KYC OCR: read the identity documents of an onboarding file and control them

KYC OCR is the step of a know your customer (KYC) process where a machine reads the documents a customer sends: the passport or ID card, often a proof of address, sometimes a bank statement. Koncile returns every field as structured data, checks the machine readable zone (MRZ) against the printed side, and gives each file a fraud score from 0 to 100. What it does not do, said first: it does not match the face of the person to the photo, test liveness, read the chip or screen names against sanctions lists. Those steps belong to other tools in the chain.

Where OCR sits in a KYC process

A KYC process answers three questions: who is this customer, is the document they sent genuine and unaltered, and is the person in front of the screen its holder. OCR answers the first one and feeds the second. The table below shows which step a KYC OCR covers and which it leaves to other tools.

Teams that only need the first three lines, for example a lender that already meets its customers or a broker that receives files by email, can run on OCR and document controls alone: passport, ID card OCR on both sides, proof of address. Teams whose regulator requires remote proof that the person is present need a biometric step on top: that is the line Koncile does not cross.

Which documents a KYC file usually contains

Regulations list the data to collect more than the documents. In the European Union, Article 22 of the anti money laundering Regulation (EU) 2024/1624 asks for all names and surnames, place and full date of birth, nationalities, the national identification number where applicable, and the usual place of residence; verification is done through « an identity document, passport or equivalent » or a qualified electronic identification. In the United States, the customer identification program rule for banks (31 CFR 1020.220) asks for name, date of birth, address and an identification number, and names « a driver's license or passport » as documents that may be used for verification.

Which document is accepted for which customer is a decision of the compliance team and its regulator. The OCR reads what it receives; it does not decide whether a driver license is enough in your jurisdiction.

What Koncile returns for a KYC file

One request per file, one JSON back per document. The example below is a passport and a proof of address sent together: each document is classified, read and controlled, and the response says when the names on both do not match. For the request itself and the field list of a passport, see the passport OCR API page.

{
  "documents": [
    {
      "type": "passport",
      "general_fields": {
        "surname": {"value": "DOE", "confidence": 0.99},
        "given_names": {"value": "JOHN MICHAEL", "confidence": 0.98},
        "document_number": {"value": "19AB12345", "confidence": 0.99},
        "date_of_birth": {"value": "1993-03-03", "confidence": 0.99},
        "date_of_expiry": {"value": "2031-03-01", "confidence": 0.99},
        "nationality": {"value": "FRA", "confidence": 0.99}
      },
      "fraud": {"score": 12, "level": "low", "signals": []}
    },
    {
      "type": "proof_of_address",
      "general_fields": {
        "holder_name": {"value": "JOHN DOE", "confidence": 0.97},
        "address": {"value": "12 RUE DES LILAS, 75011 PARIS", "confidence": 0.95},
        "issue_date": {"value": "2026-09-14", "confidence": 0.98},
        "issuer": {"value": "EDF", "confidence": 0.99}
      },
      "fraud": {"score": 64, "level": "medium",
        "signals": ["text layer edited after creation"]}
    }
  ]
}

Values are illustrations. In this example the passport is clean and the proof of address carries a medium score: the file was edited after it was produced. That does not prove fraud. It tells the analyst which document to open first.

Controls run on identity documents

• MRZ against printed fields: surname, document number, birth date and expiry date read in both zones must match. How the zone is built: MRZ guide.
• Check digits: recomputed on the MRZ of passports and ID cards.
• Expiry: the document is flagged when it has expired on the day of analysis.
• File forensics on PDFs: producer software, metadata, incremental saves and edited text layers.
• Consistency across the file: the name on the proof of address and on the bank statement is compared with the identity document.

The score goes from 0 to 100 in three levels: 0 to 39 low, 40 to 79 medium, 80 and above high. It is a signal to verify, never an accusation. The limit: a careful physical forgery, scanned or photographed, can pass the file controls, and a genuine card photographed under a lamp can get a medium score because of glare.

KYC OCR in a real onboarding flow

1. The customer uploads a photo, a scan or a PDF in your form or app, or sends it by email.
2. Your back end sends the files to the Koncile API, or a webhook picks them up from a shared inbox.
3. Koncile classifies each document, reads the fields and runs the controls; most files take a few seconds per page.
4. The JSON fills the customer record. Files with a low score and high confidence values go straight through.
5. Files with a medium or high score, or a low confidence value, go to an analyst with the signals that triggered them.
6. Your biometric and screening steps run as before, on data that no longer needs to be typed.

The gain is in the typing and in the triage. An analyst stops copying a passport number into a form and spends time on the files that show something. Whether that also shortens onboarding depends on the rest of the chain, which our comparison of the best KYC software breaks down layer by layer.

What makes KYC documents hard to read

• Phone photos: blur, glare on the laminate, a finger over the MRZ, a page cropped at the bottom. The response lowers the confidence level of the affected fields instead of guessing.
• Two sided cards: the back carries the MRZ, read by the same engine as our MRZ reader, and sometimes the address. A card sent with one side is read from that side and the response says the other is missing.
• Non Latin scripts: Arabic, Cyrillic, Greek or Chinese names are read and returned with the Latin transliteration given by the MRZ when there is one.
• Many designs: Koncile reads fields from the document itself, not from a fixed list of templates per country, so a new card design does not wait for an update.

Data protection

Identity documents are personal data under the GDPR. Koncile is SOC 2 Type II, documents are deleted after analysis and they are never used to train models. Details on the Koncile security page.

Pricing

20 free credits at signup, no card. Then from €199 per month for 1,000 credits: 1 credit per page for an extraction, 2 per page for a fraud analysis. A two sided ID card is two pages. Prices on koncile.ai. To see how Koncile compares with KYC platforms and OCR APIs, read our comparison of the best OCR API options for passports.

Sources

• Regulation (EU) 2024/1624 on the prevention of the use of the financial system for money laundering, Article 22 (EUR-Lex)
• 31 CFR 1020.220, customer identification program requirements for banks (eCFR)
• ICAO Doc 9303, machine readable travel documents