Video KYC: How Remote Identity Verification Works

TL;DR

• Video KYC replaces the branch visit with a live session: document presentation, face match, liveness detection, and a recorded audit trail.
• Regulators treat it as acceptable when it meets prescribed standards. India's central bank, for example, treats compliant video identification as equivalent to face-to-face identification.
• Customers typically need an original ID, a camera-equipped device, a stable connection and good lighting. Some jurisdictions add location rules.
• Rules differ by country: geotagging, encryption, timestamps, and audit requirements are set locally, so the control framework must be configurable.
• Fraud pressure is the main design constraint. Liveness checks, deepfake resistance and risk-based escalation matter more than the video call itself.

What video KYC is and what it verifies

Video KYC (often abbreviated VKYC) is a customer identification and due diligence step performed over live video. It answers three questions at once: is the document genuine, does the document belong to the person on camera, and is that person physically present and acting willingly.

The Reserve Bank of India describes its version, V-CIP, as an alternate method of customer identification with facial recognition and customer due diligence, carried out through a secure, live, informed-consent-based audio-visual interaction. Processes that meet the prescribed standards are treated on par with face-to-face identification under the Master Direction.

The principle is not limited to India. The FATF's Recommendation 10 is technologically neutral. As one academic analysis of remote identification notes, it does not restrict the form of identity documents, physical and digital documents stand on equal footing, and digital identification systems may be used if they capture the required data. The FATF's own guidance on digital identity lists high-resolution video transmission, allowing remote identification and proof of liveness, among the technologies that can support customer identification at onboarding.

In the United States there is no single mandated video format. Banks run their Customer Identification Program under the Bank Secrecy Act framework and choose the verification methods in their written program, so remote methods are a risk-based design decision rather than a prescribed product. Readers searching for video KYC often meet it first through Indian banking, where it is formalized, and that is why many examples below come from there.

How the video KYC process works step by step

Implementations differ, but the sequence is consistent. A Moneycontrol overview of the process describes scheduling a session, submitting documents through a secure link, a live video verification, facial recognition with a liveness check, and final approval with account activation. It also notes that some institutions add geolocation and background checks against government databases and watchlists, and that the whole process often takes under 30 minutes.

1. Initiation. The customer starts from a secure link or app, gives consent to the recording, and either joins a queue or books a slot.
2. Document capture. The customer submits the identity document, often as a scan or an electronic file, and shows the original on camera.
3. Live interaction. An authorized official, or an automated flow in unassisted models, asks control questions and requests actions such as holding the document at an angle or showing a blank sheet of paper.
4. Biometric matching and liveness. The face on camera is compared to the document photo, while liveness controls test for photos, replays, masks and synthetic media.
5. Risk checks. Sanctions, PEP and watchlist screening, device and location signals, and duplicate-identity checks run in parallel.
6. Decision and record. The case is approved, rejected or escalated to manual review, and the recording and metadata are stored for audit.
   The strongest programs treat step 5 as part of the same flow, not a later batch job. An identity that passes the video session but is later found on a sanctions list creates the same regulatory exposure as one that never was verified.

How live video, documents, biometrics and liveness work together

Each layer closes a gap the others leave open.

Document verification checks the integrity of the ID: security features, data consistency between printed fields and machine-readable zones, and signs of tampering. It tells the institution whether the document is plausible, not whether the person holding it is the rightful owner.

Biometric matching compares the customer's face to the document portrait. Serbia's National Bank, for instance, requires automated biometric matching between the captured facial image and the photograph in the identity document for automatic video onboarding. A match shows resemblance, but a photograph of the owner can produce one.

Liveness detection tests whether a real person is present at that moment. It can be active (the customer is asked to turn their head or respond to a prompt) or passive (the system analyzes the image stream without a prompt). The Serbian rules make liveness detection mandatory, active or passive.

The live session itself adds human or scripted unpredictability. India's IFSCA guidelines require face liveness and spoof detection and high-accuracy face matching using AI with randomness and anti-deepfake and anti-fraud checks. Randomness matters because a fixed sequence of prompts can be rehearsed or pre-rendered by an attacker.

Taken together, the layers produce evidence that the document is real, the face matches, the person is alive and present, and the interaction was not pre-recorded. Removing any one of them reopens a specific attack path.

What customers need for a video KYC session

The consumer checklist is short, though each bank adds local items. Published examples from Indian institutions show the typical pattern:

• Identity documents. HSBC India asks for the original PAN card and an Aadhaar offline eKYC XML file no more than three days old. Bank of Baroda lists the Aadhaar number, PAN, an Aadhaar-registered mobile number and an email address.
• Device and network. A phone, tablet, laptop or webcam-equipped desktop with a microphone and a stable connection. Karur Vysya Bank also asks for an updated Chrome browser with GPS, video and audio permissions.
• Environment. A well-lit room with a clear background. HDFC Bank additionally asks for a blank white sheet of paper and a black or blue pen, which the official may ask the customer to use.
• Location. Several of these banks require the customer to be physically in India, and HSBC states that customers must not use a VPN.
  For a global or US-facing product, the same logic translates into a pre-session checklist shown in the flow: acceptable documents, lighting guidance, camera permissions and a clear statement of any location restriction. Good guidance at this stage lowers abandonment and reduces the number of sessions that fail on quality alone.

Can video KYC be done at night?

It depends on the institution's operating model. Staffed sessions follow agent schedules, while unassisted or automated sessions can run continuously. HDFC Bank states its Video KYC desk is operational 24x7, and IDFC FIRST Bank also describes its service as 24x7. By contrast, American Express India offers sessions on non-holidays between 9:00 am and 9:00 pm, and Bank of Baroda lists 9 AM to 8 PM on working days.

For a business, availability is a conversion lever. Customers in other time zones or those who onboard after work hours abandon when they are told to return during office hours. Automating the verification path and reserving human agents for escalations is how operators extend coverage without staffing around the clock.

Regulatory requirements to design for

Video KYC is not governed by one global rulebook. The rules below are examples of how supervisors in different countries define acceptable controls, and each applies only in its own jurisdiction.

Jurisdiction Control requirements stated by the authority

• India (RBI) Recordings carry the customer's live GPS coordinates and a date-time stamp, and video quality must allow identification beyond doubt.
• India (insurance, IRDAI) End-to-end encryption at minimum AES 256, liveness checks against spoofing, geotagging to confirm presence in India, and recordings with GPS, date and time.
• India (IFSCA) Tamper-proof geotagging and timestamps, plus vulnerability assessment, penetration testing and a security audit of the infrastructure by CERT-In empanelled or accredited auditors.
• Serbia (NBS) End-to-end encrypted communication, qualified electronic timestamps on recorded images, mandatory liveness detection and automated biometric matching.
• Cyprus (CySEC) Technological neutrality: obliged entities may select or combine remote onboarding solutions subject to AML/CFT law, EBA Guidelines and FATF Guidance.
• Hong Kong (HKMA) iAM Smart is recognized as a digital identification system under the AMLO, and banks may keep using third-party vendor solutions for remote onboarding.

Two patterns stand out. First, supervisors increasingly ask for evidence integrity: timestamps, geotags, encryption and tamper-proof storage. Second, they ask for a documented assessment before launch. In Serbia, obligors must document a formal assessment of the technical solution, covering data collection, AML/CFT risk impact, operational and IT risks, identity-spoofing fraud risk and end-to-end process testing.

A useful starting point on who sets these rules is our overview of AML regulators you should know.

Fraud risks and the controls that reduce them

Remote verification moves the attack surface from a counter to a camera feed. Typical threats include forged or altered documents, presentation attacks with printed photos or replayed video, injected or deepfake streams, synthetic identities, coached customers, and one person opening many accounts.

The Monetary Authority of Singapore sets out a baseline in its circular on non-face-to-face customer due diligence. Institutions should use control questions, liveness checks to detect impersonation, staff training to spot fraudulent or tampered IDs, and additional checks through a different channel as appropriate, especially for accounts with higher money laundering and terrorist financing risk.

In practice, a resilient design combines:

• randomized challenges so the session cannot be pre-recorded;
• passive and active liveness analysis, with anti-deepfake detection;
• document authenticity checks against the machine-readable data;
• device, IP and location signals, including VPN and emulator detection where location rules apply;
• screening against sanctions, PEP, watchlists and adverse media during the same flow;
• risk-based escalation to manual review for ambiguous or high-risk cases;
• ongoing monitoring after onboarding, since identity risk does not end at account opening.
  Downstream controls such as transaction monitoring are effectively a bet on the correctness of the original identity. If that identity was fabricated, every later rule operates on false premises, which is why verification quality sets the ceiling for everything after it.

Perspective

Video KYC is often discussed as a customer-experience feature. We see it as an evidence problem. The question a supervisor asks is not whether a call took place, but whether the institution can prove who was onboarded, when, from where and under which controls.
That is why we build identity verification as one flow with screening, risk assessment and monitoring, not as separate tools. Document checks, biometric matching and liveness produce a verified identity. Sanctions, PEP and adverse media screening then test it in real time, and ongoing monitoring keeps testing it afterwards.
Regulation also differs by country, and so do expectations about data location. We offer both SaaS and on-premise deployment so that regulated institutions can keep sensitive biometric and identity data under their own control and configure the rules for each jurisdiction they serve.

Elvis

Choosing and deploying a video KYC solution

For banks, EMIs, payment service providers and iGaming operators, the selection criteria come down to evidence, configurability and integration.

Jurisdiction fit. List where customers are onboarded and map each regulator's requirements for timestamps, geotagging, encryption, recording retention and audit. Choose a platform where these are settings, not custom development.
Assisted, unassisted or hybrid. Staffed sessions suit high-risk or high-value customers. Automated sessions suit volume and round-the-clock coverage. A hybrid routes by risk score.
Spoof resistance. Ask how liveness, injection attack detection and deepfake checks are evaluated, and how often models are updated.
Data residency. Biometric data and video recordings are sensitive. Decide whether cloud processing is acceptable or whether on-premise deployment is required.
Integrated screening. Verification should hand its result directly to sanctions, PEP and adverse media checks, and to the customer risk profile.
Pre-launch assessment. Document the technical solution, fraud risks and end-to-end testing before go-live, as supervisors such as Serbia's central bank now require.
Measurement. Track completion rate, manual review rate, false rejection rate and time to decision, and tune thresholds to the risk profile of each segment.
For more background on the verification layer, see our guides on how identity verification works for banks, identity verification software for banks and the broader KYC process explained. Crypto platforms facing similar questions can read about KYC for crypto identity verification.

Finchecker for remote identity verification

Finchecker combines ID verification with liveness, automated KYC and KYB, sanctions and PEP screening, adverse media screening, ongoing monitoring and transaction monitoring in one platform. It is delivered as SaaS or on-premise, with configurable rules, audit-ready reporting and flexible API integration, so onboarding evidence and compliance decisions sit in the same record.

To see how remote verification would work for your jurisdictions and risk profile, review our ID verification service and automated KYC, then talk to Finchecker about a proof of concept through finchecker.eu.

Recommended

KYC Crypto: Identity Verification for Platforms
Automated KYC
What Is KYC? Meaning, Aim and Process Explained
Identity Verification Software for Crypto