e-KYC and Digital Identity Verification: Secure Customer Onboarding for Business Apps

More and more businesses are moving customer registration into apps: savings and loan cooperatives, financing providers, property rental platforms, marketplaces with third-party sellers, vehicle rental services, and companies selling products on instalments. In every case the same question arises: how do you make sure the person signing up is who they say they are, without making registration feel like queuing at a government office?

The answer is e-KYC, electronic identity verification. The process usually includes photographing an ID card, reading its data automatically, matching it against population records, taking a selfie, and running a liveness check to make sure the person in front of the camera is a live human, not a photo or video. Identity fraud in Indonesia is getting more serious: in 2026 the civil registration directorate (Dukcapil) even opened a tender for a liveness detection system to strengthen the digital population ID. This article explains how to design e-KYC that is secure, compliant, and still comfortable for users.

Summary

• First decide whether your business really needs e-KYC, and at what level
• The common flow: ID card photo, OCR, data matching, selfie, liveness, and decision
• Use an e-KYC provider with official verification access rather than building everything yourself
• Store as little identity data as possible, encrypted, with retention limits in line with Indonesia's PDP Law
• Prepare a fallback path for failed verifications so legitimate customers are not lost
• Measure conversion at every step to find where users drop off

Do you really need e-KYC?

Not every app needs full identity verification. A regular online store is fine with a verified phone number and a delivery address. Asking for an ID card photo in such an app drives buyers away and adds the risk of storing data you do not need.

e-KYC becomes mandatory or strongly advisable when:

• The business is regulated by a financial regulator, such as financing companies, cooperatives, payment providers, or investment services
• There is direct financial risk, for example handing over goods or funds before full payment
• There is a risk of identity misuse, such as renting vehicles, property, or high-value equipment
• Users become sellers or partners who receive payments from others
• Contracts require electronic signatures tied to a specific identity

For businesses supervised by OJK or Bank Indonesia, know-your-customer requirements are set out in the relevant regulations. Make sure your legal or compliance team reviews the rules for your licence, because the required level of verification can differ.

Tiered verification

A good approach is tiered verification. New users only verify their phone number to browse. ID verification is requested only when a user wants to make a risky transaction, such as applying for a loan or withdrawing funds. That way, users who just want to look around are not burdened, and identity data is collected only from those who actually need the service.

The common e-KYC flow

1. Photographing the ID document

The user photographs their ID card. The app should give visual guidance with a frame, automatic capture when the document is in position, and warnings if the photo is blurry, glaring, or cropped. Photo quality at this step largely determines whether later steps succeed.

2. Automatic data reading

OCR reads the national ID number, name, date of birth, and address from the photo. The results are shown to the user for review. Do not ask users to retype everything; ask them to confirm and allow corrections to misread fields. Similar techniques are covered in automating data entry from documents.

3. Document authenticity checks

The system checks for signs of tampering, such as pasted photos, inconsistent fonts, or documents displayed from another screen. e-KYC providers usually already have models to detect this.

4. Matching against population data

Data from the ID card is matched against official records through a provider with legitimate access. This confirms that the ID number really exists and matches the name and date of birth.

5. Selfie and liveness

The user takes a selfie. The system checks whether the face matches the ID photo or reference data, and whether the person in front of the camera is real. Passive liveness does not ask the user to move, so it is more comfortable. Active liveness asks for movements such as blinking or turning the head, which resists attacks better but adds a step.

6. Decision and case handling

The system produces a score and a decision: auto-approve, reject, or manual review. Decision thresholds should be adjustable by the compliance team rather than hard-coded in the app.

Build it yourself or use a provider

Building OCR, forgery detection, and liveness yourself requires specialist expertise, large training datasets, and testing against many attack types. Access to population data verification is also usually granted only to certain parties. For most businesses, using an e-KYC provider makes far more sense. What you still build yourself is the in-app flow, integration, decision rules, and the review dashboard.

When choosing a provider, consider:

• Official verification access and its legal basis
• Accuracy across conditions, including cheap phone cameras and poor lighting
• Liveness resistance to photos, videos, masks, and deepfakes
• Data storage location and the provider's retention policy
• SDKs for Android, iOS, and web, and an SDK size that does not bloat your app
• Price per verification and charges for failed or repeated attempts
• Service availability and technical support during peak hours

Privacy and data protection

Identity data is highly sensitive personal data. Face photos even count as biometric data. Indonesia's Personal Data Protection Law requires a clear legal basis, informed consent, and adequate safeguards. Key practices:

• Explain to users why the data is requested, how it will be used, and how long it will be kept
• Store only what is truly needed; often the verification result and part of the data are enough, not every raw photo
• Encrypt data at rest and in transit
• Limit internal access to roles that need it, and log every access
• Set retention periods and delete data once it is no longer needed
• Make sure the provider contract sets out their obligations as a data processor

A broader discussion is in personal data protection for websites and apps and customer data retention and deletion policies.

Keeping sign-up conversion high

Every extra step reduces the number of users who finish registration. So e-KYC design must take user experience as seriously as security:

• Explain up front which documents are needed and how long the process takes
• Show progress, for example step two of four
• Give specific error messages, such as photo too dark, try somewhere brighter
• Save progress so users can resume if the app closes
• Optimise for low-end phones and slow networks
• Report results quickly, or give an estimated time if manual review is needed

Good onboarding principles are also covered in mobile app onboarding for new users.

A fallback path for failures

Some legitimate users will fail automatic verification, for example because their ID card is damaged, an old photo looks very different from their face today, or population records have not been updated. Do not reject them outright. Provide a manual review queue, a guided re-upload option, or verification by video call. Record failure reasons to improve the flow.

An example from a digital cooperative

A savings and loan cooperative moved member registration into an app. Previously, prospective members came to the office with ID photocopies and staff entered the data by hand. With e-KYC, members register from home in a few minutes. Cases that fail automatically go into a staff queue, where they are reviewed and members are contacted if needed. Staff now focus on cases that genuinely need attention, and member data is stored neatly in the cooperative's core system. An overview of digital cooperative systems is in digital savings and loan cooperative systems.

Monitoring and auditing the verification process

Once e-KYC is live, the work is not over. Fraud patterns keep changing, and flow quality can decline unnoticed, for example after an app update or a change at the provider. Set up regular monitoring of a few indicators:

• The share of verifications auto-approved, rejected, and sent to manual review
• The most frequent failure reasons, such as blurry photos, mismatched data, or failed liveness
• Average manual review time and the size of any backlog
• Accounts later found to be problematic even though they passed verification
• Spikes in sign-ups from the same device, location, or data pattern

Keep an audit trail for every decision: which person or system decided, when, and based on what score. This trail matters for customer complaints, regulator inspections, or disputes. Review decision thresholds periodically with the compliance team, and retest the flow whenever the provider or the app is updated.

Common mistakes to avoid

• Asking every user for an ID card when it is not needed
• Storing all raw photos indefinitely
• Rejecting automatically with no manual review path
• Not testing the flow on cheap phones and in poor lighting
• Hard-coding decision thresholds so they are hard to adjust
• Not monitoring new fraud patterns such as deepfakes or synthetic identities
• Treating e-KYC as a one-time step when re-verification may be needed for risky transactions

Frequently asked questions

Is e-KYC mandatory for every app?

No. It is mandatory for businesses covered by certain financial regulations and strongly advisable for high-risk services. For ordinary apps, phone and email verification is often enough.

How long should a good e-KYC process take?

For the user, ideally a few minutes from ID photo to result. Automatic decisions usually arrive within seconds, while manual reviews can take longer depending on team capacity.

What about users without an electronic ID card?

Prepare alternatives such as other identity documents or in-person verification, in line with the rules that apply to your business.

Can e-KYC be combined with electronic signatures?

Yes. A verified identity is a strong basis for electronic signatures and e-stamps on contracts or loan agreements.

Conclusion

Good e-KYC balances security, compliance, and convenience. Start by deciding the level of verification you really need, use a provider with official verification access, store as little data as possible with strong protection, and design a flow that forgives user mistakes. That way, the business can reduce fraud without losing legitimate prospects halfway through registration.