What Is eKYC? Electronic Know Your Customer Explained

What eKYC means

eKYC — electronic Know Your Customer — is the remote, digital way to run the customer due-diligence checks that banks and regulated businesses must perform before they take on a client. Instead of a face-to-face visit and a photocopied passport, an eKYC process captures an identity document, reads and validates it, compares it to authoritative records, and checks that a live person is actually present. It is not a single action but a layered trust mechanism. It answers three questions in sequence: who the person is, whether their document is genuine, and whether the individual is really there right now. That ordering matters, because each layer rests on the one below it. The term itself is only a delivery method for KYC — the underlying legal duty is unchanged.

FATF R.10

Customer due-diligence baseline

ISO/IEC 30107

Liveness / PAD testing standard

NIST SP 800-63

Assurance levels (IAL / AAL / FAL)

EU 2024/1183

eIDAS 2.0 regulation

What an eKYC check actually verifies

Trust works like a ladder: each rung proves more than the one below, and eKYC sits well above a simple account login. A complete check combines five linked claims, and all five have to hold. The first is account truth — that the person operating the session controls the account or device. Passwords, one-time codes and device signals prove this, but nothing more. The second is identity truth — that the online person maps to a real legal identity, which is where a name and ID number are captured and matched, usually against a government, bank or credit data source. The third is live-person truth — that a real human is present now, and not a photo, a replayed video or a mask; liveness and presentation-attack detection answer this one. The fourth is document truth — that the ID document itself is genuine and unaltered, confirmed through security features, chip reads or cryptographic verification. The fifth is binding — that all of these attach to the same person and the same event, and are recorded as evidence for later review. Drop any one claim and the ladder stops carrying weight: a matched face without liveness verifies an image, and a genuine document without a data-source check proves only that a document exists.

Authentication, verification and certification are not the same

Everyday language calls all of these “identity verification”, but they check different things and deliver different levels of assurance. Identity authentication proves control of a credential — that the current operator is the account owner. By itself it does not know the person's real name or bind them to a legal identity; passwords, SMS codes, fingerprints and face login are all authentication methods. Identity proofing, or verification, establishes that a claimed identity is real: name, identity number and often a biometric are matched against authoritative sources. This is the real-name layer, and it is what eKYC performs remotely. eKYC is the electronic, remote execution of KYC due diligence. It combines identity proofing with document validation and liveness so a customer can be onboarded without an in-person visit. CA electronic certification is the highest rung. A trusted third party — a certificate authority — binds a public key to an identity in a digital certificate, so others across a network can verify it cryptographically and the signer cannot later deny it. It proves not only that the system recognises the person, but that the network can verify them.

Identity authentication vs eKYC vs CA digital certification

The three layers differ in what they prove, what evidence they produce and who can verify them.

	Identity authentication	eKYC (remote identity proofing)	CA digital certification
Question answered	Are you the account holder?	Does this online identity map to a real person?	Can the network verify this identity and key?
What it proves	Control of a credential	Real-name identity + a live person	Identity bound to a public key
Typical methods	Password, OTP, biometric login	ID document + face + data-source match + liveness	Digital certificate issued by a CA
Evidence produced	Login/authentication log	ID data, selfie match score, liveness result	Certificate, signature, timestamp
Verifiable by third parties	No — internal to the system	Partly — through the provider's evidence	Yes — cryptographically, network-wide
Non-repudiation	Weak	Moderate	Strong

eKYC vocabulary worth knowing

A handful of terms recur across regulations, vendor documents and audits, and knowing them shortens most conversations. KYC, or “know your customer”, is the process; customer due diligence (CDD) is the legal duty to identify and verify customers. FATF Recommendation 10 sets the international baseline and prohibits anonymous or fictitious-name accounts. Liveness checking proves a live human is present. Presentation-attack detection (PAD) is the formal discipline of resisting spoofs — printed photos, screen replays, masks — and is standardised in ISO/IEC 30107. Assurance levels come from NIST SP 800-63, which defines Identity Assurance Level (IAL), Authenticator Assurance Level (AAL) and Federation Assurance Level (FAL) to grade how strongly an identity, a login and a federated assertion are proven. Under eIDAS, notified eID schemes and the EU Digital Identity Wallet let a regulated identity be reused across services; eIDAS 2.0 is Regulation (EU) 2024/1183, which amended Regulation (EU) No 910/2014. In the EU banking sector, EBA/GL/2022/15 sets the guidelines for how credit and financial institutions run remote customer onboarding, including the technologies and controls expected.

Why liveness and anti-spoofing carry the risk

A face image alone proves almost nothing. A still photo, a looping video or a synthetic deepfake can all be presented to a camera, so without liveness an identity check verifies a picture, not a person. Spoofs are cheap: a printed high-resolution photo or a replayed video of the real customer defeats any check that only compares faces, which is exactly why presentation-attack detection exists. Deepfakes raise the bar further, because generative video can mimic both appearance and motion, so passive single-frame checks are no longer enough; stronger deployments combine active challenges, texture and depth analysis, and injection-attack defence. Two outputs matter here, and they are not the same thing. A face-to-document match score says the face matched the document; a liveness verdict says a live person was present. A record should keep both, because they are distinct claims. For audits and dispute handling, the process should retain the identity data, the match result, the liveness result, the timestamps and the source checks as one exportable package — evidence that can be replayed later, rather than a single pass/fail flag.

Common questions about eKYC

No. KYC is the duty to identify and verify a customer; eKYC is a remote, electronic way to perform it. The legal obligation is the same, but eKYC replaces the in-person, paper-based method with digital document capture, data-source checks and liveness.

How eSign.AI fits

eSign.AI supports configurable signer identity verification inside e-signature workflows — document and data checks, configurable signer authentication — and records the resulting identity evidence alongside the signed document and audit trail. Identity verification is one control in a signing workflow, not a substitute for your own KYC programme or legal obligations. Before relying on any eKYC process, five checks are worth settling first.

A practical path: five checks before you adopt eKYC

Treat eKYC as a controlled process, not a feature toggle. Work through these in order.

01

Confirm the required assurance level

Name the regime and the level — for example the NIST IAL or the local KYC standard — before choosing methods.

02

Confirm the accepted identity sources

Check whether a government, bank or credit source is required, and whether the document type qualifies.

03

Confirm liveness is tested to a standard

Make sure presentation-attack detection is tested against ISO/IEC 30107, not merely claimed.

04

Confirm match and liveness stay separate

Keep the face-match score and the liveness verdict as distinct, replayable outputs in the evidence.

05

Confirm the evidence is exportable

Ensure identity data, source checks, timestamps and outcomes can be produced on request.

Identity verification in electronic signatures Signer identity verification for high-risk agreements National digital identity and eSignature integration