eKYC and Digital Identity Verification: The Complete Guide
Electronic Know Your Customer (eKYC) is the digital evolution of identity verification — using document authentication, biometric matching, and database checks to verify customers in seconds rather than days. This guide explains how eKYC works technically, the regulatory frameworks that govern it, the difference between full eKYC and assisted verification, and how to evaluate eKYC providers.
The shift from in-branch to digital identity verification has been one of the most significant operational changes in financial services over the past decade. eKYC has compressed customer onboarding from a multi-day process to a multi-minute one, reduced operational cost by 60-80%, improved verification accuracy through algorithmic consistency, and made it possible to onboard customers across jurisdictions without physical presence in each market.
This guide unpacks how eKYC works, what regulators expect from it, and how to evaluate eKYC providers — both for firms building their first eKYC capability and for firms replacing legacy infrastructure that has not kept pace with regulatory or competitive expectations.
The Technical Components of an eKYC Workflow
A complete eKYC workflow consists of multiple distinct technical steps, executed in sequence with risk-based decisions at each stage. Modern platforms execute the entire sequence in under 30 seconds for the majority of customers.
Document Capture
The customer captures images of their identity document — typically passport, driving licence, or national identity card — through a mobile camera or webcam. The capture interface must guide the customer to produce images of sufficient quality (correct lighting, document fully in frame, no glare) and reject low-quality captures before they enter the verification pipeline.
Document Authentication
The captured document is parsed and validated. Document authentication checks include: confirming the document is a known type from a known issuing authority; validating security features (holograms, microprinting, MRZ checksum, embedded chip data where present); checking for evidence of tampering (font replacement, image manipulation, digital cropping); and verifying that the document has not expired. Modern document libraries cover thousands of identity documents from over 200 jurisdictions.
Biometric Selfie Capture
The customer captures a live selfie or short video. The capture is used both for biometric matching against the document photograph and for liveness detection. Capture interfaces typically include real-time guidance to ensure the face is correctly positioned and lit.
Liveness Detection
Liveness detection defeats presentation attacks — fraudsters attempting to verify using a printed photograph, a screen recording, a deepfake, or a 3D mask. Modern liveness systems use a combination of passive (analysing the captured image for signs of being a recapture) and active (asking the customer to perform a randomised action such as turning their head) techniques. The standards to look for are ISO 30107-3 PAD certification at Level 1 minimum, ideally Level 2.
Biometric Face Matching
The selfie is compared to the photograph extracted from the identity document using face-recognition algorithms. The output is a similarity score; the platform applies a threshold tuned to balance false-rejection (legitimate customers being flagged as non-matches) against false-acceptance (fraudsters being flagged as matches). NIST FRVT benchmark data is the most reliable indicator of algorithm quality.
Database and Watchlist Checks
In parallel with document and biometric verification, the verified identity is screened against sanctions lists, PEP databases, and adverse media sources. See our sanctions screening guide and PEP screening guide for the full screening framework.
Full eKYC vs Assisted Verification
eKYC implementations sit on a spectrum from fully automated to assisted-by-human:
- Full automated eKYC — the entire verification completes without human intervention for low-risk cases. The platform makes the verification decision; only edge cases route to manual review. Typical pass-through rates of 80-90% for well-tuned systems against documents from supported jurisdictions.
- Hybrid (machine-first, human-on-edge-cases) — automated processing handles the majority of cases, with risk-based routing of edge cases to a manual review queue where a trained operator makes the final decision. This is the most common production architecture.
- Assisted verification — a human operator reviews every case, with the platform providing structured review tooling rather than autonomous decision-making. Used in higher-risk segments (private banking, complex KYB cases) where machine-only decisions are not appropriate.
The right architecture depends on the risk profile of the customer base and the regulatory environment. Our KYC platform supports all three modes and allows firms to apply different modes to different customer segments based on risk.
Regulatory Acceptance of eKYC
All major AML frameworks accept eKYC, provided the methods used satisfy specific reliability requirements. The relevant provisions:
- FATF — Recommendation 10 requires verification using reliable and independent source documents, data, or information. Digital verification methods qualify provided they meet this reliability standard. FATF's 2020 Digital ID Guidance specifically endorses eKYC using regulated digital identity systems.
- EU (AMLD 6) — Article 13 explicitly permits identification using electronic identification means, electronic trust services, or other secure remote or electronic identification processes regulated under the eIDAS Regulation.
- UK (MLR 2017 / JMLSG) — JMLSG Guidance Part 1 Chapter 5 covers electronic verification in detail, recognising it as an acceptable verification method when supported by appropriate data sources and controls.
- US (FinCEN) — FinCEN guidance on the use of "non-documentary" verification methods has been progressively expanded to accommodate biometric and digital verification where reliability can be demonstrated.
- Singapore (MAS) — MAS has been an active proponent of eKYC, with Singapore's Singpass / Myinfo system providing a regulated digital identity infrastructure that financial institutions can rely on for verification.
Evaluating eKYC Providers: What Actually Matters
When evaluating eKYC providers, the metrics that matter are not always the ones in the marketing material. The criteria we recommend founders and compliance heads focus on:
- Document library coverage — how many specific document types from how many jurisdictions are supported, and what is the verification accuracy on each. A library that lists 200 countries but only handles passports from 30 of them is not adequate.
- NIST FRVT benchmark performance — the National Institute of Standards and Technology's Face Recognition Vendor Test is the authoritative independent benchmark. Production-grade providers should rank in the top tier on the relevant tracks.
- ISO 30107-3 PAD certification — independent certification of liveness detection at Level 1 minimum.
- Pass-through rate on real customer data — what percentage of cases complete without human intervention, on data that resembles your customer base. Provider-supplied benchmarks on synthetic data are not a reliable indicator.
- Regulatory data residency and compliance — where is data stored and processed, and does that align with your jurisdictional requirements (GDPR, PDPA, others).
- Audit trail and regulatory reporting — what evidence of each verification is retained, in what format, and how easily can it be produced during a regulatory inspection.
eKYC for KYB and Corporate Onboarding
eKYC for individuals is well-established. eKYC for corporate customers — verifying the entity itself plus its directors and ultimate beneficial owners — is more complex and less standardised. A complete corporate eKYC workflow integrates:
- Authoritative corporate registry lookup for the entity and its directors / shareholders.
- UBO unwrapping through any layered ownership structures.
- Customer-facing portals through which directors and UBOs complete eKYC remotely.
- Sanctions and PEP screening of all identified individuals and the entity itself.
- Document management for incorporation documents, ownership records, and trust deeds where applicable.
Our customer onboarding platform integrates all of these into a single workflow — the corporate is verified through KYB, identified UBOs are routed into individual eKYC through portals, and the resulting case file presents the analyst with a complete view ready for risk rating.
eKYC and KYB on a Single Production-Grade Platform
One Constellation's eKYC platform combines document authentication, biometric matching, liveness detection, and screening in a single workflow — supporting individuals and corporate entities across 15+ jurisdictions, with the audit trail your compliance team and your regulator will both expect.
