Beginning with version 2.0, JSF supports Bean Validation (aka JSR 303). However, it does not support every JSR 303 feature. Putting it in a nutshell, only attribute validation is supported, and it's limited to the controller class. A particularly annoying shortcoming is there's no cross-field-validation (aka class validation).
Fortunately it's easy to fix the deficiencies. Just add Apaches MyFaces ExtVal jar to the classpath, restart the server and you're done. Make sure you download the ExtVal examples, too. At the time of writing, the library is badly documented, so you need them. The examples are short and simple, so you should get along without documentation as well.
JSF bears a little surprise: It validates only the fields on the current page. If your page displays only a few of your beans attributes, the bean may be invalid (some attributes contain invalid values) but JSF doesn't show any error. JSF evaluates Bean Validation annotations when it's calling one of the bean's setters - and it considers the annotations associated with the setter or it's underlying attribute only. But then, it's no use to show error messages referring to fields that aren't displayed. Think of a multi-page wizard to see the wisdom of this approach.
For the sake of completeness I should mention that JSF 2.x doesn't deliver JSR 303 support out of the box. You have to add a JSR 303 implementation to the classpath. There are several implementations to choose from. Up to now, I'm happy with Hibernate Validator (which doesn't say neither good nor bad about the alternative implementations - I just didn't try them yet). You don't have to configure anything. JSF finds the JSR 303 implementation "automagically" without further ado.