Know your customer, the way it actually works here.
Sri Lanka has no national identity API to call. A KYC check here is built from the signals that do exist: the NIC, the mobile number, the bank account and the face. They are held to PDPA No. 9 of 2022. This page explains how each one works, what it proves, and what it does not.
The checks
What a KYC check is made of here.
Each check below is a module with the same request shape and the same structured outcome: pass, fail, or send to a human. Use one on its own, or chain them into a workflow of your own and branch on what each one returns.
National identity number
Validates the format and structure of an NIC and derives date of birth and gender from it. Sri Lanka has no national NIC registry API, so this proves the number is well-formed and internally consistent, not that the person holding it is its owner. The checks below are what establish that.
Mobile ownership
A one-time code to the customer's phone, proving they hold the SIM at the moment of the check. The message also carries a confirm link, so a customer can type the code or confirm from the message itself; merely opening the link confirms nothing. In practice this is the strongest widely available identity signal in the country.
Bank account ownership
Confirms the customer controls the account they claim, by linking it through the bank's own flow. A bank has already done its own KYC on that account, so a verified link inherits that work.
Face match and liveness
A live capture, checked for presentation attacks by flashing colours at the face and reading the reflections, then matched 1:1 against the identity photo. The video streams straight to AWS Rekognition and never reaches our servers. The result is reported check by check (liveness, match, capture quality, a selfie copied from the ID, the ID photo itself, and apparent age against the date of birth) and says plainly whether it proves a person was present or only that a photo matched.
Video KYC
A recorded video call between the customer and one of your officers, for when a decision needs a person to see who they are dealing with. The customer books a free time from your team's calendar or starts the call straight away, agrees to the recording and confirms a code sent to their phone or email first. On the call the officer photographs them holding their NIC: the face is matched against the ID portrait in the same frame, and the number on the card is compared with the one they gave. The recording is kept, encrypted, as evidence for the decision.
Read a form (OCR capture)
For businesses that still run on a paper application form. Set the form up once with the fields to read; the customer then photographs each filled page on their phone, or your team uploads it, and every field is read as written, handwriting included, with how sure the reader is. Nothing is guessed: a blank or illegible field stays empty, and a missing or unclear value, or a page that is not your form, goes to a person to correct.
Sanctions, PEP and adverse media
Screens against global sanctions and PEP data from 300+ sources, and against OFAC, EU, UN, UK OFSI and Sri Lanka designated persons pulled from source nightly, with politically exposed person handling and adverse media. Where the NIC is supplied, it is also checked against a shared blocklist of fraud confirmed by other companies. Re-screens automatically when a list changes, not just at onboarding.
Ongoing monitoring
Keeps a customer register under review after onboarding, so a name that becomes sanctioned later still surfaces.
The law
What PDPA asks of you.
The Personal Data Protection Act No. 9 of 2022 governs how you collect and hold a customer's identity data. Two things follow for KYC in particular: you need a lawful basis and the customer's knowledge for each check you run, and you must not keep the data longer than the purpose needs.
Our local checks are consent-first: the customer verifies themselves, on their own device, rather than a merchant submitting their documents on their behalf. The control-by-control detail, including encryption, retention and sub-processors, is on the security and data protection page, which is written for the reviewers who assess us before a bank goes live.
Honesty
What this cannot do.
There is no national NIC registry API in Sri Lanka, so no provider (us included) can tell you an NIC belongs to the person in front of you from the number alone. Anyone who says otherwise is selling a format check with better marketing.
What you can do is stack independent signals: the number is well-formed, the phone is in their hand, the bank account is theirs, and the live face matches the photo. Each is weak alone and strong together, and each returns its own structured result so you decide where your own threshold sits.
Next step
Run one against your own data.
A sandbox key is issued with the account, before any review, and nothing is metered in sandbox. Deterministic test identifiers let you exercise the not-found, malformed and timeout paths before you ever touch a live check.