Remote KYC: NADRA Verisys, biometrics, and the AI verification stack

Three ways to see it

1. 1

   Remote KYC in Pakistan rests on three legal foundations: the SBP Account Opening regulations, the NADRA NICOP and CNIC verification framework, and the AML/CFT Regulations 2020. The single most important piece is that NADRA, not the bank, is the source of truth for identity. NADRA owns the citizen database. The bank's job is to prove that the human in front of the camera is the same human who holds that CNIC. Everything else, including AI face-matching, document OCR, and liveness checks, exists to discharge that single proof.

2. 2

   The verification stack runs in four stages. Stage one is CNIC capture: the user takes a photo of the front and back of the card. AI does OCR on the printed fields, parses the CNIC number, and runs basic checks like format validity and Luhn-style digit math where applicable. Stage two is NADRA Verisys: the bank queries the NADRA gateway with the CNIC number and gets back the citizen's photograph and basic biographic data. This costs the bank a small per-call fee and is the most expensive part of the flow.

3. 3

   Stage three is liveness and selfie capture. The user sees their face in a live camera frame and is asked to perform a small action: blink, turn head left, look up. The AI confirms that this is a live human and not a photograph held up to the camera or a video replay. Modern liveness models use depth signals, blink timing, micro-expression cues, and texture analysis to score how confident they are. Stage four is one-to-one face matching: the AI compares the live selfie to the NADRA-returned photograph and produces a similarity score between zero and one.

The why-tree

Try this with Claude

AI-edge prompt: 'I am the head of onboarding at a Pakistani digital bank. Design a remote KYC flow for a customer with a four-megapixel selfie camera in 2pm sunlight, where my similarity threshold is 0.82 and NADRA Verisys returns a photo from 2014. Walk me through the decision tree, including what fallback options I should offer at each rejection point. Then critique your own design from the customer's emotional perspective.' Save the answer; it is your interim ops playbook.