8 Documents for KYC Verification and How to Check

Document collection can lose customers before verification even begins. In 2025, 79% of banks surveyed said document collection was where customers most often dropped out of onboarding, according to nCino's summary of Celent's survey of 409 banking professionals. Choosing the right documents for KYC verification is therefore an operational control, not just a compliance formality.

A legitimate applicant can submit an unreadable photograph, the wrong supporting document, or a valid ID that your policy doesn't accept. Manual reviewers then chase replacements, interpret unfamiliar formats, and reconcile names across records. Basic optical character recognition, or OCR, doesn't solve that problem. It reads text, but it doesn't establish whether a document is acceptable, current, or consistent with the customer's identity.

Document data extraction turns document contents into structured fields that software can validate and use. A production pipeline also needs classification, capture-quality checks, cross-document comparisons, and clear escalation rules.

Keep these evidence categories separate:

• Identity evidence establishes who the applicant is.
• Address and financial evidence supports residence, income, or source-of-funds checks.
• Corporate evidence establishes the legal entity and helps identify its representatives and owners.

The following document types cover those different jobs. Acceptance still depends on your jurisdiction, product, customer profile, and documented risk policy.

1. National Identity Card (ID Card)

A national identity card is a set of fields to extract and validate, not just an image to store. Common fields include legal name, date of birth, nationality, document number, portrait, and validity dates. Issuers vary, so set rules by country and card type rather than assuming every field appears in the same place.

The European Banking Authority's remote-onboarding guidelines call for readable, sufficiently clear captures and a match between the customer's visible information and submitted documentation. Treat image quality and identity matching as separate checks from text extraction.

Capture and validate before approval

Keep the printed name and its normalized matching value as separate fields. This preserves the original evidence when accents or surname order differ from the application.

• Capture quality: Require the full card, visible edges, readable text, and an unobstructed portrait.
• Document validity: Parse expiry dates using rules for the issuer. Treat missing or unreadable dates as unresolved, not valid.
• Identifier checks: Apply the issuing country's format and checksum rules where available.
• Identity consistency: Compare extracted fields with the application and send material differences for review.

A cropped surname calls for a targeted recapture request. Don't guess the missing text or reject the applicant automatically. For cards from different countries, identify the issuer before applying country-specific field rules. The French national ID card extraction guide covers a specific card format that can inform extraction-schema design.

For a visual companion to the document-processing workflow, use the video below.

2. Passport

A passport offers useful redundancy: its visible data page and machine-readable zone (MRZ) represent overlapping identity information. Extract both, then compare them. Reading only the easiest region discards a valuable consistency check.

FinCEN's Customer Identification Program guidance describes risk-based documentary and non-documentary verification, with passports and driving licences among typical documentary examples. It doesn't make a particular document universally mandatory, so passport acceptance should follow your written procedures rather than an assumed global rule.

A dedicated data-page capture helps customers avoid unreadable uploads.

Use the MRZ as a cross-check

Extract name, date of birth, passport number, issuing state, nationality, and expiry date wherever present. Preserve raw MRZ characters separately from parsed values, and record whether available check digits passed.

The passport MRZ guide explains the document region your extraction schema needs to handle. Name comparisons must allow for documented transliteration and truncation rules without treating unrelated names as equivalent.

For example, a bank could compare the visible birth date with the parsed MRZ birth date. A disagreement should trigger review or recapture, depending on image quality, rather than letting the higher-confidence OCR output overwrite the other value.

Practical rule: A valid MRZ checksum supports data consistency. It doesn't prove that the passport is genuine or that the applicant owns it.

Guide applicants to flatten the data page and avoid reflections. Route expired documents through your defined exception process, and keep the extraction output, validation results, and final decision linked in the audit record.

3. Residence Permit and Foreigner Identity Number (NIE in Spain)

A Spanish NIE is an identifier, not proof of residence status. Check the document that carries the number to establish what it supports, whether it is valid, and whose identity it records.

Many people worldwide lack documentary proof of identity. Verification flows should therefore accept locally appropriate evidence rather than rely on a passport-only path.

Separate the number from the document

Create distinct fields for identifier, document type, issuing authority, permit category, issue date, and expiry date. A valid identifier format does not establish the validity or purpose of its supporting document.

• Classification: Identify whether the upload is a residence card, a certificate, or another document containing an identifier.
• Format validation: Check the identifier's applicable pattern and checksum. Don't infer immigration status from the result.
• Acceptance rules: Define which permit types and supporting-document combinations meet each requirement.
• Lifecycle checks: Route expired credentials or reported status changes for review.

For a lender onboarding a foreign resident, the passport may support identity verification while a residence document supports a separate eligibility check. Link both documents to the same person, but record which requirement each one satisfies.

If surnames differ across records, compare transliteration, surname order, and supporting evidence before treating the difference as a conflict. Preserve the extracted values alongside any normalized forms.

Route unfamiliar permit layouts to a supported review path. Automatically classifying every unrecognized layout as fraudulent can exclude valid applicants.

4. Driving Licence

A rental company needs more than a readable name. It may need to establish whether the applicant holds a current licence for the requested vehicle category, while its identity workflow separately checks that the licence belongs to the applicant.

That makes a driving licence a useful example of identity evidence versus service eligibility. A document can support identity verification without satisfying every operational requirement.

The FATF consultation guidance on financial inclusion emphasizes risk-based evidence requirements and cautions that copying and retaining identity documents can introduce privacy, fraud, and discrimination risks. Collecting more images isn't automatically a stronger control.

Keep identity, entitlement, and address separate

Extract holder name, birth date, licence number, issuer, validity dates, and vehicle categories where printed. If the document includes an address, treat it as a distinct attribute with its own acceptance rules.

• Expiry checks: Identify whether a date applies to the card, a driving entitlement, or a particular category.
• Category checks: Validate the relevant entitlement against the requested service.
• Address checks: Don't assume a printed address proves current residence.
• Capture handling: Support the accepted document formats without forcing every licence into a card-only template.

A mobility platform could extract the licence category and expiry date, then route the identity attributes into its existing applicant-matching workflow. A missing category should produce an eligibility exception, not a fabricated default.

A readable driving licence can still be insufficient evidence for the specific decision you're making.

Older formats, reverse-side restrictions, and renewal annotations need deliberate handling. Require the relevant sides or pages and preserve the relationship between each extracted field and its source image.

5. Utility Bill (Proof of Address)

A utility bill supports an address claim, not a complete identity claim. Electricity, gas, water, and telecommunications documents can contain a customer name, service address, billing address, issue date, account reference, and provider details, but those fields don't always describe the same person or location.

The EU Fourth Anti-Money Laundering Directive requires verification using reliable, independent sources and retention of relevant due-diligence records for at least five years after the relationship ends or the occasional transaction is completed. It doesn't establish a universal utility-bill freshness rule for every onboarding workflow.

Address extraction must distinguish where a service is supplied from where correspondence is sent.

Match the service address

Define service address and billing address as separate fields. The utility bill guide is useful for understanding the document category before deciding which attributes your policy accepts.

Automate these checks:

• Document freshness: Compare the issue date with your approved maximum age. Don't invent a universal regulatory cutoff.
• Name comparison: Normalize spacing and accents, but preserve differences requiring explanation.
• Address comparison: Parse apartment, building, street, locality, and postal information separately.
• Account-holder exceptions: Route household, landlord, or business-name bills through a documented alternative-evidence process.

Say a neobank receives an electricity bill whose correspondence address matches the application, but whose service address differs. Matching the first address found would approve the wrong evidence.

An energy retailer might also extract a CUPS supply-point code, contracted power, and consumption for contract processing. Those fields serve a different workflow and shouldn't become mandatory KYC attributes just because they're available.

6. Bank Statement

A bank statement can support account ownership, address verification, or source-of-funds assessment. Those are different checks, and the extraction schema should reflect the purpose of collection.

For account ownership, the key fields may be account-holder name, institution, and account identifier. For financial assessment, add the statement period, currency, opening and closing balances, and transaction rows. Don't extract a complete spending history when a narrower check will do.

Reconcile pages before transactions

Multi-page statements fail in predictable ways. Extraction can duplicate repeated headers, omit continuation pages, or confuse transaction dates with posting dates. Mixed uploads can also contain unrelated statements and receipts.

• Document boundaries: Split combined PDFs into their underlying documents, then preserve page order within each statement.
• Period coverage: Check that the supplied statements cover your policy's required window without unexplained gaps.
• Ownership matching: Compare the account-holder name against verified identity data, with explicit joint-account handling.
• Financial consistency: Reconcile balances and transaction amounts where the statement format supports it.

For example, a lender assessing salary deposits should identify recurring employer credits rather than treating every incoming transfer as income. Transfers between the applicant's own accounts need separate treatment.

Engineering note: Keep transaction extraction errors separate from identity mismatches. They require different review actions and different customer messages.

A statement image also doesn't independently prove that every displayed transaction occurred. Use proportionate issuer verification or other corroboration when the risk warrants it.

Limit transaction-data access by role and purpose. Define what you retain, why you retain it, and which system holds the authoritative evidence, rather than copying full statements into every downstream application.

7. Payslip (Proof of Income)

A payslip supports an income claim; it doesn't replace identity verification. Its useful fields include employee name, employer name, pay period, currency, gross pay, deductions, and net pay.

The extraction challenge isn't just layout variation. Payroll documents may contain current-period amounts alongside year-to-date totals, employer contributions, reimbursements, and correction entries. A model that returns the largest visible salary figure can produce a plausible but incorrect result.

The distinction between payroll components matters when checking income.

Validate the pay period and payment

Use explicit field names such as current-period net pay, year-to-date gross pay, and pay-period end date. A generic field called salary is too ambiguous for production decisioning.

• Period continuity: Require the recent consecutive periods specified by your affordability policy.
• Arithmetic checks: Reconcile gross pay, deductions, and net pay while accommodating clearly identified adjustments.
• Deposit matching: Compare net pay with bank credits using documented allowances for timing and split payments.
• Employment consistency: Compare employer names with supporting employment evidence where required.

Consider a consumer lender that extracts net pay from successive payslips and compares it with bank deposits. A reimbursement or payroll correction shouldn't automatically count as recurring income.

A landlord platform might instead compare the employer and employee names with an employment-verification record. The output should distinguish a missing field from a conflicting field so reviewers know what to request.

Create an alternative path for self-employed applicants and people without conventional payroll records. Tax documents, business records, or other accepted evidence may be appropriate under the applicable policy. Repeatedly asking those applicants for a payslip won't resolve the underlying evidence mismatch.

8. Certificate of Incorporation (Company Registration Extract)

A certificate of incorporation establishes a company's formation. A current registry extract may provide additional information about status, address, directors, or ownership. They aren't interchangeable, and neither automatically proves who ultimately controls the business.

The EU customer-due-diligence framework requires customer identification and verification, identification and reasonable verification of beneficial owners, and verification of people acting on the customer's behalf. A corporate-document workflow therefore needs to connect the entity to the relevant natural persons.

Build a linked corporate record

Extract legal name, registration number, registry jurisdiction, legal form, registered address, document date, and listed representatives. Treat ownership information as present only when the document contains it.

A payments company onboarding a merchant could use the registration number and jurisdiction to retrieve the corresponding registry record. It would then verify the authorized representative and investigate the ownership chain under its applicable rules.

• Registry cross-check: Match the legal entity using the registration number and jurisdiction, not the name alone.
• Status verification: Confirm current status through an appropriate registry source rather than relying on an old formation document.
• Freshness policy: Apply your documented requirements for current extracts without presenting an internal cutoff as universal law.
• Ownership linkage: Connect relevant owners and controllers to their identity records and supporting ownership evidence.
• Representative authority: Verify that the person opening the account can act for the entity.

A legal-services workflow may need to follow ownership through intermediate companies. Store each ownership relationship separately, including its supporting document, instead of flattening the chain into a list of names.

Classify incorporation certificates, registry extracts, shareholder records, and personal IDs separately. They belong in the same case, but they answer different verification questions.

KYC and KYB Documents at a Glance

Document	Proves	Common Fields Extracted	Typical Recency Rule	Main Failure Mode
National Identity Card (ID Card)	Identity and nationality	Name, date of birth, nationality, document number, expiry date	Must be unexpired	Glare or blur; country-specific layouts; expired or altered cards
Passport	Identity and nationality	Name, document number, nationality, date of birth, sex, expiry date	Must be unexpired	Glare on the data page or mismatch between visible text and MRZ
Residence Permit and Foreigner Identity Number (NIE in Spain)	Identity and residence or permit status	Identification number, nationality, permit type, expiry date	Must be valid; re-verify before expiry	Varying formats and permit rules; gaps during renewal
Driving Licence	Identity and, where shown, address and driving eligibility	Name, date of birth, licence number, categories, issue date, expiry date, sometimes address	Must be unexpired	Outdated address or inconsistent layouts
Utility Bill (Proof of Address)	Current residential address	Account holder name, service address, billing date, provider details	Commonly issued within the last three months	Bill is in someone else's name, forged, or has a changed layout
Bank Statement	Account ownership, address, financial activity, and source of funds	Account holder, account number or IBAN, statement period, transactions, balances	Commonly covers three to six months, depending on policy	Multi-page extraction errors or inconsistent bank formats
Payslip (Proof of Income)	Employment and income	Employer and employee names, pay period, pay date, gross pay, deductions, net pay	Commonly request the three most recent consecutive payslips	Forged figures or layout variation
Certificate of Incorporation (Company Registration Extract)	Company existence, registration, and ownership details	Company name, registration number, legal form, registered address, directors, issue date	Usually issued within the last three months	Outdated or incomplete ownership information; varying registry formats

Build Your Verification Checklist and Automate It

The best documents for KYC verification are the documents that satisfy a defined evidence requirement in a particular market. A passport, utility bill, payslip, and company extract shouldn't all enter the same generic approval rule.

Build the checklist around evidence purpose, extracted fields, validation rules, and exception handling. Then test the complete workflow, including recaptures and manual review, rather than measuring extraction on clean sample documents alone.

Turn policy into executable checks

• Choose primary evidence by market: Specify accepted issuers, document types, and fallback combinations.
• Check capture quality first: Return actionable instructions for blur, glare, cropping, or missing pages.
• Enforce validity and freshness: Separate document expiry from policy-based recency requirements.
• Validate field formats: Apply relevant date, identifier, checksum, and account-format checks.
• Cross-check evidence: Compare names, addresses, dates, ownership relationships, and financial values without overwriting conflicts.
• Record the decision: Preserve the evidence reference, extracted values, validation results, policy version, and reviewer action.

Yes, you can automate extraction from KYC documents. Automated extraction alone isn't complete KYC verification. Identity matching, authenticity assessment, screening, and risk decisions still need appropriate controls and integrations. Glentorion's discussion of KYC for regulated firms provides a complementary service-model perspective.

At Matil, we combine OCR, classification, validation, and workflow orchestration through a single API, with pre-trained identity-document, bank-statement, and payslip models. Flexible schemas support rapid customization, while automatic classification and PDF splitting help process mixed uploads. Accuracy exceeds 99% in multiple use cases, but teams should validate performance against their own issuers, capture conditions, and critical fields.

Our security framework includes GDPR, ISO 27001, and AICPA SOC standards. We act as a data processor under the customer's instructions. Retention requires particular care: we don't use customers' personal or confidential document data to train public generative models or models shared with other customers, but that isn't the same as zero operational retention. By default, documents and results are retained for 12 months for audit, traceability, and support, then deleted automatically.

Start with a representative document set and approved field-level acceptance criteria. Measure correction rates, exception reasons, and reviewer workload alongside extraction accuracy. Automate clear cases, give reviewers specific unresolved checks, and keep the compliance decision explainable.

---

Matil offers document extraction, classification, validation, and workflow automation for identity documents and supporting financial evidence. If you're evaluating a KYC document pipeline, visit Matil to discuss your document types, required fields, and exception-handling workflow.