Take the specimen passport that the International Civil Aviation Organization (ICAO) prints in Doc 9303 Part 4: Anna Maria Eriksson of Utopia, a fictional state, born 12 August 1974, written 740812 in the machine readable zone. A remote applicant photographs it under a desk lamp, and OCR reads the date as 740312 (an illustrative misread). The printed check digit is 2. The misread gives 7, so the read fails before anyone looks.
Whether a remote check may rest on a photographed ID is one of the KYC requirements by country each market sets.
What is OCR (optical character recognition)?
The full form of OCR is optical character recognition. Businesses run it on paper forms and PDF files; in an ID check its meaning narrows to the printed fields and machine readable zone of a passport, ID card or driver's license.
What makes OCR important in know your customer (KYC) checks is the comparison it allows: the ID's fields against the application and against each other. The European Banking Authority's remote onboarding guidelines (EBA/GL/2022/15) name the tool: an EU bank or financial firm reading documents with "Optical Character Recognition (OCR) algorithms" should make sure they "capture information in an accurate and consistent manner" (guideline 34).
That read serves the first customer due diligence measure, verifying identity with "reliable, independent source documents, data or information" (Financial Action Task Force (FATF) Recommendation 10, June 2026 text).
How does OCR work on an identity document?
OCR works in four steps, and each can lose a character.
- Image collection. A phone camera, desk scanner or passport reader captures the document; glare or blur here becomes a misread later.
- Preprocessing. The software straightens the image, removes specks and finds the text areas.
- Recognition of text. Some OCR engines matched each character against stored patterns or extracted features such as lines and loops, while current engines use trained machine learning models.
- Postprocessing. The characters become named fields: surname, document number, birth date, expiry.
The same steps run on other KYC documents and, in eKYC, on images the customer uploads.
What is in the machine readable zone, and how is a check digit calculated?
The machine readable zone (MRZ) holds two lines of 44 characters on a passport and three of 30 on a TD1 size ID card (Doc 9303 Part 5): OCR-B capitals, digits and the filler "<", with no diacritical marks (Part 3, section 4.6). Its check digits let readers confirm that the zone's data "is correctly interpreted" (section 4.9).
A passport's lower line carries five of them: after the number, birth date, expiry and personal number, plus a composite. Each is a weighted sum's remainder: characters times 7, 3 and 1 in turn, divided by 10, with letters worth 10 to 35 and the filler 0.
For the birth date 740812: 7×7 + 4×3 + 0×1 + 8×7 + 1×3 + 2×1 = 122, remainder 2, as printed. The misread 740312 gives 87, remainder 7. The number L898902C3 (L is 21, C is 12) gives 316, remainder 6. One wrong digit in a date always changes its check digit, since 7, 3 and 1 share no factor with 10.
Treat a failed check digit as a capture problem before treating it as fraud. ICAO built the digits to show whether the zone was read correctly, and in EU remote onboarding, evidence too poor for the remote checks interrupts the process, which restarts or moves face to face (EBA guideline 40).
Which checks does a firm run on OCR output?
The advantages of using OCR for KYC verification come down to seven checks on its output: each compares machine text, so a rule can run it on every applicant, and each misses something.
Table 1. Checks on OCR output, and what each misses (as of October 2026)
| Check | Compares | Catches | Misses | Rule |
|---|---|---|---|---|
| Check digits | Number, birth date, expiry and personal number, each with its digit; the composite over all four | One wrong digit in a date; most misreads in the number | A 6 read as G; a forgery printed with correct digits | Doc 9303 Part 3, section 4.9; EBA guideline 33(c), for a copy accepted instead of the original |
| Zone against page | Name, number and dates in the zone and on the printed page | A misread on one side; a page altered alone | A forgery that is consistent on both | EBA guideline 33(b), altered data in a copy |
| Format and codes | Dates that exist, three letter state codes, field lengths | Impossible values, shifted fields | A valid but false value | Doc 9303 Parts 3 and 4 |
| Expiry | Expiry date against the date of the check | An expired document | Whether the document is real | 31 CFR 1020.220 (an unexpired ID among its examples); AMLA final report, Article 7(2)(e), for remote alternative checks ("valid and up to date") |
| Against application | Name and birth date read against those typed | Typing errors; a name that differs from the ID | A stolen real document | AMLA final report, Article 8(1)(d), a source's accuracy judged by whether it "is consistent with other sources" |
| Transliteration | Ü written as UE, UXX or U; Ö as OE or O; Ş as S | False mismatches with the application | Nothing by itself | Doc 9303 Part 3, section 6A |
| Chip against zone, where read | Data stored in the ID's chip | An altered page or zone | Cannot run on a photo, which carries no chip data | EBA guideline 35: to consider where the device and technology allow |
A passing check digit can still hide a misread. On the specimen, the personal number ZE184226B read as ZE18422GB keeps its check digit (1) and the composite (6): G counts 16, and a change of 10 in one position leaves the remainder unchanged. The algorithm is public, so a forger prints correct digits too.
What are the limitations of OCR in KYC?
In June 2025 Japan's National Police Agency and its partner ministries confirmed the end of rule 6(1)(i)(ho), the method in which a firm receives images of the customer's face and ID. Receiving ID images makes impersonation with forged or altered documents high risk, their public comment result says (translated for this entry). The change applies from 1 April 2027; methods that read the ID's IC chip stay.
Three more OCR limitations in KYC:
- Capture. A copy accepted instead of the original must be of "sufficient quality" (EBA guideline 33(d)), and unattended checks need "adequate lighting" (41(a)).
- Names. The zone drops diacritics and cuts names too long for its line: Müller may appear as MUELLER, MUXXLLER or MULLER (Part 3, sections 4.6 and 6A).
- Forgeries. A forgery printed with correct digits, or a stolen real passport, reads cleanly, so catching that identity fraud falls to the document check and the face match.
Who acts on an OCR read, and how long is the ID image kept?
Four things follow from an OCR read:
- Provider. The identity verification (IDV) provider's software reads the ID; the firm decides whether Table 1's checks and the face match of KYC verification run there too. Choosing the best OCR service for KYC starts with its output: a result per field and per check, and the image kept for review.
- Procedure. In EU remote onboarding, the firm's procedure states which steps run automatically and which need a person (EBA guideline 9(c)); the name OCR reads is the name compliance screens.
- Data. The image and fields are personal data, kept minimal, accurate and no longer than needed (GDPR Article 5(1)(c) to (e)); the firm may use only a provider that gives "sufficient guarantees" (Article 28(1)), and UK GDPR Article 5 matches.
- Record. The ID copy stays five years after the relationship ends; its personal data is then deleted, subject to each text's exceptions (Directive (EU) 2015/849, Article 40; MLR 2017 regulation 40).
complead, formerly Sanction Scanner, does not read the ID. Its product page says document and biometric identity verification is "handled by your IDV provider"; the verified identity is one input to the customer risk assessment model. In customer onboarding, that identity's KYC checks, screening and adverse media share one record and one request.
What is new for ID reads in 2026, and what is due by 2027?
- 30 September 2026. The final report on AMLA's customer due diligence standards under Regulation (EU) 2024/1624 (AMLR) Article 28(1) came out, and AMLA will submit the standards to the European Commission for adoption (AMLA's regulatory instruments page). For remote alternative checks, its Article 7(2)(c) wants images captured "in a readable format and of sufficient quality".
- 1 April 2027. Japan's image route closes.
- 10 July 2027. AMLR Article 77(3) retention applies to most obliged entities.
Reread in better light, the specimen passes all five check digits (6, 2, 9, 1, 6), its zone matches the printed page, and its expiry of 15 April 2034 is still ahead. The document check, the face match and, where it can be read, the chip still have to show that the passport is real and that the applicant is Anna Maria Eriksson.
Related terms
- KYC verification. The identity check for one customer, from the data collected to the record kept.
- Identity fraud. Using another real person's identity details, sometimes on a stolen ID that reads cleanly.
- Proof of address. The document some firms ask for to confirm where a customer lives; the US bank rule collects the address but requires no address document.
- eKYC. KYC verification done remotely, with document, face and data checks and no meeting.
- Electronic identity verification. Identity proved through eID schemes, chip reading or databases instead of a document image.
- Customer identification program. The US rule, 31 CFR 1020.220, under which a bank collects and verifies each customer's identity.
How this entry was checked. Every check digit on this page was recomputed from the specimen in ICAO Doc 9303 Part 4 (Amendment 2, 20 February 2026), and the misread in the opening is illustrative. Author: Emirhan Akgün, Software Engineer at complead. Fact checked by: Fatih Coşkun, Founder and CEO of complead, 29 October 2026. Last reviewed: 29 October 2026. The Japanese passage is translated for this entry. Each rule was reopened at its source on 28 October 2026, in page order: Doc 9303 Parts 3 (Amendment 2, 20 March 2024) and 5, EBA/GL/2022/15, FATF Recommendation 10 (June 2026 text), 31 CFR 1020.220, AMLA's final report of 30 September 2026, the result of Japan's June 2025 public comment, the GDPR and UK GDPR, Directive (EU) 2015/849, UK MLR 2017 regulation 40 and Regulation (EU) 2024/1624.
