the employer, if shown by a record signed by both, or a repository meeting the Secretary's standards. A custodian must follow every retention and disclosure rule that applies to notaries.

Electronic Journal for Remote Acts (Sections 486.1180-486.1190)

A remote online notary keeps an electronic journal of remote acts and records those acts in the permanently bound journal. The electronic journal requires two-factor authentication, forbids deleting or altering entries, keeps a backup, captures signature images and one other biometric identifier, and can print and copy entries. Entries are kept at least ten years. Under 15 CSR 30-110.070, the journal and recording are stored on a device protected by password or cryptographic process, with a secure backup, and the electronic journal is kept at least ten years after the last act it records.

Audit Trail (15 CSR 30-110.080)

Each significant action in a session, such as adding an electronic signature, is logged with:

• the action performed;
• the date and time (for example, in Coordinated Universal Time);
• the name of the party performing it; and
• that party's IP address.

Each completed document must be electronically signed and rendered tamper-evident. The notary also keeps the electronic signature and seal under exclusive control, for example by password-controlled access, and attaches them so that any later change is evident (Section 486.1200).

Exam Scenarios

• Three of five. A signer answers three of five KBA questions correctly. That is below the four-of-five standard, so the signer has failed. He may try up to two more quizzes within 48 hours, each replacing at least two questions.
• Choppy video. The signer's video freezes repeatedly and the notary cannot assess comprehension. The notary should end the session.
• Recording storage. A title company employs the notary. With a record signed by both, the company may serve as custodian of the recordings, but it must keep them at least ten years.