What is KYC?
KYC (Know Your Customer) is the process of establishing who your customer is at the moment you accept them. The purpose fits in one sentence: is the person opening this account who they claim to be?
The process answers three questions:
- Is the document genuine? The ID card, driving licence or passport is inspected through its security features and print quality.
- Is the person presenting it actually there? Liveness detection proves the person at the camera is physically present at that moment.
- Does the document belong to them? Biometric face matching compares the selfie against the photo on the document.
Verification is incomplete unless all three hold. A flow that only checks the document cannot stop an account opened with a stolen identity.
The legal basis
In Türkiye the KYC obligation is shaped by MASAK regulation, in Europe by the AML directives. On the data side, KVKK and GDPR apply — and under both, biometric data is a special category of personal data.
In practice that means you comply with identity regulation and data protection regulation at the same time. Establishing the lawful basis, providing the notice and, where required, obtaining explicit consent rest with you as the controller.
Why the manual process does not scale
Classic KYC rests on collecting paperwork and having a person read it. That model has three structural problems:
- Cost grows linearly with volume. Every new customer is another minute of review.
- Approval stretches. A user whose signup waits for days goes to a competitor.
- The error rate does not hold. What a tired reviewer misses is exactly what a model catches.
What digital verification changes
In a machine learning flow, document reading, liveness analysis and face matching run in a single API call and the result is delivered by webhook. You set the acceptance threshold to your own risk policy: everything above it is approved automatically, and only the borderline records reach a person.
The operational payoff is concrete — a fixed, predictable cost per verification, seconds instead of minutes, and an audit-ready record set.
Where to start
Decide which step of your signup flow the verification belongs to, write your acceptance thresholds against your own risk appetite, and settle your retention policy up front. If your policy rules out storage, Zero Data Retention deletes the raw images the moment verification completes, leaving only the result and the audit record with you.
