At an Indian commercial bank, an account opened remotely with Aadhaar OTP eKYC alone may hold at most 1 lakh rupees across the customer's deposit accounts and take at most 2 lakh rupees of credits a financial year. After one year without full due diligence, a deposit account is closed (RBI KYC Directions, updated 1 October 2026, paragraph 25). Elsewhere the conditions fall on the evidence, and KYC rules by country differ on which remote evidence counts.
What is eKYC?
The meaning of eKYC is KYC verification run at a distance. Its full form is electronic know your customer, or know your client. Traditional KYC and eKYC differ in the evidence. The duty stays the same. Recommendation 10 of the FATF Recommendations (June 2026 text) has firms verify identity with "reliable, independent source documents, data or information".
EU law names the remote route: electronic identification means, trust services or "any other secure, remote or electronic identification process" approved or accepted by national authorities (Directive (EU) 2015/849, Article 13(1)(a)). FATF's Guidance on Digital Identity (March 2020) adds that remote identification through a reliable, independent digital ID system with risk mitigation in place "may present a standard level of risk".
Its purpose is to complete the first customer due diligence measure, identity verification, without meeting the customer. In India, eKYC also names a service: the bank authenticates the customer's Aadhaar number through UIDAI's eKYC authentication facility, and the customer gives the number voluntarily unless a government benefit or subsidy requires it (RBI Directions, paragraph 23).
How does eKYC work? Document, biometric verification and data checks
eKYC runs three types of check. The technologies behind them: optical character recognition (OCR), security feature checks and chip reading for the document; AI face matching and liveness detection for the person; lookups through APIs for the data.
Table 1. The three eKYC checks compared
| Check | What it proves | What it reads | What defeats it | Rule |
|---|---|---|---|---|
| Document | The ID is genuine and unaltered | A passport, ID card or driver's license: printed fields, machine readable zone, security features, chip data where readable | A fake made only as an image, a scan or a photo | EBA/GL/2022/15 (since 2 October 2023), guidelines 35 and 36 |
| Face and liveness | The person presenting is the holder and is live | A selfie or video against the ID photo | Printed photos, replayed video, masks | EBA guidelines 38(a) and 41(c); BNM policy document, paragraph 8.10 |
| Data | The details match a reliable record | A register, a credit bureau, the Aadhaar record or an eID scheme | Another person's real details, or a synthetic mix | Regulation (EU) 2024/1624 (AMLR), Article 22(6) |
None of the rulebooks compared below asks for all three on every remote customer. A US bank may verify with non documentary methods and no face match, the EBA asks for liveness only in unattended checks, Malaysia lists the three with an "and/or", and India's Aadhaar eKYC authenticates against the UIDAI record instead of a document. So your written procedure has to name the checks it combines for each product and market.
eKYC stops at identity: sanctions and PEP screening, the decision and the record are the later steps of KYC verification. A fourth check, proof of address, is added where the market or the firm's policy asks for one; a US bank collects the address without one.
What does the face and liveness check prove?
In biometric verification, the second check in Table 1, the face match ties the person in front of the camera to the ID photo, and liveness detection looks for the attacks Malaysia's policy document names: photos, videos and synthetic face masks. Neither proves the identity is real. A face can match an ID made for a synthetic identity. Biometric data used to identify a person uniquely falls in the special categories of UK GDPR Article 9(1).
Which rules allow eKYC, and on what terms?
FATF lists non face to face business among its examples of higher risk only "where appropriate risk mitigation measures have not been implemented" (Interpretive Note to Recommendation 10, paragraph 15(c)). Each market then writes its own compliance requirements and standards for a remote check, so global regulatory acceptance of eKYC is decided market by market.
Table 2. eKYC rules by market (as of October 2026)
| Market | Rule and date | A remote check may rest on | Condition on the person | Chip, eID or data source |
|---|---|---|---|---|
| EU | AMLR Article 22(6), from 10 July 2027 (until then Directive 2015/849, Article 13(1)(a)); AMLA's final report on the due diligence standards, Article 7 | An ID plus independent sources where relevant, or eID at "substantial" or "high" | Remote document and face checks only where neither default can be used (Article 7(1)) | eID under eIDAS; chip data where readable (EBA guideline 35) |
| UK | MLR 2017, regulation 28(19) | Documents, data, or an electronic identification process "secure from fraud and misuse" | The process gives assurance that the person claiming the identity is that person (28(19)(b)) | Electronic identification means or a trust service (28(19)(a)) |
| US | 31 CFR 1020.220 | Documents, non documentary methods or both | The customer identification program's non documentary procedures must cover a customer who opens "without appearing in person" | Consumer reporting agency, public database or other source |
| India | RBI Directions, paragraphs 23, 25 and 44 | Aadhaar authentication through UIDAI; the video based customer identification process | Video identification by a bank official with facial recognition, on par with face to face | UIDAI record; the Central KYC Records Registry (CKYCR), which holds KYC records in digital form and lets a bank download one by KYC Identifier with the customer's explicit consent |
| Singapore | MAS Notice 626, paragraph 6.29 | Non face to face CDD | Measures at least as strong as face to face | Not named in the paragraph |
| Malaysia | BNM electronic KYC policy document, 15 April 2024 | Document verification, biometric matching "and/or" liveness detection | Liveness against photos, videos and masks; false acceptance rate audited where AI decides | Government issued ID; no chip reading named |
| Japan | Ordinance No. 3 of 2025, from 1 April 2027 | Face image plus the ID's IC chip data, among other methods | Face image taken in the firm's software | IC chip; the face and ID image method ends |
In AMLA's text a remote document and face check is the fallback, not the default: a firm that uses it must be able to show why the customer could neither present the document in person nor use an eID at the substantial or high level (Article 7(1) and (3)). The US rule names no remote method. A bank's procedures must still cover the customer who never appears in person.
How do fake IDs get past eKYC, and when does it stop real customers?
On 26 February 2026, the US Attorney for the Southern District of New York announced that OnlyFake's creator had been charged and had pleaded guilty. The site generated at least about 10,000 "Digital Fake IDs", styled as "a scan" or as a photo "taken on a surface like a table". The office's release adds: "Many of those financial institutions allow individuals to submit scans or photographs".
Japan gives the forgery risk of sending ID images as its reason for ending the image method on 1 April 2027, and EBA guidelines 35 and 36 point firms to chip data and security features. A live check can expose a deepfake: FinCEN's alert of 13 November 2024 says responses to live prompts "may reveal inconsistencies in the deepfake identity", so some fraudsters claim repeated technical glitches or use webcam plugins that show previously generated video. Fake IDs and deepfakes are both identity fraud at onboarding.
The other challenge in implementing eKYC is the genuine customer a check cannot read: under EBA guideline 40, evidence too poor to check restarts the process or moves it face to face. Malaysia measures the reverse error. Picture a bank (illustrative) using AI checks whose audit of one month's cases finds 7 of 200 non genuine attempts accepted: a false acceptance rate of 3.5 percent. Above 3 percent, BNM wants a risk assessment for the board; above 5 percent in any two months within four, the bank must notify BNM (Appendix 2).
Who runs the eKYC checks, and what happens after them?
An identity verification (IDV) provider's solution, software or system runs the three checks. The onboarding team handles referrals, restarts and the face to face route. Compliance writes the AML procedure for each product and market, records why any fallback was used (AMLA Article 7(3)), owns screening and makes the decision.
complead, formerly Sanction Scanner, sits after the provider. Its product page says the document and biometric checks are "handled by your IDV provider", and the verified identity feeds its customer risk assessment model as an input. In customer onboarding, screening and adverse media then run with the KYC checks on one record, in a single request.
Which eKYC rules moved in 2026, and which dates come next?
- 9 June. The UK's digital verification services trust framework 1.0 reached final release; gov.uk says it takes effect once a conformity assessment body is first accredited, not before 1 September 2026.
- 30 September. AMLA published the final report on its customer due diligence standards for the EU (AMLR Article 28(1)), Article 7 on remote checks included, as its regulatory instruments page records; the European Commission receives it for adoption.
- Future dates. Each EU member state must provide at least one European Digital Identity Wallet by 24 December 2026 (eIDAS Article 5a(1), counted from Implementing Regulation (EU) 2024/2981). The AMLR applies to most obliged entities from 10 July 2027. Banks bound to strong user authentication must accept the wallet at the user's request by 24 December 2027 (Article 5f(2)).
Table 1's document check reads three things: the printed fields, the machine readable zone and, where it can, the chip. How does optical character recognition read the first two, and what happens when they disagree with the third?
Related terms
- KYC verification. The full identity check for one customer, from collecting the data to the record.
- Proof of address. A document that shows where a customer lives; some markets ask for one.
- Synthetic identity fraud. A made up person stitched together from real and invented details, which a face match cannot expose.
- Impersonation fraud. Posing as a trusted person or organization to get money or data.
- Electronic identity verification. The methods behind the data check: eID schemes, NFC chip reading and database lookups.
- Optical character recognition. Software that reads the printed text and the machine readable zone of an ID.
How this entry was checked. Emirhan Akgün, a software engineer at complead, is the author. Fact checked by: Fatih Coşkun, Founder and CEO of complead, 28 October 2026. Last reviewed: 28 October 2026. The bank in the false acceptance example is illustrative. All texts were read on 28 October 2026, in page order: the RBI's KYC Directions for commercial banks (updated 1 October 2026), the FATF Recommendations of June 2026, Directive (EU) 2015/849 as amended, FATF's Guidance on Digital Identity, EBA/GL/2022/15, BNM's policy document of 15 April 2024, Regulation (EU) 2024/1624, UK GDPR Article 9, AMLA's final report of 30 September 2026, Regulation (EU) 2024/1183 and Implementing Regulation (EU) 2024/2981, UK MLR 2017 regulation 28, 31 CFR 1020.220, MAS Notice 626, Japan's Ordinance No. 3 of 2025, the OnlyFake release of 26 February 2026, FinCEN's alert of 13 November 2024 and the UK trust framework 1.0.
