Study guide
8.1 Digital Onboarding & Electronic KYC (eKYC) Foundations
ACAMS Certified AML FinTech Compliance Associate CAFCA
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CAFCA Exam Overview and Study Strategy
1.1 CAFCA Exam Format, Official Domains, and Study Strategy
2 Chapter 2: Domain 1: FinTech Business Models and Their Vulnerabilities
2.1 Neobanks, Challenger Banks, and Digital Banking Models 2.2 Payment Processors, Gateways, and Merchant Acquirers 2.3 Buy Now, Pay Later (BNPL) and Alternative Credit 2.4 BaaS Architecture, Embedded Finance, and Program Structures
3 Chapter 3: Domain 1: Financial Crime Types and the Regulatory Perimeter
3.1 Types of Financial Crime and Predicate Offences 3.2 Licensing, Registration, Charters, and Regulatory Sandboxes 3.3 Virtual Asset Service Provider (VASP) Framework & FinCEN MSB Rules
4 Chapter 4: Domain 1: Global AML Frameworks and Sources of Guidance
4.1 U.S. Regulatory Architecture: BSA, PATRIOT Act, and AMLA 2020 4.2 European Union Regulatory Framework: AMLD6, the AML Package, and MiCA 4.3 International Standards: UK FCA, Singapore MAS, and Hong Kong HKMA 4.4 Sources of Guidance for Building Anti-Financial Crime Processes
5 Chapter 5: Domain 1: Risk Management Framework, Risk-Based Approach, and Data Protection
5.1 Risk Management Framework: Lines of Defence, Policies, Assurance, and the MLRO 5.2 Risk-Based Approach, Risk Assessment, Risk Appetite, and Types of Risk 5.3 Handling Sensitive Information: PII, SPII, Privacy Laws, and Breach Reporting
6 Chapter 6: Domain 1: Bank Partners and Internal Threats
6.1 Regulatory Expectations and Enforcement on Sponsor Banks 6.2 How Banks Risk-Rate FinTechs: Onboarding, Ongoing Oversight, and De-Risking 6.3 Controlling Internal Threats: Insider Fraud, Collusion, and Data Misuse
7 Chapter 7: Domain 2: CIP, KYC, CDD, and EDD
7.1 Customer Identification Program (CIP) Under USA PATRIOT Act §326 7.2 The FinCEN CDD Rule & Beneficial Ownership Standards 7.3 KYC to EDD: Applying CDD and Enhanced Due Diligence Across Customer Types
8 Chapter 8: Domain 2: Identity Verification, Data Sources, and Device Data
8.1 Digital Onboarding & Electronic KYC (eKYC) Foundations 8.2 Biometric Face Matching and Liveness Detection 8.3 Verification Data Sources and How to Judge Their Reliability 8.4 Device Fingerprinting, Geolocation, and Behavioral Biometrics
9 Chapter 9: Domain 2: Onboarding Screening, Risk Ratings, and Fraud Red Flags
9.1 Screening at Onboarding: Sanctions Lists, PEPs, and Known Fraudsters 9.2 Customer Risk Ratings: Factors, Data Sources, and How Scoring Models Work 9.3 Detecting Synthetic Identity Fraud and Ineligible Applicants 9.4 Deepfakes, Generative AI Threats, and Scam Typologies
10 Chapter 10: Domain 3: Payment Screening
10.1 OFAC Sanctions Regimes & the 50 Percent Rule 10.2 Real-Time vs. Batch Screening Architecture in High-Velocity Rails 10.3 Screening Logic: Fuzzy Matching, Phonetics, and PEP Controls
11 Chapter 11: Domain 3: Transaction Monitoring Systems and Red Flags
11.1 Hybrid Transaction Monitoring: Rules Engines vs. Machine Learning 11.2 FinTech Typologies: Mule Networks, Funnel Accounts, and Rapid Pass-Through 11.3 Fraud-AML Convergence: BIN Attacks, ATO, and Credential Stuffing 11.4 Model Risk Management Under SR 11-7 & System Optimization
12 Chapter 12: Domain 3: Payment Methods and Transaction Risk Characteristics
12.1 Common Payment Methods, Crypto, and High-Risk Transactions Such as Aggregation 12.2 Transaction Risk Characteristics: Reversibility, Convertibility, Fund Integrity, and Privacy Coins 12.3 Wallet Types, Custody Architectures, and Counterparty Risks 12.4 Stablecoins, On/Off Ramps, and Asset-Referenced Tokens
13 Chapter 13: Domain 3: Monitoring Crypto Transactions
13.1 Blockchain Analytics & Transaction Tracing 13.2 The FATF Travel Rule for Virtual Assets 13.3 DeFi, Mixers, and Smart Contract Sanctions
14 Chapter 14: Domain 3: Alert Investigation, Audit Trails, and Monitoring MI
14.1 The Alert Investigation Process: From Unusual to Suspicious and When to Escalate 14.2 Building an Audit Trail for Suspicious Activity Reviews 14.3 Communicating Monitoring Results: KPIs, KRIs, OKRs, and Management Information
15 Chapter 15: Domain 4: Investigations and Customer Communication
15.1 Talking to Customers During Investigations and Offboarding: Financial Crime Risk vs Policy Breach 15.2 Reviewing KYC, Transactions, Open Sources, and Documents to Build an Investigation 15.3 Analytical Principles in Investigations: Avoiding Confirmation Bias and Other Traps
16 Chapter 16: Domain 4: SARs and STRs
16.1 SARs and STRs: What They Are, When and Where to File, and Why They Matter 16.2 Writing Effective SAR and STR Narratives
17 Chapter 17: Domain 4: Law Enforcement, Regulators, and Banking Partners
17.1 Operational AML Governance and Third-Party Risk Management 17.2 Working With Law Enforcement, Banking Partners, Regulators, and Other Third Parties 17.3 Types of Law Enforcement Requests: Subpoenas, Court Orders, 314(a), and International Requests 17.4 How Banking Partners' Terms of Service Relate to the FinTech's Own Terms
18 Chapter 18: Domain 5: Scaling Anti-Financial Crime Strategies
18.1 Assessing New Products and Features Before Launch 18.2 Refreshing the Financial Crime Risk Assessment as the Business Scales 18.3 Changes That Should Trigger a Financial Crime Risk Assessment Review 18.4 Record Retention Rules and Secure Data Storage 18.5 Outsourcing Controls: Surge Capacity, RegTech, and Independent Testing
8.1 Digital Onboarding & Electronic KYC (eKYC) Foundations
Key Takeaways Explain This Topic AI
Modern digital onboarding relies on Electronic KYC (eKYC) pipelines combining automated edge document capture, Optical Character Recognition (OCR), Machine Readable Zone (MRZ) validation, and cryptographic NFC chip extraction.
Under ICAO Document 9303, MRZ check digits use a modulus 10 algorithm with repeating 7-3-1 weights to detect misread or altered document numbers, birth dates, and expiry dates; they are an error check, not cryptography.
Near Field Communication (NFC) extraction provides the highest identity assurance by executing Passive Authentication (PA) to validate the Document Security Object (SOD) against national root certificates stored in the ICAO Public Key Directory (PKD).
Basic Access Control (BAC) uses visual MRZ data as a symmetric key to establish an encrypted session with an e-passport chip, but only Passive Authentication (PA) and Active Authentication (AA) prove that data is authentic and the physical chip has not been cloned.
Last updated: October 2026
Remote customer acquisition is the lifeblood of contemporary financial technology. Neobanks, digital asset platforms, payment processors, and online brokerages rely on automated digital onboarding to register users within minutes, replacing legacy in-person branch visits with mobile and web-based workflows. However, the elimination of face-to-face verification creates severe vulnerabilities for Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) compliance. Criminal networks exploit remote channels through stolen physical IDs, forged credentials, synthetic identities, and automated bots. To satisfy global Customer Due Diligence (CDD) obligations and maintain institutional integrity, FinTech firms must construct robust Electronic KYC (eKYC) architectures.
Digital Onboarding Architecture and Processing Pipelines
A production-grade eKYC framework integrates multi-tiered verification pipelines operating in fractions of a second. The architecture begins at the edge within the user's mobile smartphone application or web browser via a client-side Software Development Kit (SDK). This client capture layer enforces real-time image quality gates before transmitting encrypted payloads to the backend orchestration layer .
The orchestration engine coordinates specialized sub-services, including Optical Character Recognition (OCR), document authenticity analysis, database cross-referencing, biometric matching, and device risk scoring. Depending on institutional risk appetite and product complexity, onboarding workflows execute either synchronously (delivering real-time account approval within 30 to 60 seconds) or asynchronously (queuing flagged applications for secondary human investigation). The central operational metric is the Straight-Through Processing (STP) rate: the percentage of applicants successfully onboarded without manual human intervention. High-performing FinTechs target STP rates between 75% and 90%, routing the remaining 10% to 25% of high-risk or ambiguous applications to specialized Financial Crime Operations teams for Enhanced Due Diligence (EDD) .
Document Capture and Image Quality Assurance Gates
The integrity of automated identity verification depends entirely on the fidelity of the raw image input. When a user presents a physical identity credential—such as a passport, national identity card, or driver's license—the mobile SDK activates automated capture routines designed to eliminate user error.
Legacy onboarding flows relied on static image uploads (such as scanned PDFs or gallery photos), which fraudsters readily manipulate using image editing software. Modern eKYC architectures enforce real-time video streaming or programmatic auto-capture. The SDK monitors the video stream for specific image quality metrics:
Resolution and Pixel Density : Ensuring the document image satisfies a minimum threshold of 300 Dots Per Inch (DPI) to facilitate accurate machine analysis.
Glare and Specular Reflection Detection : Glare caused by plastic laminates or flash photography obscures critical text and holographic security marks. Auto-capture algorithms detect localized saturation peaks and guide the user to adjust the camera angle.
Blur and Motion Analysis : Utilizing Laplacian variance filters to calculate image sharpness, instantly rejecting frames degraded by hand jitter or camera defocus.
Perspective and Skew Correction : Identifying document corner boundaries in real time, calculating projective transformation matrices, and normalizing the credential into an unskewed, flat aspect ratio.
Cropping and Framing : Validating that all four outer corners and the complete border of the physical card remain fully visible within the camera viewfinder to prevent cropped or sliced credentials from concealing tampering.
Optical Character Recognition (OCR) and the Visual Inspection Zone (VIZ)
Once an acceptable image is captured, the processing pipeline segments the document into functional zones. The Visual Inspection Zone (VIZ) encompasses the primary text fields displayed on the biographical page, including the legal full name, date of birth, residential address, document identification number, issue date, and expiration date.
The Optical Character Recognition (OCR) engine isolates these regions, applies adaptive binarization to separate text glyphs from complex background graphics, and translates visual pixels into structured machine-encoded text strings. Sophisticated OCR engines generate granular confidence scores (ranging from 0.0 to 1.0) for every isolated character and alphanumeric string. If an OCR confidence score falls below a predefined compliance threshold (for example, 0.85), the application cannot proceed via straight-through processing and is flagged for manual review.
Furthermore, advanced document analysis engines evaluate the typographical formatting of the VIZ. State-issued credentials utilize proprietary, standardized font families with strict specifications for character height, stroke thickness, baseline positioning, and horizontal kerning (the spacing between adjacent characters). Automated font inspection algorithms cross-examine the extracted text against known government templates; unauthorized deviations in font smoothing, irregular character kerning, or inconsistent baseline positioning serve as primary indicators of digital text alteration.
Machine Readable Zone (MRZ) Architecture and the 7-3-1 Algorithm
Passports, official travel documents, and many national identity cards incorporate a Machine Readable Zone (MRZ) established under ICAO Document 9303 (promulgated by the International Civil Aviation Organization). The MRZ encodes biographical data in an immutable, standardized layout printed in a high-contrast monospace typeface known as OCR-B .
ICAO Doc 9303 defines three primary physical formats:
TD1 (Three-line format) : Utilized on credit-card-sized national identity cards and some other ID cards, consisting of 3 lines of 30 characters each (90 characters total).
TD2 (Two-line format) : Utilized on larger identity cards and official travel documents, consisting of 2 lines of 36 characters each (72 characters total).
TD3 (Two-line format) : The universal standard for international travel passports, consisting of 2 lines of 44 characters each (88 characters total).
The MRZ's main control value lies in its check digits. They are not cryptographic, but they provide mathematical validation using a modulus 10 check-digit algorithm with repeating weights of 7-3-1 .
Mathematical Mechanics of the 7-3-1 Checksum
Every character within an MRZ string maps to an exact numerical value:
Digits 0 through 9 retain their face values (0 to 9).
Letters A through Z map sequentially from 10 to 35 (where A = 10, B = 11, ..., Z = 35).
The filler symbol < maps to a value of 0.
To calculate or verify a check digit, each character value in a data field is multiplied sequentially by a repeating weight sequence: the first character is multiplied by 7, the second by 3, the third by 1, the fourth by 7, the fifth by 3, and so on. The resulting products are summed, and the sum is divided by 10. The remainder (the modulus 10 result) represents the official check digit:
Check Digit = (Sum of [Character Value * Weight Factor]) mod 10
Within a TD3 passport, independent check digits protect the Document Number , the Date of Birth (YYMMDD), and the Date of Expiry (YYMMDD). In addition, a comprehensive Composite Check Digit calculates an overarching checksum across the document number, birth date, expiry date, optional personal number, and their respective individual check digits.
If an optical character recognition engine misreads a single character, or if a fraudster edits a digital image to change an expiration date from "24" to "29" without recalculating the complex multi-variable composite checksum, the mathematical check-digit algorithm fails instantly. In an automated eKYC pipeline, an MRZ check-digit failure is treated as an immediate hard fraud exception.
Near Field Communication (NFC) and Cryptographic Chip Verification
While optical capture and MRZ parsing provide robust initial filters, optical inspection remains susceptible to ultra-high-resolution physical forgeries and skilled digital manipulation. The gold standard for remote document verification is Near Field Communication (NFC) chip interrogation from electronic passports (e-passports) and biometric identity cards, conforming to ISO/IEC 14443 .
Electronic passports contain a tiny, tamper-resistant secure microcontroller embedded within the biographical booklet cover or polycarbonate page. This chip stores the Logical Data Structure (LDS) , which organizes identity records into designated Data Groups:
Data Group 1 (DG1) : Contains an exact digital duplication of the complete Machine Readable Zone.
Data Group 2 (DG2) : Contains the holder's facial image as issued, stored in a compressed format (JPEG or JPEG 2000).
Data Group 3 (DG3) : Fingerprint biometrics (strictly restricted to sovereign border control agencies).
Document Security Object (SOD) : The cryptographic anchor containing hashes of the populated Data Groups (using an algorithm the issuer chooses, commonly from the SHA-2 family), digitally signed by the issuing state's document signer.
Access Control and Cryptographic Authentication Protocols
To extract and authenticate data from an e-passport chip, the mobile onboarding application must execute a strict sequence of cryptographic protocols:
Basic Access Control (BAC) / Password Authenticated Connection Establishment (PACE) : The chip does not broadcast data openly over radio frequencies. To prevent unauthorized wireless eavesdropping (skimming), the mobile device must first read the visual MRZ (document number, date of birth, and expiry date). These values serve as the cryptographic seed to derive symmetric encryption and message authentication keys (3DES or AES-128). Once the BAC or PACE mutual handshake succeeds, an encrypted communication channel is established.
Passive Authentication (PA) : BAC only encrypts the radio channel; it does not prove that the underlying data is genuine. Passive Authentication proves data authenticity and integrity. The eKYC verification engine inspects the Document Security Object (SOD), extracts the issuing state's digital certificate, and verifies the digital signature against a trusted root certificate. These trusted certificates are maintained by sovereign governments and synchronized globally via the ICAO Public Key Directory (PKD) . If a fraudster modifies a single byte of the holder's name in DG1 or swaps the photo in DG2, the cryptographic hash no longer matches the digital signature on the SOD, and Passive Authentication fails.
Active Authentication (AA) / Chip Authentication (CA) : Passive Authentication prevents data tampering, but an advanced adversary could theoretically copy the genuine binary contents of an authentic chip and flash them onto a blank, programmable NFC microcontroller (chip cloning). To defeat cloning, Active Authentication executes an asymmetric challenge-response protocol. The verification engine sends a random numerical nonce to the chip. The chip signs this nonce using a unique private key stored permanently within the secure element that can never be read or exported. The verifier checks the signature with the chip's public key, which is stored in Data Group 15 and protected by the SOD hash. A valid signature shows that the chip is genuine rather than a copy.
Document Tampering, Security Features, and Physical Forgery Detection
When NFC chips are absent (such as with non-electronic driver's licenses), compliance engines rely on automated visual forensic inspection to detect physical tampering and counterfeit documents.
Government credentials utilize multi-layered security printing technologies that cannot be replicated by commercial printing presses or laser copiers:
Microprinting : High-resolution lines of text (typically 0.15 to 0.3 millimeters in height) appearing on borders or signature lines. To the naked human eye or a standard 600 DPI desktop printer, microprinting renders as a solid or blurry line. Advanced computer vision models analyze macro-lens camera captures to confirm that the text characters remain sharp, legible, and structurally intact.
Guilloche Patterns : Intricate, continuous geometric line patterns generated by mathematical harmonic equations. Counterfeiters attempting to reproduce guilloche patterns via desktop scanners introduce pixelation, broken lines, and color bleeding.
Rainbow (Split-Fountain) Printing : Subtle, seamless gradations between two or more ink colors across the document surface without visible dots or screening boundaries.
Optically Variable Ink (OVI) : Specialized inks containing microscopic interference flakes that shift color dramatically when viewed from different angles (for example, shifting from emerald green to deep violet). The mobile onboarding SDK instructs the user to tilt the document during capture, analyzing sequential video frames to verify the dynamic spectral color shift.
Laser Engraving and Tactile Relief : Polycarbonate identity cards burn biographical data and ghost portraits directly into inner plastic layers using high-powered lasers. This creates a raised, tactile surface relief and distinct carbonized grayscale profiles that resist surface scratching and chemical erasure.
Modern document forgery detection algorithms inspect digital captures for digital artifacting (such as JPEG compression ghosting around biographical text boxes), font mismatches, irregular page aspect ratios, altered photo bounding boxes, and discrepancies between the issue date and known physical template revision histories.
Comparative Analysis: Document Verification Modalities
Verification Layer Target Data Source Primary International Standard Cryptographic Trust Anchor Primary Fraud Vulnerability Operational Latency & Throughput
Visual Inspection Zone (VIZ) OCR Physical text printed on document biographical page National motor vehicle and identity card issuing standards None (relies on visual template comparison and database lookups) High; susceptible to digital image manipulation, font alterations, and forged physical substrates Near real-time (< 2 seconds); high straight-through throughput
MRZ Checksum Parsing Monospace OCR-B text lines on passport or ID reverse ICAO Document 9303 (TD1, TD2, TD3 specifications) Mathematical check digits only (7-3-1 weights); no cryptography Moderate; check digits detect accidental typos or amateur edits, but fraudsters can mathematically compute new valid checksums on completely fabricated credentials Instantaneous (< 0.5 seconds); fully automated
NFC Passive Authentication (PA) Microcontroller chip embedded in e-passport / e-ID card ISO/IEC 14443 contactless interface; ICAO Doc 9303 Part 10 (LDS) Country Signing CA (CSCA) digital signatures registered with ICAO PKD Negligible data alteration risk; mathematically impossible to forge without compromising sovereign private keys Moderate (4 to 12 seconds); requires NFC-enabled smartphone hardware
NFC Active Authentication (AA) Microcontroller secure element hardware ISO/IEC 7816-4; ICAO Doc 9303 Part 11 Asymmetric challenge-response using embedded non-exportable private key Immune to chip cloning; vulnerability restricted to physical relay attacks Adds 1 to 3 seconds to NFC interrogation workflow
Authoritative Registry Verification Central government database / national identity authority API Sovereign data exchange protocols (e.g., AAMVA DLDV in the US, Aadhaar in India) Direct authenticated government server connection (TLS/mTLS API endpoints) Dependent on registry uptime; exposes no document physical attributes but confirms identity existence Variable (1 to 5 seconds); subject to government API outages and network latency
- Realistic Exam Scenarios
- Scenario 1: The Flawed Checksum Exception
An online cross-border challenger bank onboards an applicant presenting an international passport issued by an EU member state. The mobile SDK successfully extracts the user's biographical data via VIZ OCR, and all visual details match the customer's self-declared application form. However, the automated MRZ parsing engine triggers a critical alert: while the document number and date of birth check digits match, the Composite Check Digit fails the 7-3-1 modulus 10 calculation. The applicant contacts customer support, claiming that the passport has a minor clerical typo made by the local passport office and requesting a manual override.
Compliance Analysis : The compliance officer should first require a clean re-capture to rule out a misread. If the composite check still fails, the officer must uphold the rejection or route the case to fraud operations for a full document review. Genuine passports are issued with valid check digits, so a repeated failure indicates that MRZ characters have been altered, cropped, or forged. Overriding an MRZ checksum failure without authoritative registry validation violates foundational CIP/eKYC controls and exposes the institution to forged identity documents used by money laundering syndicates.
Scenario 2: NFC Fallback Governance
A high-growth FinTech payment provider introduces NFC e-passport reading into its mobile onboarding flow to combat an influx of sophisticated fake IDs. While customer satisfaction is high among users with high-end smartphones, the operations team observes that 32% of applicants either possess devices lacking NFC hardware or experience read timeouts due to thick phone cases. The product team proposes establishing an automatic, unmonitored fallback that routes any failed NFC attempt straight to basic visual OCR without additional risk controls.
Compliance Analysis : An unmonitored, automatic fallback undermines the security benefits of NFC verification. Organized fraud rings quickly identify that shielding an e-passport chip with aluminum foil or disabling NFC triggers a downgrade to visual OCR, allowing them to submit forged documents that would have failed Passive Authentication. The compliance officer must mandate a risk-based fallback architecture : when an applicant bypasses or fails NFC reading, the system must enforce compensating controls, including mandatory passive biometric liveness verification, device risk telemetry evaluation, and automated cross-referencing against authoritative national registries (such as the American Association of Motor Vehicle Administrators [AAMVA] Driver License Data Verification [DLDV] service).
Common Exam Traps
Trap 1: Confusing Basic Access Control (BAC) with Passive Authentication (PA) . Exam questions frequently probe the distinct roles of BAC and PA. Remember that BAC only derives session encryption keys from the MRZ to prevent wireless eavesdropping; BAC does not prove that the data stored on the chip is genuine or untampered. Only Passive Authentication (PA) validates the Document Security Object (SOD) against trusted Country Signing CA certificates from the ICAO PKD.
Trap 2: Assuming a Valid MRZ Check Digit Guarantees Document Authenticity . While a failed check digit proves data tampering or reading errors, a passing check digit does not guarantee the document is real. Sophisticated counterfeiters who print entirely fraudulent documents can easily execute the 7-3-1 modulus 10 algorithm to print mathematically valid check digits on forged cards. Check-digit validation is a necessary filter, but it must be paired with security feature inspection or cryptographic chip validation.
Trap 3: Treating OCR as an Identity Verification Mechanism . OCR is purely an information extraction technology, not an identity authentication mechanism. Extracting text from a visual image confirms what is printed on the card, but it provides zero proof that the card is genuine, that the person presenting it is the rightful owner, or that the identity exists in government records.