KYC Pass Rates: Why Legitimate users Fail Verification and How to Fix it

Your onboarding dashboard shows a decline. It does not tell you whether that was a fraudster stopped at the gate or a real customer whose address was written under a hierarchy your parser had never seen.

Most verification stacks record the outcome and discard the cause, which is why teams end up arguing about vendor accuracy when what they should be discussing is attribution.

Verification failure has at least four distinct causes, and only one of them is fraud. Your KYC pass rate reports all four as the same number.

What does it actually mean to pass KYC?

Passing KYC means a user has cleared three separate checks inside one session, and any one of them can end the journey. Know Your Customer, usually shortened to KYC, is the regulated process of confirming that a customer is who they claim to be before you let them transact. Under Regulation (EU) 2024/1624, the EU’s anti-money laundering regulation, that obligation becomes directly applicable across every member state from 10 July 2027.

KYC meaning, and the three KYC pass steps

• Document capture: The user photographs a government-issued ID. After that the system reads the data fields, parses the name, and checks the document’s security features for signs of manipulation.

• Biometric match: The user takes a selfie or completes a liveness check. Then the system confirms a live human is present and matches that face to the document photo.

• AML screening: The system takes the extracted identity and runs it against sanctions lists, politically exposed person databases, and adverse media before the account opens.

The KYC verification process is sequential, so each step consumes the output of the one before it. A misread name at step one becomes a false screening hit at step three, which is why extraction quality decides far more of your pass rate than the screening engine does.

First-attempt pass rate versus overall pass rate

Your overall pass rate counts everyone who eventually passed, including the people who failed and tried again. Your first-attempt pass rate counts only the people who got through on their first try.

The gap between the two numbers is the users who needed more than one go. Overall will always be the higher figure, because every retry that succeeds is counted as a pass. That makes it the more flattering number to report and the less useful one to act on.

Why does KYC verification fail for legitimate users?

Verification fails for legitimate users in four recognisable ways, and only one of them involves actual fraud. Which one dominates your funnel depends entirely on your markets, your customers’ devices and how many checks you have stacked, so the useful question is not which cause is biggest in general. It is which one is biggest in yours.

The four causes, and how to tell them apart

Why data-layer failures are the hardest to see

Of the four, data-layer errors are the ones least likely to show up as errors. A blurry photo announces itself and a fraud flag is logged as a fraud flag, but a misparsed name produces a clean, confident negative. The dashboard records a decline and nobody asks whether the address was actually wrong or simply written under a hierarchy the parser had never seen.

Vietnam is the clearest documented example. In April 2025, Resolution 60-NQ/TW replaced the country’s three-tier address hierarchy with Province/City to Commune/Ward, and Resolution 125/NQ-CP cut provincial units from 63 to 34. Millions of records still carry the old format, so a system reading only one of them rejects the people carrying the other. 

Shufti’s breakdown of why KYC fails in Vietnam sets out the mechanism. Without diacritic-aware extraction and normalisation, systems manufacture discrepancies between what the user typed, what the document says and what the database holds. Vietnam is not unusual here, only well documented. The same class of failure surfaces wherever local naming conventions, scripts or administrative structures diverge from the Western defaults most stacks were built around.

What are the real KYC requirements a user has to meet?

Three things, in almost every jurisdiction. What you accept for each one decides how many real customers get through.

Requirement 1: A valid government-issued photo ID

A passport, national ID card, driving licence or residence permit. It has to be current and readable enough for the system to pull the data fields.

You do not have to demand a passport. A national ID card or driving licence meets the same obligation in most jurisdictions, and a passport-only policy will fail every customer who does not hold one.

Requirement 2: Proof of address

Evidence that the customer lives where they say they live. Usually a utility bill, bank statement or government letter dated within the last three months, though some markets let you check the address against a national database instead. This is the requirement that reformed jurisdictions break, because a perfectly valid address written in the old format reads as a mismatch against the new one.

Requirement 3: A live biometric check

A selfie or short video that proves a real person is present and matches the photo on the document. It confirms liveness as well as likeness, which is what stops someone passing with a stolen or borrowed ID.

How to do KYC online without losing the users you want

Four controls do most of the work, and none of them requires loosening your risk appetite. Fast KYC approval is a by-product of clean extraction and smart routing, never of weaker checks.

• Route by risk instead of by default: Apply the heaviest checks to the riskiest segments and let low-risk users through a lighter path. Uniform friction costs you conversion without buying proportional safety.

• Make the failure reason legible: Track declines by cause, not just by count. If you cannot separate a blurry photo from a name-parsing mismatch, you cannot fix either one.

• Design the retry, not just the happy path: Most recoverable failures are recoverable only if the user is told what went wrong and gets a second attempt inside the same session.

• Judge approval rate and loss rate together: A pass rate that climbs while fraud losses climb faster is not an improvement, and a fraud rate near zero usually means you are rejecting customers you wanted.

What should you look for in a KYC verification provider?

Evaluate online KYC services against the things that move your pass rate, not against the headline accuracy number every vendor quotes.

How Shufti helps onboarding teams lift first-attempt pass rates

If your users are in Vietnam, Indonesia, Brazil, South Asia or the Gulf, you have probably watched good customers fail a check they should have passed. The cause is usually extraction rather than risk, because most verification stacks were trained on Western documents and adapted to everything else afterwards.

Shufti’s document intelligence was built the other way round. It actively processes 10,000+ document types across 150+ languages and 240+ countries, and it parses multi-part names and diacritics without forcing them into Western order. For jurisdictions that have restructured their address systems, Shufti processes both the pre-reform and post-reform formats, so a valid legacy address stops registering as a mismatch. Clients running non-Latin document mixes in Vietnam, Indonesia and the Gulf see that difference in their first-attempt numbers.