White paper: digital identity verification (KYC)

Opening an account, activating an e-wallet, registering a driver or a seller: more and more services begin with remote identity verification. Done well, it takes under a minute and stops most fraud. Done badly, it drives good customers away and lets the bad ones through. This white paper sums up what we learned building onboarding journeys for fintech, mobility and real estate, and designing our own verification product.

Why verify, and why it is hard

Identity verification serves three needs: meeting know-your-customer (KYC) and anti-money-laundering obligations, protecting the service against fake accounts and fraud, and giving honest users confidence. The difficulty comes from the variety of situations: dozens of identity-document formats, photos taken in poor conditions, slow networks, and fraudsters who now have image-generation tools.

The framework: compliance and personal data

Two families of rules apply. On one side, anti-money-laundering and counter-terrorist-financing obligations, transposed in the WAEMU countries and detailed by financial regulators, require identifying the customer, keeping evidence and screening certain lists. On the other, personal data protection: in Côte d'Ivoire, Law No. 2013-450 of 19 June 2013 governs the collection, retention and security of data, under the supervision of ARTCI. A compliant journey collects the minimum necessary, explains why, keeps evidence for the legal period and no longer, and protects biometric data with particular care.

The best verification is the one the honest user does not notice and the fraudster does not get through.

The five checks of modern verification

• Document data extraction: automatic reading of the fields (name, date of birth, number, validity) by character recognition, with consistency checks between readable zones.
• Document authenticity: detection of retouching, printouts, obsolete templates and layout inconsistencies.
• Face match: comparison of the selfie with the document photo, with a threshold adapted to the risk level.
• Liveness detection: checking that a real person is in front of the camera, and not a photo, a video or a mask, through passive (image analysis) or active (requested movements) methods.
• List screening: sanctions, politically exposed persons, adverse media, with human review of matches.

Integrating verification into a journey

1. Scope the risk level. A low-limit wallet and a credit account do not require the same checks; define tiers.
2. Choose the accepted documents country by country, and plan a fallback route (branch, video call) for unusual cases.
3. Design the mobile journey: capture guidance, immediate feedback on a blurry photo, resumption after a network drop.
4. Write the decision rules: what is accepted automatically, what is refused, what goes to manual review, and why. Every decision must be explainable.
5. Measure: acceptance rate, median time, refusal reasons, fraud detected after the fact. These numbers guide the tuning.

Common pitfalls

• Asking for more documents than necessary, which increases drop-off without reducing fraud.
• Setting thresholds once and for all, while the population and the attacks evolve.
• Neglecting real conditions: entry-level phones, low light, unstable network.
• Keeping biometric images with no retention limit and no dedicated encryption.
• Treating manual review as an untooled exception, until it becomes a bottleneck.

Checklist

• The applicable regulatory obligations are listed, with retention periods.
• The data collected is minimal and its purpose is explained to the user.
• The five checks are in place, with thresholds documented per risk tier.
• The journey has been tested on modest devices and on degraded networks.
• Automatic decisions are explainable and logged.
• A manual review queue exists, with target delays.
• Indicators are tracked weekly and thresholds readjusted.

Conclusion

Identity verification is not a box to tick but a product in its own right, which is measured and improved. That is the conviction that led us to design KYX, and that we apply in every fintech project. To discuss it from your own journey, write to us.