Know your customer, the way it actually works here.
Sri Lanka has no national identity API to call. A KYC check here is built from the signals that do exist — the NIC, the mobile number, the bank account and the face — and held to PDPA No. 9 of 2022. This page explains how each one works, what it proves, and what it does not.
The checks
What a KYC check is made of here.
Each check below is a module with the same request shape and the same structured outcome — pass, fail, or send to a human. Use one on its own, or chain them into a journey.
National identity number
Validates the format and structure of an NIC and derives date of birth and gender from it. Sri Lanka has no national NIC registry API, so this proves the number is well-formed and internally consistent — not that the person holding it is its owner. The checks below are what establish that.
Mobile ownership
A one-time code to the customer's phone, proving they hold the SIM at the moment of the check. In practice this is the strongest widely available identity signal in the country.
Bank account ownership
Confirms the customer controls the account they claim, by linking it through the bank's own flow. A bank has already done its own KYC on that account, so a verified link inherits that work.
Face match and liveness
A live capture, checked for presentation attacks by flashing colours at the face and reading the reflections, then matched 1:1 against the identity photo. The video streams straight to AWS Rekognition and never reaches our servers.
Sanctions, PEP and adverse media
Screens against OFAC, EU, UN, UK OFSI and Sri Lanka designated persons, with politically exposed person handling and adverse media. Re-screens automatically when a list changes, not just at onboarding.
Ongoing monitoring
Keeps a customer register under review after onboarding, so a name that becomes sanctioned later still surfaces.
The law
What PDPA asks of you.
The Personal Data Protection Act No. 9 of 2022 governs how you collect and hold a customer's identity data. Two things follow for KYC in particular: you need a lawful basis and the customer's knowledge for each check you run, and you must not keep the data longer than the purpose needs.
Our local checks are consent-first — the customer verifies themselves, on their own device, rather than a merchant submitting their documents on their behalf. The control-by-control detail, including encryption, retention and sub-processors, is on the security and data protection page, which is written for the reviewers who assess us before a bank goes live.
Honesty
What this cannot do.
There is no national NIC registry API in Sri Lanka, so no provider — us included — can tell you an NIC belongs to the person in front of you from the number alone. Anyone who says otherwise is selling a format check with better marketing.
What you can do is stack independent signals: the number is well-formed, the phone is in their hand, the bank account is theirs, and the live face matches the photo. Each is weak alone and strong together, and each returns its own structured result so you decide where your own threshold sits.
Next step
Run one against your own data.
A sandbox key is issued with the account, before any review, and nothing is metered in sandbox. Deterministic test identifiers let you exercise the not-found, malformed and timeout paths before you ever touch a live check.