The KYC readiness checklist

Fourteen checks to clear before you put identity verification in front of real users. Tick them off as you go; your progress stays in this browser.

Consent and law

Written consent is captured before every checkYou need a lawful basis and informed consent from each person before you submit their face, document or ID number. Store the timestamp and the wording they saw.

You know who is controller and who is processorUnder the NDPA 2023 you decide why the data is collected, so you carry the duty to notify people. Your vendor processes it on your instruction.

Cross-border transfers are coveredIf a vendor processes biometric data outside Nigeria, confirm the safeguards in writing and what is deleted when.

Capture quality

Your capture screen guides the userShow framing, lighting and glare hints on screen. Most failed verifications are bad photos, not bad actors.

Poor images are separated from failed identitiesA blurry upload should prompt a retry, not count as a rejection. Track the two outcomes separately.

You cap retriesUnlimited retries let attackers probe your thresholds. Pick a small limit and send repeat failures to manual review.

Decisions

Liveness runs before face matchingMatching a spoofed face against an ID proves nothing. Order the checks so the cheap, decisive one goes first.

You chose thresholds on purposeDecide your acceptable false-accept and false-reject balance for each risk tier, and write the numbers down.

Borderline scores go to a humanGive the middle band a review lane instead of forcing accept or reject.

Data handling

Raw images are deleted after the checkKeep the decision and the scores. Keep selfies and ID photos only if a regulator requires it, and then say so in your privacy policy.

Identity numbers are stored as keyed hashesA plain hash of an 11-digit number can be reversed by brute force. Use a keyed hash such as HMAC with a secret held outside the database.

Retention periods are written and enforcedDecide how long results are kept (AML rules often set seven years) and delete on schedule.

Operations

Every decision is auditableStore the model version, tier, scores and timestamp with each result so you can explain a decision months later.

API keys live in a secrets managerRotate them, scope them per environment and never ship them in a mobile app or web bundle.

Want the checks done for you?

IDNexus covers liveness, face match, document OCR, quality gating and audit-ready results in one API call, from $0.10.

Create account