Read our white paper on AI forgeries in 2026
New AI fake detection model. Try it now
  1. Home
  2. Solutions
  3. KYC and KYB

OCR extraction and document verification for KYC & KYB

The document automation tool that combines state of the art OCR with authenticity checks on every document.

  • 22k+ users
  • SOC 2 and GDPR
  • Try for free
Talk to an expert
4.6 / 5 on Trustpilot
Sample US passport being scanned

The document checker used by insurers, banks and large companies

4.8 / 5
Toyota Assurances Meelo Servier Sonepar Epson Next & Go MG Motor HealthNet Homecare
Luxembourg School of Business Bilfinger Yomoni CMAM AND-e ADN Solutions Ecotable Cerfrance
In short

Which documents are required for KYC and KYB verification?

For an individual, a KYC file gathers a valid government issued photo ID, a recent proof of address and, depending on risk, proof of income or source of funds. For a company (KYB), add a registration certificate or register extract, the articles of association, the identity of the beneficial owners and bank details in the company's name. The exact list depends on the country and on your risk policy.

  1. IdentityID card, passport or residence permit, valid. The selfie and liveness belong to biometric tools.
  2. AddressUtility or phone bill, bank statement, tax document: recent, in the customer's name and at the declared address.
  3. Income and fundsPay stubs, tax documents, statements: asked under enhanced due diligence or to justify the source of funds.
  4. CompanyRegistration certificate or register extract, articles of association up to date, list of directors.
  5. Beneficial ownersMore than 25% of shares or voting rights in the UK and France, 25% or more in the US, or control by other means.
  6. Bank detailsAccount in the customer's or the company's name. In France, a first payment from that account counts as a remote verification measure.
Documents

KYC documents and business verification documents checked in a file

ID documents

ID card, passport, residence permit: photo, printed fields, edited areas, template by country and year.

Proof of address

Name, address, date and supplier of a utility or phone bill.

Bank details

Account number, holder and bank extracted, holder compared with the declared customer.

Bank statements

Source of funds: balances recalculated, deleted lines, PDF rewritten after the export.

Tax documents

Declared income, household details, tax address and template of the tax authority.

Pay stubs

Gross, deductions and net recalculated, payroll software template, employer found in registers.

Company registration documents

Company number, directors, date of the extract and template of the register.

Articles and beneficial owner declarations

Capital, shareholding, directors and signatories extracted to document the beneficial owners.

Method

How fake documents get through KYC onboarding

Biometrics made a fake identity harder to pass in front of the camera. Fraudsters moved to the documents around the identity, which nobody looks at closely.

The proof of address, weakest link

It is the easiest document to make: a PDF bill, a name and an address replaced, a date made more recent to pass under the three months. In France, many energy bills and tax notices carry a 2D-Doc, a signed code that holds the original data and can be compared with the visible text; its absence on a supplier that usually prints one is already a signal. Most UK and US bills carry no such code, so the file itself has to speak: producer software, fonts, comparison with the bills known from the same supplier, and the date of the last save against the date printed on the bill.

The substituted bank details

Bank details decide where the money will go, or where it will come from. At onboarding, fraud takes two forms: an account in a third party's name, or a bank details document edited to match the declared identity. The Banque de France puts manipulation fraud at €516 M in 2025, more than 40% of payment fraud in France, account number substitution included. Basic checks: holder identical to the customer, account number check digits valid, bank existing. Koncile runs them on every bank details document, and checks on top that the file has not been modified.

UBO verification: the edited register extract and the shell company

A register extract is a PDF, so it can be edited: extract date made more recent, director replaced, capital rounded up. In France, extracts issued by Infogreffe carry a verification code to enter for free on controle.infogreffe.fr, one at a time; at portfolio scale, that no longer holds. In the UK, Companies House made identity verification mandatory for directors and persons with significant control from 18 November 2025, which raises the bar on who stands behind a company, not on the PDF you receive. Koncile cross checks the company number with the registers, compares the extract with the register's template and reads its metadata. The underlying question remains: who controls the company. Articles and beneficial owner declarations must tell the same story.

Koncile does not replace biometric identity verification: the biometric provider verifies the person, Koncile verifies the file.

Checks

KYC OCR: read and check every document

KYC OCR is first about no longer retyping. At Koncile, the same reading serves the check: the extracted fields and the fraud score arrive in the same response.

KYC automation: structured fields, not raw text

A classic OCR returns text. A KYC file needs fields: surname, first names, date of birth, document number and expiry date, address, account number, company number, directors. Koncile relies on one template per document type, with over 99% accuracy on key fields, in several languages, on PDFs as on photos taken at an angle. Korint runs very different documents through the same flow: ID card, bank details, private hire licence, driving licence, no claims statement, vehicle registration, company extract, lease and photos.

KYC document verification: the customer's name on every document

The most profitable check is also the simplest: verify that each document is in the name of the person signing up. At Meelo, a French credit fintech, Koncile reads the supporting documents at onboarding (address, pay stubs, tax documents, bank details), checks they are in the customer's name and extracts the account number that will serve for the direct debit mandate. A document in a third party's name comes up as an anomaly, with the document concerned. The analyst decides: a partner hosting the applicant can be legitimate, a stranger much less so.

Alongside Onfido, Veriff, IDnow or Sumsub

These solutions verify the person: selfie, liveness, face compared with the photo, chip read when there is one. Koncile verifies the file: authentic or edited, issued or not by the issuer it displays. The two complement each other. The typical flow hands identity and selfie to the biometric provider, then sends Koncile the ID document for a second opinion on edits, and every other document in the file. 1stKYC, a KYC platform, integrates Koncile through the API inside its own product.

A readable reason, test by test

A compliance team must be able to explain a refusal, to the customer as to the regulator. 1stKYC set that requirement from day one: a fraud reason that can be explained and defended. Koncile returns a score from 0 to 100 and a reason for every test. Calibration matters as much: documents modified a few minutes after their creation by a scanning app were coming out on alert, when that is the normal behaviour of those apps. The check was recalibrated, not bypassed.

AI based KYC and AI for AML: what each model does

Three different jobs hide behind the words. AI identity verification is the biometric provider's work: matching a live face with the photo on the ID. KYC AI, as Koncile practises it, is file analysis: reading the fields of every document and judging whether the file was edited, generated or produced by another software than its issuer's. AML AI, finally, watches transactions and screens names against sanctions lists once the relationship exists; Koncile does not do that part. What it feeds into your AML tooling is cleaner: income and source of funds documents already read, recalculated and scored, with the reason attached.

Case studies

What AML rules ask of documents in the EU, the UK and the US

Three regimes, one idea: identify the customer, then verify on documents or information that do not come from the customer alone. Here is what is true and sourced.

EU: from national codes to a single regulation in 2027

Today each member state applies its own transposition of the EU directives. In France, obliged entities (banks, payment institutions, insurers, finance companies, crypto asset providers, notaries, accountants and others) verify identity on a valid official document with a photo, or on a register extract less than three months old for a company, and a beneficial owner is anyone holding more than 25% of capital or voting rights or exercising control by other means (Monetary and Financial Code, articles R561-5-1 and R561-1). The 2024 EU package created AMLA, the European anti money laundering authority based in Frankfurt (Regulation (EU) 2024/1620), and Regulation (EU) 2024/1624, the AMLR, applies directly in every member state from 10 July 2027, with Directive (EU) 2024/1640 to be transposed by the same date. The vigilance rules will then be the same across the Union.

UK: the Money Laundering Regulations 2017

Regulation 28 requires the regulated firm to identify the customer and verify their identity, and for a company to obtain and verify its name, company number and registered office, then take reasonable measures to verify its directors and beneficial owners. Verify means on the basis of documents or information obtained from a reliable source which is independent of the person whose identity is being verified; documents issued by an official body count as independent even when the customer provides them. A beneficial owner is an individual who ultimately owns or controls more than 25% of the shares or voting rights, or otherwise controls the company (regulation 5). Since 18 November 2025, directors and persons with significant control must also verify their identity with Companies House.

US: the CIP and CDD rules

A bank's Customer Identification Program (31 CFR 1020.220) collects four items before opening an account: name, date of birth, address and an identification number, then verifies them through documents, such as a driver's license or passport for an individual and, for an entity, documents showing its existence such as certified articles of incorporation, a government issued business license, a partnership agreement or a trust instrument, or through non documentary methods. The CDD rule (31 CFR 1010.230) adds beneficial ownership: each individual who owns 25 percent or more of the equity of a legal entity customer, plus one individual with significant control, verified with the same kind of procedures. In February 2026, FinCEN issued exceptive relief on when the beneficial owners of an existing customer must be identified again.

This summary does not replace your compliance officer or your regulator's guidance.

Data

What onboarding files taught us

What companies say about document fraud, and what we see in our customers' flows.

1 in 5working adults in France already faced a forged document (Ipsos barometer, 2026)
7%of companies consider themselves fully prepared for these risks (same barometer)
5%of files manipulated or transformed across 1.6 million documents processed by Koncile
30+external databases cross checked, from company registers to data leaks

One working adult in five has already seen a forged document, and barely one company in fourteen says it is ready. The barometer is French; we have no equivalent UK or US survey to cite. In our flows, 5% of files show a manipulation or a transformation. Transformed does not mean fake: a rescanned document, one compressed by an app or saved again changes its technical signature without anyone cheating. In KYC, a false positive is expensive, an honest customer blocked at sign up. That is why Koncile calibrates each check by issuer and by channel, and why the metadata library stays specific to each customer, with no personal data in it.

Source: Ipsos barometer, 2026; Koncile data 2026.

Clients

They verify their files with Koncile

See all our customers

KYC platform that calls Koncile through the API inside its own flow, notably on Belgian ID cards, with one requirement: a fraud reason that can be explained and defended.

One flow for very different documents: ID card, bank details, private hire licence, driving licence, no claims statement, vehicle registration, company extract, lease and photos.

Supporting documents read at onboarding, customer's name verified on every document, income rules applied and account number extracted for the direct debit mandate.

Read the case study

AMOM

Company register extracts checked at onboarding, with an anti money laundering lawyer keeping the final say on flagged files.

Frequently asked questions

Short answers, with figures when we have them.

Talk to us

  1. For an individual: a valid government issued photo ID, a recent proof of address and, depending on the risk level, proof of income or source of funds (pay stubs, tax documents, statements). For a company: a registration certificate or register extract, articles of association, the identity of directors and beneficial owners, and bank details. The US CIP rule names a driver's license or passport for individuals and certified articles of incorporation or a business license for entities.

  2. KYC (Know Your Customer) verifies a natural person: identity, address, source of funds. KYB (Know Your Business) verifies a company: its existence in the register, its directors, its beneficial owners and its bank account. A KYB always contains KYCs, those of the directors and the beneficial owners.

  3. No, it completes it. Onfido, Veriff, IDnow or Sumsub verify the person: selfie, liveness, face comparison. Koncile verifies the files: edits, metadata, issuer's template, content consistency, on the ID document as on the proof of address, bank details, register extract or articles. It integrates through the API into an existing flow.

  4. The set of checks a bank runs before and during a relationship to know who its customer is: identity, address, activity, source of funds, and for a company its directors and beneficial owners. In the EU it stems from the anti money laundering directives, in the UK from the Money Laundering Regulations 2017, in the US from the CIP and CDD rules. In each case, KYC verification means verifying on documents or data that do not come from the customer alone.

  5. The KYB process verifies a company rather than a person. KYB requirements, in the UK and the EU as in the US, come down to four checks: the company exists in the official register (name, number, registered office), its directors are who the articles say, its beneficial owners are identified and verified, more than 25% in the UK and France, 25% or more in the US, and its bank account is in its name. KYB verification with Koncile covers the documents behind each step: register extract, articles, beneficial owner declaration and bank details, read and scored for fraud.

  6. In the EU, the AMLR applies directly from 10 July 2027 and harmonises due diligence across the Union; AMLA, the new European authority, is based in Frankfurt. In the UK, identity verification with Companies House is mandatory for directors and persons with significant control since 18 November 2025. In the US, FinCEN issued exceptive relief in February 2026 on re identifying the beneficial owners of existing legal entity customers. In France, the consumer credit reform applies from 20 November 2026.

  7. No general law sets that period for a proof of address: it is market practice, written into each institution's policy. The three month rule in the French Monetary and Financial Code concerns the register extract of a company (article R561-5-1). In practice, a bill older than three months is often refused, and a date made more recent is one of the most common edits.

  8. In France, enter the extract's verification code on Infogreffe's free control service, then check the date, the company number and the directors in the public registers; in the UK, compare with the Companies House record. For a few extracts a month, that is enough. For hundreds, Koncile cross checks the company number with the registers and reads the file: register template, producer software, modification traces.

  9. In the same pass as the reading. KYC OCR turns every document in the file into usable fields (name, date of birth, document number, address, account number, company number) without retyping. Koncile then examines the file (producer software, modification traces), the image (edited areas) and the content (arithmetic, dates, the customer's name), and compares the document with the known documents of its issuer. The same API response contains the extracted fields and the fraud score from 0 to 100, with the reason for each test.

Further reading

Try Koncile's fraud detection on your own documents

Upload your bank statements, pay stubs or IDs: Koncile extracts the data and flags fakes in seconds.

Talk to an expert