AMLR Solutions 
AMLR Consultation
EUDI Wallet
Onboarding
Ongoing Monitoring
FRAML
KYC
KYB
KYI
Age Assurance
Workforce IAM
Candidate Verification
Account Takeover
Bonus/ Promotion Abuse
Chargeback Fraud
Deepfake
Document Fraud
Fraud Networks
Impersonation Fraud
Money Mule Activity
Multi-Accounting
Party Fraud
Regulatory & Compliance Risks
Synthetic Identity Fraud
Adult Content
Banking
Crypto
Fintech
Forex
Compliance
Fraud prevention
Trust & safety
Global expansion
Compliance Officers
Developers
Fraud Analysts
Product Managers
Journey Builder 
Global Trust Platform
Customer Profiles
Vendor Comparison
IDV Case Management
AML Case Management
Regulatory Reporting
Agentic Rule Builder 
AI Compliance Co-Pilot 
Fraud Analytics
Fraud Hub 
OCR
Shufti AI
Bank Account Verification 
Biometric Duplication
Database Checks
Document Intelligence
Government ID
Mobile Driver's License
NFC
Selfie Liveness
Brand Personalisation
Deployment Options
Identity Methods
IDV Modes
Multi-tenancy
On-Premise IDV
Secure Capture
Shufti MCP
- Afghanistan
- Albania
- Algeria
- Andorra
- Angola
- Argentina
- Armenia
- Australia
- Austria
- Azerbaijan
- Bahrain
- Bangladesh
- Belarus
- Belgium
- Belize
- Bolivia
- Bosnia and Herzegovina
- Brazil
- Brunei
- Bulgaria
- Cambodia
- Cameroon
- Canada
- Chile
- China
- Colombia
- Costa Rica
- Croatia
- Cyprus
- Czech Republic
- Denmark
- Dominican Republic
- Ecuador
- Egypt
- El Salvador
- Estonia
- Eswatini
- Ethiopia
- Finland
- France
- Germany
- Greece
- Haiti
- Hong Kong
- Hungary
- India
- Iraq
- Ireland
- Indonesia
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Lithuania
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Mongolia
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Poland
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Saudi Arabia
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- UAE
- Uganda
- Ukraine
- UK
- USA
- Vietnam
- Zambia
Scale Identity Verification and KYC Operations in Brunei
Verify citizens, permanent residents and foreign workers through Smart Identity Card checks, biometric passport NFC and 10,000+ foreign ID document types, run KYB on ROCBN-registered companies and their controllers, and monitor transactions and sanctions lists. One platform runs compliance and fraud prevention across the full customer lifecycle for BDCB-supervised firms.
Operational Performance for Brunei KYC
Our Numbers Speak Volumes
79.02%
Pass
Rates
Under 5 secs
IDV
Verification
100%
Omni-format
Document Recognition
Brunei IDV/KYC Challenges
E-KYC Approval Puts the Vendor's Evidence on Trial
Digital KYC in Brunei needs sign-off from Brunei Darussalam Central Bank (BDCB) before launch, and third-party vendors must supply test and audit reports that prove their error rates. Shufti's iBeta Level 3 liveness certification and logged decisions give firms that evidence for the application.
Company Registers of Controllers Sit Outside Public View
Bruneian companies keep their own register of controllers under the Companies Act, and the public cannot inspect it, so firms rely on what the customer hands over. Shufti extracts each controller from registers and shareholder records, then verifies and screens them.
Keeping Customer Risk Current Requires Continuous Monitoring
The Criminal Asset Recovery Order (CARO) requires ongoing due diligence, and BDCB expects existing customers rescreened against the designated persons list with every new transaction. Shufti checks transactions against profiles, rescreens customers as lists change and flags registry, director and ownership changes.
Thin Case Files Weaken IFIS Reports
STRs go to the Financial Intelligence Unit (FIU) through the Integrated Financial Intelligence System (IFIS) as soon as a suspicion forms, and designated-person matches carry an even tighter deadline. Thin case files slow both, so Shufti's case management gathers each filing's evidence in one bundle.
Documents and Languages
Individual Documents Shufti Verifies in Brunei
Shufti verifies 7 Bruneian identity documents plus passports and ID cards from other countries. The cards below cover the core documents Brunei onboarding relies on, with the full list on the supported documents page.
View All Supported DocumentsSmart Identity Card (Kad Pengenalan Pintar)
Issued by the Immigration and National Registration Department under the National Registration Act (Chapter 19), in yellow for citizens, purple for permanent residents and green for foreign pass holders. Shufti verifies each variant, checks it for tampering and matches its photo to a liveness-checked selfie.
Certificate of Identity (Sijil Pengenalan Brunei)
The machine-readable travel document for permanent residents who hold no Bruneian passport, stateless residents among them. Shufti reads its MRZ, validates the checksums and matches the holder's face, so these customers onboard through the same flow as everyone else.
Brunei Biometric Passport
Pasport Biometrik Brunei, issued by the Immigration and National Registration Department, carries a chip Shufti reads through NFC. Shufti also runs nine forensic detection layers, from MRZ checksum validation to hologram analysis, so a cloned or altered passport fails before onboarding.
Foreign Passports and National ID Cards
Shufti actively processes 10,000+ ID document types from 240+ countries and territories, and its zero-shot AI learns new document formats in minutes. Foreign workers, who hold a green Smart IC alongside their passport, and visiting customers verify with the documents they already carry.
Brunei Driving License
Issued by the Land Transport Department (JPD), with full licences valid for up to ten years. Shufti checks authenticity, expiry and licence class and matches the photo to the customer, which helps car rental, motor finance and ride-hailing platforms onboard drivers and renters.
Proof of Address
Electricity bills from the Department of Electrical Services, telecom bills from DST, Progresif and imagine, and local bank statements are read in the same step as the ID. Shufti matches the name and address against the identity document on file.
Entity Identity
Certificate of Incorporation and Company Number
Issued by the Registry of Companies and Business Names (ROCBN), with an RC number for local companies and an RFC number for foreign companies. Shufti confirms status, directors and filings through a live registry call at every check.
Business Name Registration Certificate
ROCBN registers sole proprietorships and partnerships under a P-series number. Shufti checks the certificate for tampering against live registry data and confirms the trading name, owners and registration status before onboarding.
Memorandum and Articles of Association
Filed with ROCBN at incorporation. Shufti's AI-OCR reads ownership, share capital and signing authority, and flags GAN-generated or edited pages, so the constitution on file matches the company you are onboarding.
Business Address Proof
The registered office recorded with ROCBN. Shufti cross-checks it against tenancy agreements, utility bills and bank statements, and flags any address that differs from the registry filing before the account opens.
Tax Identity
RC, RFC and P Numbers as Tax Identifiers
Brunei issues no separate taxpayer number, so companies taxed under the Income Tax Act (Chapter 35) are identified by their ROCBN registration number. Shufti extracts it from registry and tax records and flags any mismatch between the two.
Foreign Tax Registrations and Self-Certification
Foreign shareholders and branches present tax numbers issued abroad. Shufti extracts those numbers alongside FATCA and CRS self-certifications and checks the declared tax residence against the rest of the file.
Ownership and Control
Register of Controllers
Part 10A of the Companies Act, added in 2020, requires each company to record anyone holding more than 25% of its shares or votes, within 30 days of incorporation for new companies. Shufti extracts each controller, verifies their identity and screens them.
Shareholder Register and Ownership Chart
Shufti maps ownership through intermediate companies to the natural person in control and screens each layer against sanctions, PEP and adverse media lists, so a holding structure cannot hide a designated person.
Directors and Authorised Signatories
Shufti verifies the identity document of every director on the ROCBN filing and every signatory on the account, screens each one, and alerts your team when the board changes.
Languages We Cover
Malay, English and Expat Document Parsing
Bruneian identity documents carry Malay and English text, while foreign workers present documents in many other scripts. Shufti's OCR reads 150+ languages and scripts at 99.7% accuracy and averages 93% accuracy against Google Vision's 78.4% in its published benchmark. Zero-shot document intelligence extracts data from layouts it has never seen, on first sight, without waiting for a template.
Malay Name Matching
Bruneian names carry bin or binti patronymics and titles such as Haji, Hajah, Pengiran, Awang and Dayang, and Arabic-origin names appear in several Latin spellings. Shufti's phonetic and transliteration rules match these forms in sanctions and PEP screening.
Cross-Document Consistency Checks
Names, IC numbers and dates of birth are reconciled across the Smart IC, passport, Certificate of Identity, driving licence and register of controllers, so a mismatch surfaces before approval rather than during a BDCB inspection.
Independent Validation
Shufti's Recognition Across Independent Evaluations
Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Top Vendor for Product Execution in the Liminal Index for KYC 2026
View Report
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader in G2 Fall 2026 reports
Read More
Regulatory Update
Every Verification Route Brunei Firms Rely On, in One Platform
BDCB's Notice FIU/N-1/2022/1 limits e-KYC to government-issued identity documents, verified with real-time biometric technology and liveness detection (paragraphs 3.2 and 5). Shufti supports that route in full, plus chip and video routes for foreign workers and customers without a Smart IC.
Document and Face Biometric
LiveThe customer photographs a Smart IC, Certificate of Identity or passport and takes a selfie, and Shufti matches the two with iBeta Level 3 liveness. This is the e-KYC route BDCB's notice describes, and the one most customers take.
NFC Chip Verification
LiveShufti reads the chip in the Brunei biometric passport and most foreign biometric passports and checks the issuer's signed data, giving firms a high-assurance route for permanent residents, foreign workers and customers who need a stronger check.
Video Identification
LiveAn agent-led video session, run in the language your customers use, verifies the customer and their document live, captures consent and records the full session as evidence, a useful route for customers who struggle with a selfie flow.
Fraud Prevention Across the Brunei Customer Journey
Reduce fraud losses and protect customer trust across onboarding, account access, and payments. Shufti connects identity, behavioral, device, network, and transaction intelligence to help Brunei businesses act on risk while keeping legitimate customers moving.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer Avoidable Re-submissions
Capture guidance for Smart ICs, Certificates of Identity and passports cuts glare, crop and blur rejections before the customer submits.
Cleaner Audit Trails
Shufti's case management records sources, results, timestamps, evidence, analyst notes and decision history, packaged as report-ready bundles for STR filing through IFIS.
One Workflow, One Back Office
Unify KYC, KYB, AML screening and transaction monitoring in one case file. Perpetual KYC/KYB tracks ownership, director and transaction behavior changes throughout the lifecycle.
Smart IC-First Flow Design
Residents verify with the Smart IC first, and foreign workers move to passport checks in the same flow.
Shufti's IDV/KYC Solutions for Brunei
KYC Solutions
Brunei customers include citizens on yellow ICs, permanent residents, foreign workers on green ICs and visitors on passports, and a growing number now hold BruneiID. One Shufti flow routes each by risk, so nobody faces checks they don't need.
Explore More
Face Verification
Remote onboarding under BDCB's notice depends on proof that the person matches the IC. Shufti's face match recorded a false match rate below 0.001 in DHS RIVR 2025 testing and passes 99.5% of genuine users first time, so honest customers rarely retry.
.
Age Verification
Prepaid SIM registration is open only to customers aged 12 or over, and lenders and insurers need adult customers. Shufti estimates age from a selfie in under 5 seconds and falls back to an ID check when the estimate sits close to the threshold.
.
Bank Account Verification
Salary credits, loan disbursements and refunds go astray when the account name differs from the customer's. Shufti validates the account number and matches the account holder's name in real time before the first payment moves.
.
Address Verification
Addresses in Brunei are often written by kampong, mukim and simpang, and spellings vary across bills and records. Shufti's layout-aware extraction and fuzzy matching read them consistently against the ID record, with a 99.3% pass rate.
.
Document Verification
Altered and counterfeit IDs are the usual entry point for impersonation. Shufti checks a Smart IC or passport within seconds, reading every field and running forensic checks, so a forged card is caught before the account opens.
.
Identity Verification
Some customers need more than one check, such as a foreign worker opening an account with a passport and green IC. Shufti combines document, biometric, NFC and address checks in one API session, so the decision lands in one case file.
.KYB Solutions
Brunei companies register with ROCBN, keep their own register of controllers and often sit inside group structures, and BDCB's e-KYC notice leaves legal persons out of remote onboarding. Shufti's live registry calls and document checks give corporate onboarding the evidence CARO's beneficial ownership duty calls for.
Explore More
Business Verification
To onboard a Bruneian company, firms confirm its RC number, directors, signatories and everyone who owns or controls 25% or more. Shufti's live registry call confirms the ROCBN record, and controllers are checked against the register of controllers and shareholder records the company provides.
.
Enhanced Due Diligence
BDCB's 2025 PEP guidelines treat foreign PEPs as higher risk by default, and its e-KYC notice bars remote onboarding of new high-risk customers until a face-to-face check. Shufti's branching EDD questionnaires collect source of funds and wealth and score the answers for your reviewer.
.AML Screening
A customer who is clean at onboarding can land on a list next week. Shufti's perpetual KYC rescreens customers against 4,000+ watchlists, including BDCB's consolidated list of designated persons and UN sanctions lists, refreshed every 15 minutes, with every alert kept in one case file.
Explore More
Business AML Screening
Sanctions exposure often sits with an owner or director rather than the company itself, and BDCB expects beneficial owners screened against the designated persons list. Shufti screens every entity, controller and director and rescreens the whole portfolio through perpetual KYB.
.
Transaction Monitoring
Linked cash deposits that add up to the BND 15,000 reporting threshold are a classic structuring signal. Shufti's library of 500+ pre-built rules covers structuring, smurfing and mule activity, cuts false positives by up to 60% and hands analysts case bundles ready for IFIS.
.
AI Compliance Co-Pilot
One common name can return 140+ screening hits, and shared patronymics make near-matches common in Brunei. Shufti's AI Compliance Co-Pilot reviews every hit, assigns a 0 to 100 confidence score with a written reason, and leaves the final call with your MLRO.
.Built To Fit Brunei's Compliance Landscape
AML compliance in Brunei rests on the Criminal Asset Recovery Order, 2012 and BDCB's Financial Intelligence Unit across every sector, while BDCB's sector rules add duties for banks, insurers, capital markets firms and money services businesses. Shufti maps its KYC, KYB, AML screening and transaction monitoring controls to every regime below, so one platform covers each license your group holds.
Criminal Asset Recovery Order, 2012 (CARO)
Brunei's primary AML law repealed the Anti-Money Laundering Act (Chapter 209) and was amended in 2023. It requires non-face-to-face due diligence no less effective than in person (section 5), ongoing due diligence (section 13), records kept for at least 7 years (section 14) and prompt STRs (section 15).
Brunei Darussalam Central Bank (BDCB)
BDCB licenses and supervises banks, Islamic banks, finance companies, insurers and takaful operators, capital markets firms, money changers, remitters and payment service providers. Section 25A of CARO, added in 2023, gives it powers to monitor, inspect and sanction financial institutions and designated non-financial businesses for AML/CFT breaches.
Financial Intelligence Unit (FIU)
Set up within BDCB under CARO, the FIU receives STRs and cash transaction reports through the Integrated Financial Intelligence System (IFIS), which runs on goAML. Section 16 requires cash transactions of BND 15,000 or more, single, linked or attempted, to be reported within 5 working days.
Notice FIU/N-1/2022/1 on Non-Face-to-Face Customer Onboarding
In force since 1 September 2022, it requires BDCB approval before any e-KYC launch, limits e-KYC to natural persons with government-issued ID (paragraph 3), caps the false acceptance rate at 5% (paragraph 5.10) and bars remote onboarding of new high-risk customers before face-to-face verification (paragraph 6.2).
Guidelines FIU/G-1/2025/1 on High-Risk Customers and PEPs
Effective 19 December 2025, the guidelines treat foreign PEPs as higher risk by default and domestic PEPs as high risk only where their activities warrant it (paragraph 4.1). They encourage firms to record PEPs' family members and close associates, whom CARO's 2023 amendment brought into the PEP definition.
Securities Markets Order, 2013
BDCB licenses capital markets intermediaries under the Order, and Guidelines CMA/G-3/2022/12 extend it to digital tokens that behave like securities. The central bank has said cryptocurrencies are not legal tender and that a licensing framework is in development, while CARO's 2023 amendment already covers virtual asset service providers.
Registry of Companies and Business Names (ROCBN)
ROCBN registers local companies, foreign companies and business names through the One Common Portal. Part 10A of the Companies Act (Chapter 39) requires each company to keep a register of controllers holding more than 25%, which is not open to public inspection, with fines of up to BND 5,000.
Immigration and National Registration Department
The department issues the Smart Identity Card under the National Registration Act (Chapter 19), the biometric passport and the Certificate of Identity for permanent residents. BruneiID, introduced by the Ministry of Home Affairs and the Ministry of Transport and Infocommunications, builds on the IC record.
Anti-Terrorism (Terrorist Financing) Regulations, 2013
Made under the Anti-Terrorism Order, 2011, the regulations give effect to UN Security Council resolutions 1267, 1988 and 1373. BDCB publishes the consolidated list of designated persons, and Notice FIU/N-1/2024/1 requires screening at onboarding and on every list update, with matches reported through IFIS within 24 hours.
National Anti-Money Laundering and Combating the Financing of Terrorism Committee (NAMLC)
Chaired at deputy minister level, with the Commissioner of Police and BDCB's Managing Director as deputy co-chairs and the FIU as secretariat, NAMLC sets national AML/CFT policy. Brunei's 2023 APG mutual evaluation and 2024 follow-up report feed a fourth National Strategy running to 2029.
Brunei Data Residency and Deployment
Shufti runs on-premises inside your Brunei infrastructure, including fully air-gapped deployments, or in regional cloud hosting where in-country cloud capacity is limited. Your agreement fixes hosting locations, sub-processors and transfer arrangements, so your BDCB file shows exactly where data sits.
Personal Data Protection Order, 2025 (PDPO)
Administered by the Authority for Info-communications Technology Industry (AITI), the PDPO requires notice within 3 days of assessing a notifiable breach (section 28) and allows transfers outside Brunei only with comparable protection (section 24). Shufti supports both with encryption, role-based access, configurable retention and incident records.
BDCB Outsourcing and Technology Risk Rules
BDCB's outsourcing guidelines accept offshore service providers only where BDCB keeps supervisory access and confidentiality holds, and its IT third-party guidelines ask firms to assess data protection where the provider operates. Shufti documents its controls, sub-processors and audit rights to support that assessment.
Retention Controls
Retention is configurable by client and license. The 7-year minimum in section 14 of CARO is a floor rather than an automatic deletion date, and legal holds keep records under investigation for as long as the case needs them.
Encryption and Security
Data is encrypted with TLS 1.2 or 1.3 in transit and AES-256 at rest, with role-based access and audit logging throughout. Shufti holds ISO 27001:2022 certification and a SOC 2 Type 2 report, which shortens your vendor due diligence.
Automated Decisions and Biometric Data
BDCB expects AI-driven e-KYC to be monitored and tested until its results are reliable (paragraph 5.8). Shufti returns every result with its supporting details through the API and back office, so teams can track error rates, explain outcomes and escalate disputed results.
Scope of Our Role
Shufti processes personal data on each firm's instructions as a data processor under the PDPO, and the licensed firm keeps responsibility for its own compliance. Shufti's privacy notice identifies the limited activities it carries out for its own purposes.
Data Residency and Privacy Controls in Brunei
Brunei AML Sources That Strengthen Decisions
Brunei Darussalam Central Bank (BDCB)
Financial Intelligence Unit, BDCB (FIU)
Attorney General's Chambers (AGC)
Anti-Corruption Bureau (ACB)
Royal Brunei Police Force (RBPF)
Narcotics Control Bureau (NCB)
Royal Customs and Excise Department (RCED)
Internal Security Department (ISD)
Ministry of Foreign Affairs (MFA)
Immigration and National Registration Department (INRD)
Asia/Pacific Group on Money Laundering (APG)
Financial Action Task Force (FATF)
Egmont Group of Financial Intelligence Units
International Criminal Police Organization (INTERPOL)
World Customs Organization (WCO)
Turn Brunei Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.
INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.
Certified to Global Standards
PROVEN WORKFLOWS
Identity Verification Built Around Your Industry in Brunei
Faster Account Opening On BDCB-Approved e-KYC
Identity verification at a Brunei bank starts with BDCB approval for any remote onboarding solution, and the same rules apply to Islamic banks. Shufti pairs Smart IC and passport checks with liveness, PEP screening and source-of-funds questionnaires, so Islamic finance KYC in Brunei runs through the same flow.
Frequently Asked Questions
Does BruneiID work for KYC, and how do customers verify without it?
BruneiID currently signs residents into government services and has not yet opened to regulated firms for KYC. Customers verify with a Smart IC or Certificate of Identity and a liveness-checked selfie, or with passport NFC, all inside the same onboarding flow and case file.
Is a Smart Identity Card image enough to verify a Brunei customer?
An image alone leaves room for edited or borrowed cards. Shufti adds forensic tamper checks and a liveness-backed face match, which is what BDCB's e-KYC notice expects from remote onboarding, and steps up to passport NFC or video when the risk calls for it.
Can Shufti verify foreign documents or identity formats it has not encountered before?
Yes. Shufti's zero-shot document intelligence reads unfamiliar layouts and checks them for tampering, so foreign workers and visitors verify with whatever passport or national ID they hold, without waiting for a template update. Each result carries the same audit trail as a Bruneian document.
How does Shufti OCR compare with Google OCR for Brunei identity documents?
Bruneian IDs carry Malay and English fields in Latin script, which Shufti reads at the accuracy it publishes across its full language set. Across the languages in its published benchmark, Shufti averages 93% accuracy against Google Vision's 78.4%, which matters for documents from the foreign workforce.
How does Shufti verify ownership when a Bruneian company has several corporate layers?
Shufti reads ROCBN filings, the register of controllers and shareholder records, and traces each corporate shareholder to the natural persons behind it. It identifies everyone owning or controlling 25% or more, as CARO's beneficial owner definition requires, then verifies and screens each person.
Does Shufti's ongoing monitoring cover more than sanctions screening?
Yes. Section 13 of CARO requires ongoing due diligence throughout the business relationship. Shufti monitors transactions against each customer's profile, rescreens customers and owners, and flags director, ownership and registry changes for review, so every risk rating stays current between periodic reviews.
How does Shufti keep screening current and handle Malay name variations?
Watchlists, including BDCB's consolidated list of designated persons, refresh every 15 minutes. Native phonetic models across 80+ languages match patronymics, honorifics and alternative spellings, which BDCB's 2024 notice expects firms to catch when a name does not match the list exactly.
Can we choose Brunei hosting or run verification inside our own infrastructure?
Yes. Shufti can run on-premises inside your Brunei infrastructure, including fully air-gapped deployments, or in regional cloud hosting. Either way, hosting location and transfer terms are written into your agreement, which supports the PDPO transfer rule and BDCB's outsourcing expectations.
What controls help us protect identity and biometric data?
Encryption in transit and at rest, role-based access, audit logs and configurable retention protect identity and biometric data, backed by ISO 27001:2022 certification and a SOC 2 Type 2 report. Shufti also supports your PDPO breach assessment with complete incident records.
Can we configure different retention periods for different Brunei licenses?
Yes. Retention is set per client, product and license, so a bank, a remitter and an insurer in one group can each keep records on their own schedule above CARO's 7-year minimum, with legal holds for open investigations and audits.
What does Shufti provide when our compliance team needs to prepare an IFIS report?
Shufti assembles a report-ready bundle with the customer's verification results, screening hits, transaction history and analyst notes, so your MLRO can complete an STR or cash transaction report in IFIS quickly, including designated-person reports that are due within 24 hours.
Can we add verification checks without rebuilding our onboarding journey?
Yes. Shufti's AI Journey Builder adds or reorders checks such as NFC, video, address or EDD questionnaires by product, customer type and risk tier, so a new BDCB requirement means a configuration change rather than a rebuild of your existing flow.
How does Shufti make verification queries easier for our customer support team?
Support agents see each verification result in the back office with the reason behind it, the documents captured and the checks that failed, so they can explain a decline in Malay or English and guide the customer to a retry or another route.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
19 June, 2026
KYC Compliance and Identity Fraud Challenge Across APAC
Shufti's own verification data shows fraud climbing alongside digital growth across APAC. Where that pressure lands, and what the leading markets are doing about it.
Whitepaper
