eKYC and digital identity verification.

What KYC requires

Know your customer (KYC) is the set of checks a regulated business, such as a bank or mobile-money provider, carries out on its customers. The aim is to be confident that customers are who they say they are, and to understand the risk they bring. The international standards of the Financial Action Task Force (FATF) call these checks customer due diligence (CDD). CDD includes:

• identifying the customer and verifying that identity using reliable, independent sources;
• identifying the beneficial owner, the real person who ultimately owns or controls a customer that is a company or other arrangement;
• understanding the purpose of the relationship;
• ongoing monitoring: keeping information up to date and watching for activity that does not fit.

KYC is risk-based. Lower-risk products can use simplified checks, and higher-risk customers need enhanced ones. Many mobile-money and banking services use tiered KYC: basic verification opens an account with low limits, and fuller verification raises them.

eKYC is KYC done digitally and remotely, often on the customer's phone, instead of in a branch. It must meet the same standard as a face-to-face check. But no member of staff sees the customer in person, so fraud that a person at a counter might notice has to be caught in other ways.

How a digital identity check works

A typical eKYC journey has five steps:

• Notice and consent. Before anything is captured, the customer is told what will be collected, why, and for how long.
• Document capture. The customer photographs their identity document. Image-quality checks reject blurred, cropped or glare-covered photos early.
• Document checks. Text is read automatically (optical character recognition, OCR), and the data is checked for consistency and expiry. Many passports and identity cards carry a machine-readable zone (MRZ): the lines of letters, numbers and < signs at the bottom of the photo page. An international standard, ICAO Doc 9303, defines it. Its check digits catch reading errors and crude alterations. A skilled forger can recalculate them, so they are only one check among several.
• The person. A selfie or short video is compared with the document photo, and liveness checks confirm a real person is present (next lesson).
• Data checks. Where the law allows, details are confirmed against an authoritative source. In Kenya this is the national population register, now called the Maisha Integrated Population Register and long known as the Integrated Population Registration System (IPRS). The phone number may be confirmed with a one-time passcode.

The results are combined into an outcome: approve, reject, or send to a person for review. A good system records every step, the evidence it used and who made the final decision.

Face matching and liveness

Face matching in eKYC is usually one-to-one verification: is the person in the selfie the same person as on the document? This is different from one-to-many identification, which searches one face against a whole database of faces.

The system produces a similarity score, and a threshold turns it into "match" or "no match". This is a trade-off:

• a low threshold lets more impostors through (false matches);
• a high threshold rejects more genuine customers (false non-matches).

Liveness detection checks that the camera is seeing a real, present person, not a printed photo, a screen, a mask or a replayed video. Showing the camera a fake like this is called a presentation attack. The international standard ISO/IEC 30107 sets out how to test defences against presentation attacks. Checks can be active (asking the person to turn their head or blink) or passive (analysing the image without asking the person to do anything).

Newer threats include deepfakes (realistic fake video made by software) and injection attacks, where fake video is fed into the app without passing through the camera at all. ISO/IEC 30107 covers attacks at the camera, not injection. Defending against injection needs checks on the device and the video stream as well as the face.

Face-matching accuracy can also differ between demographic groups, such as age, sex and skin tone. The US National Institute of Standards and Technology (NIST) found such differences in many algorithms it tested in 2019. Test the system on the kind of customers you actually serve, and give people another route, such as a branch or agent visit, when the technology fails them.

The fraud eKYC must stop

Remote onboarding attracts particular kinds of fraud:

• Impersonation with a stolen or borrowed identity document.
• Forged or altered documents, including edited photos and details.
• Synthetic identities built from a mix of real and invented details.
• Duplicate identities: one person opening many accounts under different names, often the same face with different documents.
• Mule accounts: genuine people who are paid, tricked or pressured into opening accounts that criminals then use to move stolen money. A mule passes every identity check, because the person is real.

Defences work in layers: document checks, face matching and liveness, checks against authoritative data, spotting the same face or document in more than one application, and monitoring the account after it is opened.

Automated checks should help people decide, not decide everything alone. A sensible design:

• sets minimum scores that front-line staff cannot lower;
• sends uncertain cases to a trained reviewer;
• requires a second reviewer for high-risk decisions;
• records the reason for every rejection.

Protecting people's data

eKYC collects some of the most sensitive data a business can hold: identity documents, face images and often biometric templates (the numerical description of a face that the software compares). In Kenya, the Data Protection Act, 2019 treats biometric data as sensitive personal data, which carries stricter conditions. Good practice, and in many cases the law, calls for:

• a lawful basis and clear notice before capture, with consent where it is required;
• data minimisation: collect only what the check needs;
• retention limits: keep data only as long as the law and the purpose require, then delete it;
• security: encryption, strict access control and a record of who viewed what;
• a data protection impact assessment before processing that is likely to be high risk. Large-scale biometric processing usually is.

People also have rights over automated decisions. Under section 35 of Kenya's Act, when a decision that significantly affects a person is made by a computer alone, the organisation must tell the person in writing. The person can then ask for the decision to be reconsidered, or for a new decision that is not made by the computer alone. For eKYC, that means a trained person should be able to review a rejection, and the customer should be told how to ask for it.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.