KYC document extraction for customer onboarding

Extraction, not identity verification

KYC has two document jobs that are easy to confuse. Identity verification asks whether a document is genuine and belongs to the person presenting it. Extraction asks what the document says. docRefinery does only the second: it fills the case file with names, numbers, dates and addresses, so analysts stop retyping them. Keep a specialist provider for authenticity, biometrics and sanctions screening.

What the case file needs from each document

Ownership percentages matter because rules set thresholds on them. In the United States, FinCEN's customer due diligence rule requires covered institutions to identify and verify any individual who owns 25 percent or more of a legal entity customer. Passports, ID cards, driving licences, utility bills and bank statements are catalogue types, detailed on the passport, utility bill and bank statement pages; certificates of incorporation and registry extracts are set up as a workflow or a custom type, trained at no charge.

Issuers rarely redesign their documents

Issuers are institutions, and institutions rarely redesign their forms. Machine-readable passports follow the ICAO Doc 9303 specification, and a given country's passport is the same layout for every holder. Utilities and banks print the same bill and statement for every customer. What changes is the applicant, not the layout. Each layout is learned once and remembered, and a re-issued design is re-trained when it first appears.

Why an empty field beats a confident guess

In KYC, the expensive failure is a plausible value nobody questions, not a blank. When a field is not on the document, docRefinery returns null instead of inventing one, and a reviewer sees an empty cell they can chase. When a value is there but hard to read, such as a smudged expiry date or a glare-covered document number, it comes back scored below your threshold and waits for a person. Thresholds are set per field, so document numbers and dates can demand far more than an address line. See confidence scores in document extraction.

The analyst makes the call

Decisions stay with your analysts. Low-confidence fields go to the extraction review queue, where the reviewer sees the original page with each value's location highlighted, corrects it, and every change is kept on the run. A failed workflow rule, such as an expiry date before the issue date, also flags the run for review.

What onboarding teams get around the data

• A single output for a mixed file. Passports, ID cards, bills and registry extracts all return the same format, so the case system needs one parser.
• Case-file names. Each field's Return as alias sets the key that comes back, such as id_number or date_of_birth, whichever your screening tools expect.
• Evidence behind the values. Page and box citations show an auditor or second reviewer where a name or date was read.
• Data minimisation by setting. The organisation decides what may be extracted, with owner, admin and member roles, so a parent's name or an address can stay off.
• Applicants from anywhere. 70+ languages and scripts are supported, for names and labels printed outside the Latin alphabet.
• Registry extracts without a project. Custom types are trained, hosted and re-trained at no charge, and a workflow starts from one sample document.
• Corrections that count. When an analyst fixes a misread, it can return as a suggested fix for that layout, and someone still has to accept it after it has been tested.
• Accountable access. API keys carry an expiry, can be revoked, and keep an activity log.

Sensitive data and deployment

Identity documents are highly sensitive. Enterprise plans support private VPC and fully air-gapped on-premises deployment, on models that run inside your network, so documents need not leave it. That is a deployment capability, not a compliance certificate. Data retention is configurable per plan, from 7 days on Starter to custom terms on Enterprise, and data is encrypted in transit and at rest. On certification: a SOC 2 Type II audit is in progress and no report has been issued yet; SSO is planned for Enterprise and is not available yet; and there are no data-residency commitments yet. For an evaluation on hosted plans, use specimen or test documents rather than real customer files.

Passing fields to case management

With your names set under Return as and one format for every document, your code writes fields to the case with a single mapping; authentication covers the API keys. An analyst can also export CSV, Excel or JSON. The Chrome extension, in early access and not in the Chrome Web Store yet, runs a document and auto-fills a web form, which suits case systems with no import route. Connectors and webhooks aren't available yet: integrations are in design on the roadmap.

KYC needs it does not meet

• You need identity verification, liveness, sanctions screening or fraud detection. docRefinery offers none of these.
• Your procurement requires a SOC 2 report today.
• You accept identity documents from many countries but see each one rarely, so few layouts repeat.

Onboarding friction has a cost. In an ABBYY survey of 1,623 IT decision makers, run by Sapio Research in September 2022, nine in ten businesses reported some abandonment during customer onboarding. That is a third-party figure about onboarding in general, not a measure of docRefinery.