Identity verification services: how to choose one (IDV, eKYC, eIDAS)

What is an identity verification service?

An identity verification service confirms, remotely, that a person is who they claim to be, by checking an identity document, their face, an authoritative database or an electronic ID. Choose one on four things: the methods your regulator accepts, the share of people who actually finish the flow, the evidence it hands back and how easily you can mix methods per person and per country.

Most buyers compare fraud detection first. Our data says start with completion. Of the identity verification checks created on Dotfile over the past year, 38% were never completed by the person invited, and 3.3% were rejected. That includes people who abandoned the whole onboarding, not only the identity step. Either way, you lose more than eleven people to the flow for every one the checks turn away.

Which identity verification methods exist?

There are five, and a serious provider stack covers more than one.

eKYC (electronic KYC) is used in two senses: broadly, any remote identity verification; narrowly, and in this guide, verification without a document, matching the attributes a person declares against two or more independent databases. Liveness detection proves that a live person is in front of the camera at the time of capture, not a photo, a mask or a replayed video. Our liveness and deepfakes guide covers it in depth, and the document check guide covers forensics on the document side.

What does the law require for remote identity verification?

The obligation is the same under every regime: verify identity on the basis of documents, data or information from a reliable and independent source. What changes is the list of accepted means.

Today, EU law is the directive as transposed nationally. Article 13(1)(a), Directive (EU) 2015/849, as amended in 2018, accepts "electronic identification means, relevant trust services as set out in Regulation (EU) No 910/2014 or any other secure, remote or electronic identification process regulated, recognised, approved or accepted by the relevant national authorities". That last clause is why national schemes matter: France certifies remote identity verification providers under ANSSI's PVID framework, and Germany's BaFin sets the rules for video identification. The EBA Guidelines on remote customer onboarding (EBA/GL/2022/15), which apply since 2 October 2023, require liveness detection in every unattended solution (paragraph 41(c)).

From 10 July 2027, the AMLR applies directly. Article 22(6), Regulation (EU) 2024/1624 gives two routes to verify a customer: "the submission of an identity document, passport or equivalent and, where relevant, the acquisition of information from reliable and independent sources", or "electronic identification means" meeting the eIDAS assurance levels "substantial" or "high" and "relevant qualified trust services". Read literally, a database check on its own fits neither route for the customer. It fits Article 22(7) for beneficial owners, or sits next to a document. AMLA had until 10 July 2026 to draft the technical standards listing the reliable sources and eID attributes (Article 28(1)(d) and (e)); they will settle the detail.

In the UK, regulation 28(19) of the Money Laundering Regulations 2017 treats an electronic identification process as a reliable independent source if it is "secure from fraud and misuse" and capable of providing appropriate assurance that the person is who they claim to be.

How do you choose an identity verification service?

Six questions separate a provider that works in production from one that demos well.

1. Which methods does it support, per country? A cross-border business needs document and liveness, eKYC where databases are good, agent-led video where it is expected and eID as the EU Digital Identity Wallet arrives.
2. What is the completion rate, not the pass rate? Ask for the share of people invited who finish. Then test it on your own users, on mobile, in your languages.
3. What does it catch? Document authenticity, face match, liveness and resistance to synthetic video injected into the camera feed. Ask which standard the liveness was tested against (ISO/IEC 30107-3 for presentation attacks).
4. What evidence comes back? Images, video, extracted data, reason codes for each control. An approval without a reason is useless in an audit.
5. Does it compare with what the customer declared? Extracted name and date of birth must match the case, or the check proves the wrong person.
6. Can you mix and switch? KYB files carry several people. You will want liveness for the signatory and a lighter check for each beneficial owner, and the option to change provider without rebuilding your onboarding.

Price per attempt is the wrong unit. Divide it by your completion rate: a check at €1.50 per attempt with 62% completion costs €2.42 per verified person.

Worked example: one KYB file, three people, three methods

A fictional Irish payment institution, Linden Pay, onboards Atelier Rive SAS, a French company. Three people need verifying. The example is read under the AMLR, which applies from 10 July 2027; today the same duties sit in Article 13(1), Directive (EU) 2015/849.

Claire's video verification comes back with a data comparison failure: the form says "Claire-Marie", the passport says "Claire Marie". She corrects it in the portal and the check passes. Tom's eKYC returns a 2-source pass. Ines never opens the link. Two weeks later the case is still waiting on her, which is the single most common way an identity check fails.

What the data says about identity verification

Based on identity verification checks created on Dotfile over the past year and at least 30 days old; aggregates only.

• 38% were never completed by the person invited.
• 57.9% were approved and 0.7% were sent to a person for review.
• 3.3% were rejected.

The gap between 38% and 3.3% is the case for choosing on completion first, and for chasing the invitation as hard as you analyse the result.

Frequently asked questions

What is the difference between IDV and eKYC?

IDV checks a document and, with liveness, the person holding it. eKYC checks declared data against databases and needs nothing from the user. eKYC is faster and cheaper; IDV proves presence.

Is eKYC enough under the AMLR?

For a natural person customer, Article 22(6) names an identity document or an eID. Use eKYC alongside a document, or for beneficial owners under Article 22(7), until AMLA's technical standards say more.

Can you automate identity verification?

Yes, for most people. The provider captures and analyses the document, the face and the data; you decide whether its approval or rejection closes the check automatically, and send the rest to an analyst.

Will the EU Digital Identity Wallet replace identity verification providers?

Not soon. Each Member State must offer a wallet within 24 months of the implementing acts (Article 5a(1), Regulation (EU) 2024/1183), and banks and financial services that must use strong user authentication must accept it within 36 months, on the user's request (Article 5f(2)). It becomes one more method, not the only one.

How is identity verification different in KYB?

A KYB file verifies several people: the representative, every beneficial owner, sometimes directors. See the KYB process and UBO verification guides, and our explainer on how identity verification works.

Where Dotfile fits

Dotfile orchestrates the methods rather than replacing them. The liveness ID verification check runs on Veriff, Checkout or Onfido, the automated ID document check on IDnow or Veriff, IDnow VideoIdent covers agent-led video and eKYC runs with GBG. Templates assign a method per role, extracted data is compared with the case and you choose whether provider decisions approve or reject automatically. See the identity verification documentation.