Identity verification automation: how to automate the checks and route the exceptions

Identity verification automation is the use of software to collect a customer's ID and personal details, run the same identity checks on every applicant, and send only the exceptions to a person. A typical setup combines an ID verification provider for the document and a selfie match, data source and watchlist checks, and document extraction that reads the ID's data and the rest of the file.

This guide covers what each check proves, how to automate the workflow step by step, what still needs a reviewer and where Docsumo fits.

What is identity verification automation?

Identity verification answers one question: is this applicant a real person, and the person they claim to be? NIST's digital identity guidelines (SP 800-63A-4, July 2025) split the answer into three steps, and software can run part of each.

• Resolution

  Collect the evidence and details, such as name, date of birth, address and ID number, needed to single out one unique, real person.

• Validation

  Confirm the evidence and details are genuine, accurate and valid: the ID itself, and the details against authoritative or credible sources.

• Verification

  Confirm the applicant presenting the evidence is the person it was issued to, for example by comparing a selfie with the ID photo.

For US banks, the Customer Identification Program (CIP) rule, 31 CFR 1020.220, sets the minimum. A bank's CIP must include procedures to verify each customer's identity within a reasonable time after the account is opened, using documents, non-documentary methods or both. Its non-documentary procedures must address customers who open an account without appearing in person, which is every account opened online. What CIP asks banks to collect is covered in automated KYC verification.

How identity verification automation works

One flow runs the checks in order and hands your onboarding system a result, with the evidence behind it.

Different tools usually own different checks. ID verification providers test the document's security features and match the selfie to the ID photo. Data source checks compare the details with information from a consumer reporting agency, a public database or another source. For a driver's license, AAMVA's Driver's License Data Verification (DLDV) service compares the data with the records of participating issuing states and returns a match flag for each field; AAMVA approves each user. Document AI reads the ID's data and the paperwork around it, such as proof of address.

How to automate identity verification, step by step

Automating the workflow is mostly deciding, in advance, what happens after each check.

1. Write the rules firstTurn your verification policy into checks: which IDs you accept, which fields must match the application, and which results pass, go to review or stop the application.
2. Collect the ID with the applicationAsk for the details, a photo of the ID (both sides of a US driver's license) and a selfie if your policy calls for one. Capture tips, such as no glare and the whole card in frame, save re-requests.
3. Read the IDOCR reads the printed fields. A passport's machine readable zone (MRZ) and the PDF417 barcode on the back of a US license hold a second copy of the key fields.
4. Run the data checksRecompute the MRZ check digits, compare the license front with its barcode, confirm the ID hasn't expired, and match the name, date of birth and address to the application.
5. Add the checks your policy needsSend the ID and selfie to your ID verification provider, and the details to data source and watchlist checks.
6. Route the exceptionsClean results continue on their own. Low-confidence fields, mismatches and failed checks go to a reviewer with the image and the reason.
7. Record and deliverKeep what was checked, how, with what result, and how each discrepancy was resolved. Then send the result to your onboarding system by API or webhook.

Here's part of step 4 on one license: the front read and checked against its decoded barcode.

Manual vs automated identity verification

Manual review spends a person's time on every applicant, including the clean ones. Automation keeps people for the calls that need judgment.

Check digits show the difference. ICAO Doc 9303 puts them in a passport's MRZ so readers can verify the data was read correctly, and a failed digit points to the field to re-read before anyone relies on it.

What still needs a person

Some results shouldn't pass or fail without a reviewer. The CIP rule also requires procedures for when a bank can't form a reasonable belief that it knows a customer's true identity, including when not to open the account.

• Low-confidence fieldsA blurred date or a worn ID number goes to a reviewer with the field highlighted, rather than a guess.
• MismatchesThe name, date of birth or address differs between the ID, its MRZ or barcode, and the application. A different address may only mean the customer moved, so ask before declining.
• Failed or inconclusive provider resultsA document or selfie check that doesn't pass needs a person to decide the next step.
• Possible watchlist matchesA potential match needs a decision on whether it's the same person.
• Unfamiliar documentsThe CIP rule names documents a bank isn't familiar with as a case its non-documentary procedures must address.

Give reviewers the image, the extracted value and the reason for the flag, and record what they decide: CIP records must describe how each substantive discrepancy was resolved. The full list of records is in the best KYC document verification software.

Where Docsumo fits

Docsumo is the document layer of this workflow. It reads passports and driver's licenses with pre-trained models, and a workflow step decodes the license's PDF417 barcode with a barcode library so the front can be checked against it. MRZ check digits are recomputed in a code step you set up. Fields below the confidence threshold you set for each field go to your reviewers, who click a field to see its source on the image; their corrections improve the model. Documents arrive by upload, email or API, and results reach your onboarding or core system through the API and webhooks. On the Enterprise plan, cross-document validation checks the ID against the rest of the file, such as the application, utility bills and bank statements, and case management keeps each customer's file together.

Docsumo doesn't read passport chips, inspect security features, run liveness checks, match selfies or screen sanctions lists, so teams pair it with an ID verification provider and a screening service. It is SOC 2 Type 2 audited and ISO/IEC 27001:2022 certified, encrypts data in transit (TLS) and at rest (AES-256), and supports SSO and MFA; see security. Audit logging comes with the Business and Enterprise plans.

• 99%99%field-level accuracy across 250+ document types
• 95%+95%+straight-through processing

The bottom line

Identity verification automation works when every check has an owner and every result has a next step. Let software read the ID and run the data checks, let an ID verification provider test the document and the selfie, and send only the exceptions to a person, with a record of how each was resolved. For the details of each ID, see passport OCR and driver's license OCR.

Book a demo with a few of your own onboarding files, or start a free trial.

Frequently asked questions