eKYC used to be a selfie plus an ID photo. In 2026, it is a stack.
The modern stack has five layers: passive liveness (no taps, no blinks) tuned against deepfakes, NFC chip reads on ePassports and national IDs, risk-based step-up that escalates when signals look off, issuer-verified credentials from national identity rails, and an audit trail that records every check.
Regulators in Bangkok, Singapore, Jakarta, Manila, and Hanoi now expect all five. The gap between vendor pitch decks and what actually ships is still wide.
Onboarding teams are consolidating. Fewer vendors, deeper integration, and a focus on fraud economics rather than raw conversion. Here is what we have seen on cross-region projects in the last twelve months.
Why now
Three forces broke the old playbook at once:
- Generative face and voice synthesis is cheap, so rule-based liveness no longer holds up.
- National digital identity rails (state-run ID systems, like Thailand's NDID, India's Aadhaar, Singapore's Singpass, Estonia's e-ID, and the EU's eIDAS framework) are now production-grade across major markets.
- Regulators have shifted from observing to enforcing. Expect notices, capital add-ons, and remediation deadlines.
Identity rails, by country
- Thailand: NDID is now the default for investment accounts. The BOT and SEC are tightening evidence rules.
- Singapore: Singpass and Myinfo cover almost every resident. The hard part is the fallback for foreign onboarding.
- Indonesia, Vietnam, and the Philippines: Dukcapil, VNeID, and PhilSys are maturing. Data quality is uneven, but usable.
- Cross-border: issuer-verified mobile driving licences (mDL) and the EU Digital Identity Wallet are showing up. Plan for them now.
The 2026 stack
| Country | ID rail | Liveness | Watchlist | Doc support |
|---|---|---|---|---|
| Thailand | NDID + AMLO | Required | OFAC + UN + AMLO | TH ID, passport |
| Singapore | Singpass / MyInfo (MAS) | Optional (risk-tiered) | MAS sanctions + UN | NRIC, FIN, passport |
| Indonesia | Privy / Dukcapil + OJK | Required | OFAC + DTTOT | KTP, passport |
| Vietnam | VNeID + SBV | Required | OFAC + UN | CCCD, passport |
| Philippines | PhilSys + BSP/AMLC | Required | OFAC + AMLC | PhilID, passport |
| Malaysia | MyDigital ID + BNM | Required | OFAC + UN | MyKad, passport |
No single vendor does it all. Production stacks are layered:
- Capture — multi-modal: document, selfie, NFC, and voice when needed.
- Verification — routed by product, jurisdiction, and risk band.
- Decisioning — model-driven, but bounded by policy.
- Audit — every step writes to an immutable record.
What each layer needs
- Passive liveness with deepfake-specific detectors. Texture or blink checks alone are not enough.
- OCR (text extraction from the ID image) plus NFC chip reads where the ID supports it. The chip is far harder to forge than the photo.
- Risk-based step-up: low-risk users pass at tier one. Higher risk triggers NDID, video, or branch handoff.
- Signal fusion across device, network, and behaviour telemetry. Biometrics on its own is not enough.
How to evaluate vendors
Pricing is fragmenting. Per-verification is still default for growth-stage products. Enterprise deals are moving to per-seat or per-entity with a usage floor, which ties cost to fraud loss instead of raw volume.
Shortlist vendors that publish iBeta PAD Level 2 results (the industry liveness benchmark), real deepfake numbers, and per-market accuracy. Skip the aggregate marketing figures.
Shortlist checklist
- Ask for false-accept and false-reject rates on deepfakes synthesised in the last six months.
- Confirm data residency and sub-processors meet PDPA, MAS TRM, OJK, and BSP rules per jurisdiction.
- Check for native connectors to NDID, Singpass, Dukcapil, VNeID, and PhilSys. Retrofitting one later is painful.
- Demand audit-ready evidence export. You should be able to reconstruct any verification with model version, decisions, and signals.
The winning eKYC stack in 2026 is not the one with the flashiest liveness demo. It is the one your compliance team can defend in writing.
Where HarmonyX fits
We integrate regulated onboarding end to end. Mobile capture, national identity rails, and connection into core banking, insurance, or telco systems — with the governance hooks auditors ask for.
If you are re-platforming eKYC this year, or replacing a vendor whose deepfake numbers have drifted, talk to us early. Integration is where most programmes slip.
