eKYC under the hood: from camera to decision.

The pipeline, and a usable picture

An eKYC check is a chain of steps, and each step depends on the one before:

1. Capture the identity document and the person's face on their phone or computer.
2. Read the document: the printed text, the machine-readable zone at the bottom and, where possible, the chip.
3. Check the document: is it genuine, unaltered and in date?
4. Check the person is live: is a real person present, not a photo or a recording?
5. Compare the live face with the face on the document or chip.
6. Decide pass, refer for review or fail, and record what happened.

Everything starts with the picture. The international reference for face photos in passports and identity cards comes from ICAO, the UN's civil aviation agency, whose Doc 9303 sets the standards for travel documents. ICAO's 2018 technical report on portrait quality describes what a good reference photo looks like:

• the face in focus from nose to ears, on a plain background with no shadows;
• even, symmetrical lighting, with the brightness of the cheeks, forehead and chin within one photographic stop of each other;
• the head facing the camera: tilted up or down, or turned left or right, by less than 5 degrees, and rolled by less than 8;
• a neutral expression, mouth closed and eyes open;
• enough detail: at least 90 pixels between the centres of the eyes, and ideally 240 for a live capture.

A phone selfie is not a passport studio, but these rules describe what the software is trying to get close to, and why it asks users to move into better light or hold the phone straight.

Measuring quality automatically. Germany's Federal Office for Information Security (BSI) publishes OFIQ, open-source software that is a reference implementation of the ISO/IEC 29794-5 face image quality standard. It scores more than 20 aspects of a face image from 0 to 100, such as lighting uniformity, sharpness, exposure, head pose, eyes open and whether the face is covered, plus an overall score that predicts how useful the image will be for recognition.

When the picture is poor, stop. The EU banking authority's remote onboarding guidelines say photos and video should be taken in adequate light, at the moment of the check, and that if the evidence is not good enough the process should be restarted or moved to a face-to-face check.

Reading the machine-readable zone

The machine-readable zone (MRZ) is the block of characters at the bottom of a passport page or the back of an identity card. ICAO Doc 9303 defines it precisely:

• It is printed in the OCR-B typeface, designed for machines to read, at a fixed 10 characters per inch, and must also be readable under near-infrared light.
• It uses only digits, capital letters A to Z and the filler character <. Names with accents or in other scripts appear in their national form in the visible part of the document, but are written in plain letters in the MRZ, so the two can legitimately differ.
• Passports (format TD3) have two lines of 44 characters; identity cards (format TD1) have three lines of 30.

Check digits. Key fields such as the document number, date of birth and expiry date are each followed by a check digit, and there is a final composite check digit over several fields. ICAO's rule:

• give each character a value: digits are themselves, < is 0, and A to Z are 10 to 35;
• multiply each value by a repeating weight of 7, 3, 1, 7, 3, 1, and so on, from left to right;
• add the products and divide by 10; the remainder is the check digit.

ICAO's own example: a date of birth of 27 July 1952 is written 520727. The weighted products are 5×7, 2×3, 0×1, 7×7, 2×3 and 7×1, which add up to 103. The remainder after dividing by 10 is 3, so the field is written 5207273.

What check digits are for. They catch misreads and typing errors: if a camera reads an 8 as a 3, the check digit no longer fits. They are not a security feature. Anyone can calculate them, so a forger can produce a perfectly consistent fake MRZ. That is why the MRZ must also be compared with the printed details and, where possible, with the chip.

Compare everything with everything. A sound check confirms that the MRZ, the visible printed fields and the chip data agree, allowing for legitimate differences such as national characters in names.

The chip and what it proves

Most modern passports, and many identity cards, carry a contactless chip. ICAO calls these electronic machine-readable travel documents (eMRTDs). Phones with NFC can read them.

What is on the chip (ICAO Doc 9303 Part 10):

• Data group 1: the same information as the printed MRZ.
• Data group 2: the holder's face image (mandatory).
• Optional data groups for fingerprints and iris, and others for security features.
• The Document Security Object (SOD): a list of hashes, a kind of digital fingerprint, of every data group, digitally signed by the issuing state.

Opening the chip. The chip will not talk to just anyone. With Basic Access Control (BAC), the reader must know the document number, date of birth and expiry date from the MRZ, which is why the app first reads the MRZ with the camera. BAC stops someone reading a passport secretly in a pocket, but its keys are weak. The newer PACE protocol gives strong keys from the same information or a card access number. ICAO requires new chips to support PACE from 1 January 2027 and to use only PACE from 1 January 2028; documents already issued remain valid until they expire.

Checking the data is genuine: passive authentication. The reader hashes each data group and compares it with the signed list, then checks the signature against the issuing state's certificates. Each state runs a Country Signing Certificate Authority, and ICAO's Public Key Directory shares the certificates and revocation lists between countries. If everything matches, the data is exactly what the state issued.

Checking the chip is genuine. Passive authentication proves the data is authentic, but ICAO notes it does not stop someone copying it to another chip. Active Authentication and Chip Authentication prove the chip holds a secret key that cannot be copied, defeating clones.

What the chip does not prove. ENISA, the EU cybersecurity agency, puts it plainly: these cryptographic checks do not prove that the right living person is holding the document. That still needs face comparison and liveness. Also, NFC readers are not available on all older or low-cost phones, so there must be another route.

Kenya. The Directorate of Immigration Services says Kenya issues ePassports in line with ICAO Doc 9303, and ICAO lists Kenya as a participant in its Public Key Directory since December 2022.

How a face match becomes yes or no

Modern face recognition, as NIST describes it, works in three steps:

1. Detect the face in the image.
2. Extract features: convert the face into a template, a list of numbers that captures its distinctive features.
3. Compare two templates to produce a similarity score, and compare the score with a threshold: above it, the system treats the two images as the same person.

One-to-one versus one-to-many. eKYC usually does verification (1:1): is the face in the selfie the same as the face on this document? Identification (1:N) compares one face with a whole database, for example to find duplicate applicants using different names. They answer different questions and have different risks.

Two kinds of error, as NIST defines them for 1:1 matching:

• False match rate (FMR): the share of comparisons between different people that score at or above the threshold. A false match is a security problem: an impostor gets through.
• False non-match rate (FNMR): the share of comparisons of the same person that score below the threshold. A false non-match is a convenience problem: a genuine customer is rejected.

The threshold trade-off. Raising the threshold lowers false matches but raises false non-matches, and the reverse. NIST notes that systems usually favour a low false match rate for security, because a genuine user who is rejected can often simply try again. This is why an error rate means nothing without its threshold. NIST's public face recognition tests report results as the false non-match rate at a fixed false match rate, for example at one in a million.

Quality matters. Poor lighting, blur and pose push scores down for genuine users. Good capture guidance, from the first lesson, is one of the cheapest ways to improve accuracy.

Kenya's Office of the Data Protection Commissioner describes the same pipeline in its 2025 guidance on biometric data, and notes that because matching works on statistical probabilities, there is always some risk of false acceptance or rejection.

Liveness, the decision and the record

A match against a photo of a photo proves nothing. Liveness detection, part of presentation attack detection, checks that a real person is in front of the camera.

• Active liveness asks the user to do something: blink, smile, turn the head, or read random words. The response must match what was asked.
• Passive liveness needs no action and analyses the captured images, looking at signals such as reflections, texture and tiny colour changes in the skin caused by blood flow.

ENISA notes that active checks are harder to fool but cause more users to give up, while passive checks are smoother; many systems combine the two. Either way, the system also needs to confirm it is talking to a real device and camera capturing in real time, not an emulator or a recording fed in.

Putting it together. ENISA describes the usual order: face comparison is done only after the liveness check and the document check have both passed. Automated systems then decide clear cases and send uncertain ones to a trained person when confidence falls below a set level. NIST's 2025 guidelines go further for one-to-many duplicate checks: a possible duplicate must not lead to an automatic rejection without manual review.

The record. The EBA guidelines ask for images, video, sound and data to be time-stamped, stored securely and kept readable, so that a decision can be checked later. A good record shows which checks ran, their results and thresholds, who reviewed the case and why the decision was made.

In Kenya: the Data Protection Act, 2019 gives people the right not to be subject to a decision based solely on automated processing that significantly affects them, subject to exceptions such as consent or contract. The Data Protection Commissioner's 2025 guidance on biometric data says human intervention only counts if the reviewer looks at "all the available input and output data", not just the result, and has "the authority and competence to change the decision". The Central Bank of Kenya's 2025 guidance on customer due diligence gives examples of verification, including cross-checking national identity details against the population register (IPRS) and selfie-based facial recognition for digital lenders and mobile money providers.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.