What Is eKYC? Electronic Know Your Customer Explained

eKYC — electronic Know Your Customer — is the remote, digital way to run the customer due-diligence checks that banks and regulated businesses must perform before they take on a client. Instead of a face-to-face visit and a photocopied passport, an eKYC process captures an identity document, reads and validates it, compares it to authoritative records, and checks that a live person is actually present.

It is not a single action but a layered trust mechanism. It answers three questions in sequence: who the person is, whether their document is genuine, and whether the individual is really there right now. That ordering matters, because each layer rests on the one below it. The term itself is only a delivery method for KYC — the underlying legal duty is unchanged.

Trust works like a ladder: each rung proves more than the one below, and eKYC sits well above a simple account login. A complete check combines five linked claims, and all five have to hold.

The first is account truth — that the person operating the session controls the account or device. Passwords, one-time codes and device signals prove this, but nothing more. The second is identity truth — that the online person maps to a real legal identity, which is where a name and ID number are captured and matched, usually against a government, bank or credit data source. The third is live-person truth — that a real human is present now, and not a photo, a replayed video or a mask; liveness and presentation-attack detection answer this one.

The fourth is document truth — that the ID document itself is genuine and unaltered, confirmed through security features, chip reads or cryptographic verification. The fifth is binding — that all of these attach to the same person and the same event, and are recorded as evidence for later review. Drop any one claim and the ladder stops carrying weight: a matched face without liveness verifies an image, and a genuine document without a data-source check proves only that a document exists.

Everyday language calls all of these “identity verification”, but they check different things and deliver different levels of assurance.

Identity authentication proves control of a credential — that the current operator is the account owner. By itself it does not know the person's real name or bind them to a legal identity; passwords, SMS codes, fingerprints and face login are all authentication methods.

Identity proofing, or verification, establishes that a claimed identity is real: name, identity number and often a biometric are matched against authoritative sources. This is the real-name layer, and it is what eKYC performs remotely.

eKYC is the electronic, remote execution of KYC due diligence. It combines identity proofing with document validation and liveness so a customer can be onboarded without an in-person visit.

CA electronic certification is the highest rung. A trusted third party — a certificate authority — binds a public key to an identity in a digital certificate, so others across a network can verify it cryptographically and the signer cannot later deny it. It proves not only that the system recognises the person, but that the network can verify them.

A handful of terms recur across regulations, vendor documents and audits, and knowing them shortens most conversations.

KYC, or “know your customer”, is the process; customer due diligence (CDD) is the legal duty to identify and verify customers. FATF Recommendation 10 sets the international baseline and prohibits anonymous or fictitious-name accounts.

Liveness checking proves a live human is present. Presentation-attack detection (PAD) is the formal discipline of resisting spoofs — printed photos, screen replays, masks — and is standardised in ISO/IEC 30107.

Assurance levels come from NIST SP 800-63, which defines Identity Assurance Level (IAL), Authenticator Assurance Level (AAL) and Federation Assurance Level (FAL) to grade how strongly an identity, a login and a federated assertion are proven.

Under eIDAS, notified eID schemes and the EU Digital Identity Wallet let a regulated identity be reused across services; eIDAS 2.0 is Regulation (EU) 2024/1183, which amended Regulation (EU) No 910/2014. In the EU banking sector, EBA/GL/2022/15 sets the guidelines for how credit and financial institutions run remote customer onboarding, including the technologies and controls expected.

A face image alone proves almost nothing. A still photo, a looping video or a synthetic deepfake can all be presented to a camera, so without liveness an identity check verifies a picture, not a person.

Spoofs are cheap: a printed high-resolution photo or a replayed video of the real customer defeats any check that only compares faces, which is exactly why presentation-attack detection exists. Deepfakes raise the bar further, because generative video can mimic both appearance and motion, so passive single-frame checks are no longer enough; stronger deployments combine active challenges, texture and depth analysis, and injection-attack defence.

Two outputs matter here, and they are not the same thing. A face-to-document match score says the face matched the document; a liveness verdict says a live person was present. A record should keep both, because they are distinct claims. For audits and dispute handling, the process should retain the identity data, the match result, the liveness result, the timestamps and the source checks as one exportable package — evidence that can be replayed later, rather than a single pass/fail flag.

eSign.AI supports configurable signer identity verification inside e-signature workflows — document and data checks, configurable signer authentication — and records the resulting identity evidence alongside the signed document and audit trail. Identity verification is one control in a signing workflow, not a substitute for your own KYC programme or legal obligations.

Before relying on any eKYC process, five checks are worth settling first.