KYC and identity verificationاعرف عميلك KYC والتحقق من الهوية

Know your customer (اعرف عميلك), or KYC, is the duty on a financial institution to know who it is dealing with before opening an account. It is three questions rather than one: does this person exist, is the person in front of you the same one, and are you allowed to deal with them.

A photograph of an identity card answers only one of three questions. KYC products package those questions into a journey a bank or FinTech can buy.

Why isn't a photo of the ID enough?

This is the first thing that irritates users. They photograph their ID, then are asked to photograph their face, then to move their head, then to wait for review. Why all of it when the document was already sent?

Because a photo of an ID answers one question out of three.

The first: is this document real? That is the easiest, and comparison against an official source settles it. The second: does this document belong to whoever is presenting it? A stolen ID passes the first and fails the second. The third: is its owner here right now? Someone holding a photo taken from Instagram passes the first two and falls at the third.

Hence the head movement or the smile, which is called a liveness check. It does not verify your identity. It verifies that a live human is in front of the camera rather than a photograph or a recording.

Build a product that treats the three as one question and a fraudster walks through it. Treat them as three separate systems and you exhaust the customer for nothing. The skill is knowing which question has been answered and which is still open.

Document, person, and moment

Know Your Customer, or KYC (اعرف عميلك), is the duty to understand who a provider is dealing with. It does not mean collecting the largest possible file. A payment company needs identity evidence proportionate to the service's risk. A small controlled test differs from an account able to receive millions of riyals and send them internationally.

The first question is whether the identity document is genuine and valid. A system reads the number, name, and expiry date, checks for manipulation and field consistency, and may compare the details with an authoritative source. A well-designed fake can convince the eye while an official record shows that its number does not exist.

The second question is whether the document belongs to the person presenting it. A fraudster may steal a genuine card. A relative may use its owner's card, even with permission, to open an account that the owner will not control. The journey therefore has to bind the face, data, and authentication channel to the person who will actually own the account.

The third question is whether that person is alive and present now. A liveness check (فحص الحيوية) attempts to distinguish a present human from a printed image, recorded video, or digitally generated face. Looking similar to an identity photograph is not enough.

Passing one question does not compensate for failing another. A document can be genuine and its owner alive while the person holding the phone is someone else. A face can match a forged card containing invented details. Identity is a chain of evidence rather than one captured image.

Onboarding is the beginning

KYC does not end when an account opens. Names change, documents expire, companies change ownership, and account behaviour can reverse. A provider keeps information current and repeats checks after defined events or on cycles proportionate to risk.

A trigger may be a request to increase a transfer limit tenfold. It may appear when an account signs in from a new device and country, then immediately adds a beneficiary. A sanctions list or relevant public status may change. In each case, old evidence is no longer enough for the new decision.

Ongoing checks do not require every customer to photograph a card every week. Where rules and systems permit, authoritative data can be validated in the background. An extra customer step can be reserved for a meaningful change in risk. Friction falls when the moment fits the reason instead of an arbitrary calendar.

The system also needs to know which information version supported a decision. If a document expires before a large transaction, an investigator needs the file's state when the transaction occurred. Updating a company address must not erase the previous address from the audit trail.

Nafath changes the evidence source

Saudi Arabia has a national digital-identity channel through Nafath. A person approves an identity request through a trusted government channel. The provider can bind the result to authoritative information instead of relying only on an uploaded card image.

This differs from asking a customer to photograph an ID and blink at the app's camera. In the second journey, the company collects a sensitive image, assesses its quality, resists forgery, and builds or buys facial and liveness checks. Nafath uses an approved integration with a national identity and authentication channel.

Nafath does not make every customer low risk. It may establish who the person is, but not the source of their wealth or the purpose of a company they represent. A genuine person can approve an account while following a scammer's instructions. Nafath improves identity evidence; it does not replace purpose and behaviour assessment.

The platform must still validate the integration result. It binds the request to one session and one customer, prevents reuse of an old result for a new account, and records the identifier, time, and outcome without retaining unnecessary secrets. Cancellation and expiry need clear failure states.

A company is not the human behind it

A corporate customer requires two levels of checking. The provider verifies the entity's existence, registration, and representative. It then identifies the beneficial owner (المستفيد الحقيقي), the human who ultimately owns or controls the company. A name on a commercial record is not enough when ownership passes through other layers.

One person may directly own 60 percent of a local shop, producing a short path. A foreign company may own a Saudi company while a holding company or fund owns the foreign parent. The provider traces the chain to natural persons or explains the control structure under the applicable rules.

A director is not always a beneficial owner. A professional employee can manage a company without owning it. A small shareholder might control appointments to the board or hold decisive voting rights. Ownership and control both matter.

The person opening the account also needs authority to act. A mandate, resolution, or registered capacity may establish that authority. The company and owners can be genuine while the employee requesting a transfer lacks permission. Entity identity and a human's authority to bind it are separate checks.

Corporate KYC continues after acceptance. A share transfer triggers new beneficial-owner, sanctions, and risk checks. A director change updates authorised representatives. The account should not remain connected to an employee who left a year ago.

Enhanced diligence follows risk

Enhanced due diligence (العناية الواجبة المشدّدة), or EDD, adds checks for higher-risk customers. It is neither a punishment nor an accusation. A prominent public function, a complex ownership structure, or a cash-intensive activity may require deeper understanding and higher approval.

EDD can include evidence of source of funds, source of wealth, and expected transaction purpose. It may require additional ownership documents, an interview, or senior-management approval. Each request should address a defined risk instead of collecting personal records because a checklist happens to be long.

Source of funds explains the money entering a specific transaction, such as proceeds from selling property. Source of wealth explains how a person built their financial position overall, perhaps through a business operated for twenty years. One can be clear while the other remains unexplained.

The product should not hide an extra check behind a generic error. It should tell the customer what evidence is needed, in which format, and with what expected timing, without exposing internal rules that attackers can exploit. A legitimate alternative route is needed when a customer lacks the usual document but has other reliable evidence.

Friction is measurable

Every additional request loses some customers, but guessing does not reveal how many. Teams should measure movement through identity start, document capture, liveness, Nafath return, and manual review. Voluntary abandonment, technical failure, and regulatory rejection need separate labels.

The data may show that customers leave because a camera cannot focus in poor light. Nafath may return successfully while the app loses the session. Small companies may not understand an ownership-document request. Compliance cost can come from poor implementation rather than the obligation itself.

Reducing abandonment cannot be the only target. Removing liveness may increase acceptance and stolen accounts. Making name matching too strict may reject legitimate spelling differences. Approval, rejection, fraud, manual review, and complaints need to be considered together.

A human route remains necessary for genuine unusual cases. A camera may be damaged, a customer's appearance may change after treatment, or Arabic and English name forms may differ. A reviewer can collect alternative evidence under a recorded policy, but should not bypass a mandatory check to satisfy a sales deadline.

A good team treats identity as an ongoing capability. It knows which evidence supports each claim, when that evidence expires, which event requires an update, and who may see the data. Friction can then concentrate at moments of risk instead of becoming a permanent burden for every customer.