e-KYC

Electronic know-your-customer (e-KYC) is the process of verifying a customer's identity remotely using digital means — typically an identity document scan, a biometric face match and a liveness check — in place of an in-person branch visit.^[1]

History

Know-your-customer checks exist to satisfy anti-money-laundering rules: financial institutions must know who their customers are before opening an account. Traditionally this meant inspecting a physical identity card across a counter. As account opening moved online, regulators had to decide how much assurance a remote check must provide.

Bank Negara Malaysia (BNM) issued its first e-KYC policy document on 30 June 2020, allowing remote onboarding for individuals during the pandemic-era shift to digital banking, and replaced it with a revised policy document, BNM/RH/PD 030-16, issued and effective 15 April 2024. The current version applies to licensed banks, investment banks, Islamic banks, life insurers, money services businesses and approved issuers of payment instruments, and is the standard BNM examiners assess compliance against.^[1][2]

Key Concepts

The overriding requirement is that e-KYC must achieve the same level of identity assurance as face-to-face verification. BNM's policy sets out three modules that together satisfy that standard:^[2]

• Document verification — checking that the submitted identity document is genuine and not forged, altered or replayed from a photograph.
• Facial recognition — matching the live capture of the user's face against the photograph embedded in the identity document, with a recorded match confidence score retained as evidence.
• Liveness detection — confirming the subject is a live person rather than a printed photo, a recorded video or a synthetic face mask; BNM specifies presentation-attack detection requirements in Section S 8.21 and Appendix 2 of the policy, referencing international standards such as ISO 19794-5.^[2]

Institutions that deploy biometric matching without liveness detection, or document checks without biometric matching, do not meet the policy's standard. Vendors used for liveness detection must appear on BNM's approved list, and institutions must retain records including facial match confidence scores for supervisory review.^[3]

Because e-KYC depends on biometric and identity data, it sits squarely within personal data protection law: the data collected is sensitive, purpose-bound and must be secured and retained only as long as required.^[4]

Applications

E-KYC underpins remote current-account and savings opening, digital bank onboarding, e-wallet registration, investment account opening, remittance and money service sign-ups, and corporate (legal person) verification. It is also used more widely for age verification and fraud prevention where a service must establish that a named individual is really present.

>See Also

• Face Recognition
• AI in Malaysian Banking
• PDPA Malaysia
• MyDigital Blueprint
• Deepfake