The KYC Verification Process: Step-by-Step from Identity to Decision

The KYC verification process can look deceptively simple from the outside: a subject submits documents, a check is run, a report is produced. In practice, each stage involves decisions about source quality, proportionality, consent, data handling and output structure that determine whether the result is genuinely useful or merely a completed form. This article walks through what a thorough, defensible KYC process looks like at each stage.

Stage 1: Define the Decision and Scope

Every verification process should begin with a question: what decision is this check designed to inform? A background check for a senior finance role requires different checks than one for a field operations contractor. Starting with the decision makes the scope selection principled rather than arbitrary.

• What is the nature of the role or relationship?
• What risk exposure does the organisation have if the information provided is inaccurate?
• What checks are proportionate to that exposure?
• Are there regulatory requirements that mandate specific checks?

Stage 2: Obtain Consent

Before any data is collected, the subject must be informed that a background check is being conducted and must consent to the processing of their personal data for that purpose. This is required under data protection legislation in most jurisdictions — including Kenya's Data Protection Act 2019 — and it is also good practice because it sets clear expectations and reduces adversarial dynamics.

Consent must be informed, specific and freely given. A buried clause in an employment contract or tenancy application is not adequate consent for a detailed background check.

Stage 3: Document Collection

The subject provides the identity documents required for the agreed scope. For a basic identity verification, this will typically be a national ID card, passport or alien ID. For checks involving credentials — academic qualifications, professional certifications, driving licences — the relevant documents are collected alongside the identity anchor.

Document collection should happen via a secure, audited channel. The Datapoint platform uses an encrypted submission portal that records what was submitted, when and by whom — creating an audit trail from the outset.

Stage 4: Document Authenticity Verification

The submitted document is examined for authenticity before any further checks are run against it. This involves checking security features, format compliance and, where the technology is available, machine-readable zone data. For Kenyan national IDs and passports, Datapoint queries the issuing government registry directly — confirming that the document number corresponds to a genuine issue for an individual matching the submitted data.

1. 1Visual inspection — Format, fonts, security features, holographic elements
2. 2MRZ/barcode validation — Machine-readable data extracted and validated
3. 3Registry query — Document number cross-referenced against issuing authority database
4. 4Liveness check — Where required, a biometric check confirms the submitter matches the document holder

Stage 5: Source Cross-Referencing

Once the identity anchor is confirmed, the agreed scope of checks is executed. Each check draws on a specific source with known characteristics. A police clearance certificate check does not use the same source as a driving licence validation; a sanctions screen is different from an adverse media search. The quality of each source — its currency, completeness and authoritative status — should be visible in the final report.

• National ID / Passport — IPRS / DCI registry query (Kenya)
• Alien ID — DCI Alien ID registry
• Driving licence — NTSA database
• Police clearance certificate — DCI CRB query
• PSV licence — NTSA licensing records
• Professional credentials — Issuing body registry (e.g., LSK for advocates, KMPDC for medical practitioners)
• Education certificates — KNEC / institutional registry
• Sanctions — OFAC, UN, EU, HM Treasury, local equivalents
• Adverse media — Structured public record search

Stage 6: Handling Unresolved Matters

Not every check produces a clear confirmed or clear denied result. Records may be absent from a database because they predate digitalisation. A name match on a sanctions list may have insufficient detail to confirm it relates to the subject. The issuing registry may be temporarily unavailable. A thorough KYC process records these as unresolved matters — explaining what could not be confirmed and why — rather than silently treating them as clear.

An unresolved matter is not a red flag. It is a gap in information that requires a human decision about how much weight to give it. The worst outcome is a report that treats the absence of a result as a positive confirmation.

Stage 7: Structuring the Output

The final report must be readable by the person making the decision — not only by compliance professionals. It should organise findings into three distinct categories:

1. 1Confirmed findings — Information that has been verified against an authoritative source and is accurate as stated.
2. 2Unresolved matters — Checks that could not produce a confirmed result, with the reason noted.
3. 3Attention items — Findings that are confirmed but require interpretation before a decision is made (e.g., an adverse media entry, a sanctions match that needs further review, a credential discrepancy).

Stage 8: The Decision

The verification report informs the decision; it does not make it. The decision belongs to the commissioning organisation, which must weigh the confirmed findings, unresolved matters and attention items against the nature of the role and the organisation's risk appetite. Automating the decision — passing or failing people based on any individual check result — creates legal exposure and is likely to produce both false positives and false negatives.

A KYC process designed at this level of rigour takes longer and costs more than a checkbox exercise. It also produces information that is genuinely useful — and a record that is genuinely defensible. For decisions that matter, that is the correct trade-off.