Custom eKYC Development for Banks and Lenders: Build vs Buy, Costs and APAC Rules
Custom eKYC development means building your own remote identity verification flow instead of renting one from a vendor. Electronic Know Your Customer (eKYC) checks a customer remotely with an ID photo, a live selfie, a face match and watchlist screening. Most banks and lenders buy the core checks and build the flow, risk rules, review queue and integrations around them.
Two rule changes made that build decision more urgent in Southeast Asia. In Vietnam, a State Bank of Vietnam decision took effect on 1 July 2024. Transfers above VND 10 million now need a biometric check against the chip-based citizen ID or VNeID account. The face check moved from onboarding into everyday banking.
In the Philippines, law firm SyCipLaw reports that the Securities and Exchange Commission lifted its moratorium on new online lending platforms from 1 August 2026. New lenders can register platforms again, and each one needs a way to verify borrowers remotely before it pays out a loan.
Attackers moved too. Gartner reported that injection attacks on face biometrics rose 200% in 2023. In February 2024, it forecast that by 2026, 30% of enterprises would stop trusting face-based identity verification on its own.
1. When should a bank or lender build custom eKYC instead of buying?
Buy eKYC when you need to launch fast with standard ID documents and moderate volume. Build when local ID formats, very high volume or data residency rules make vendors a poor fit. A hybrid is the common middle path: vendor checks for documents and liveness, inside your own flow, risk rules and review queue.
| Approach | Fits | Trade-off |
|---|---|---|
| Buy: per-check vendor | New digital banks, lenders and wallets with standard passports and IDs that must launch within months | Fast and certified, but cost grows with volume and data leaves your environment |
| Hybrid: vendor checks plus your own flow | Banks and lenders that need their own risk rules, review queue and core banking or loan system integration | Two parties to manage, and integration effort |
| Build: own models and platform | High volume, many local ID formats, strict data residency, in-house AI team | Highest upfront cost, and you own PAD testing and model upkeep |
Building your own identity models is probably not worth it when monthly volume keeps per-check pricing small. The same holds when customers mostly use passports and IDs that global vendors already read well. It is also premature if no team can retrain models against new attacks, or if compliance cannot yet say which checks each product needs.
Data residency deserves an early answer. Face images and ID data are sensitive personal data. Check whether your regulator, your data protection law or your board requires them to stay in the country. A yes can rule out a cloud-only vendor and push the decision toward hybrid or build.
2. What goes into a custom eKYC system?
A custom eKYC system has three layers. The identity layer reads and checks the document, runs liveness and matches the face. The decision layer applies your risk rules and routes doubtful cases to reviewers. The integration layer sends each result to your loan, account and core banking systems and keeps an audit trail.
| Component | What it does | Usually built or bought |
|---|---|---|
| Capture SDK (web and mobile) | Guides the customer through the ID photo and selfie, and rejects blurry or glare-covered images before upload | Either; build it when the app experience is your own |
| Document OCR and classification | Reads name, date of birth and ID number, and recognizes the ID type | Bought for passports; often built or tuned for local IDs |
| Document authenticity and NFC | Checks fonts, layout and security features, and reads the signed data on chip-based IDs and e-passports | Usually bought |
| Liveness and face match | Detects photos, replays, masks and injected video, then compares the selfie with the ID photo | Usually bought, unless volume or data residency justify your own models |
| Screening | Checks names against sanctions and politically exposed person (PEP) lists | Licensed data, integrated by you |
| Risk rules and decision engine | Approves, rejects or routes each case according to your risk appetite | Built |
| Exception queue | Shows reviewers only the flagged cases, with the evidence side by side | Built |
| Audit log and consent | Records every check, decision and consent for regulators | Built |
| Integrations | Connects to loan origination, core banking, CRM and national ID systems | Built |
Two parts decide most outcomes. Capture quality drives how many genuine customers fail, and liveness decides how many fake ones get through. A flow that asks for a retake with clear guidance keeps more good customers than one that rejects quietly.
eKYC is one part of a wider onboarding journey that also covers consent, account setup and the first transaction. Our guide to digital onboarding workflows shows how those steps fit together.
3. What does eKYC for digital lending need?
eKYC for digital lending has to verify each borrower before money leaves the account, not after. Besides ID, liveness and face checks, lenders need duplicate identity detection, device signals and rules for repeat applicants. Those checks feed the credit decision, so the eKYC result has to reach the loan system in seconds.
Loan fraud rarely looks like one fake ID. It looks like the same face behind applications under different names, or one phone submitting loan requests with several different IDs. A lender’s eKYC should compare each new applicant with past applicants, not only with the ID in hand.
Speed matters just as much. A borrower waiting for a loan decision drops off quickly, so clear cases need automatic approval. Reviewers then need the ID, selfie and risk flags on one screen to clear the rest in minutes.
In the Philippines, banks and digital banks follow BSP rules, while financing and lending companies answer to the Securities and Exchange Commission. SEC Memorandum Circular 20 of 2026 sets prudential, disclosure and market conduct rules for those companies, and reinforces data privacy duties. SyCipLaw’s summary lists no specific identity verification standard, so each lender still has to justify its own design.
Savvycom’s eKYC project in the Philippines was for a digital finance provider handling online loans and account registration. Section 7 covers what it changed.
4. What do regulators in Vietnam, Singapore and the Philippines require?
Vietnam, Singapore and the Philippines all allow remote eKYC onboarding but set different evidence rules. Vietnam ties biometric checks to chip-based IDs and VNeID. Singapore expects banks to assess their own non-face-to-face controls and recognizes Myinfo data. The Philippines allows eKYC with digital IDs, including PhilSys, under BSP Circular 1170.
Rules change often in all three markets. The table below is a planning summary of the cited rules, not legal advice. Confirm the current text with your compliance team before you fix the design.
| Market | Key rules | What the rules point to |
|---|---|---|
| Vietnam | Circular 17/2024/TT-NHNN on payment accounts, from 1 July 2024. Decision 2345/QD-NHNN on biometric checks for online transfers, from 1 July 2024. Circular 50/2024/TT-NHNN on online banking security, amended by Circular 77/2025/TT-NHNN | Banks are expected to match the customer’s face against chip ID or VNeID data, and to repeat the check on large transfers and new devices. Circular 77/2025 points to presentation attack detection at ISO 30107 level 2 or equivalent |
| Singapore | MAS Notice 626 on customer due diligence for banks; MAS circulars AMLD 01/2018 (Myinfo) and AMLD 01/2022 (non-face-to-face measures) | Banks are expected to use liveness checks and to add checks through another channel for higher-risk customers. The board and senior management approve the technology assessment |
| Philippines | BSP Circular 1170 (2023), amending the customer due diligence rules in the bank and non-bank manuals. SEC Memorandum Circular 20 of 2026 for financing and lending companies | Institutions may run eKYC on digital ID systems, including PhilSys under the PSA’s guidelines, on reliable technology. Online lending platforms can register again from 1 August 2026 |
Singapore’s circular on non-face-to-face customer due diligence adds a point many teams miss. Banks should not rely only on a vendor’s external quality certificates. They are expected to test how well the solution works for their own customers.
In the Philippines, BSP Circular 1170 asks institutions using digital ID for eKYC to run effective and reliable technology. In Vietnam, the State Bank’s banking review reports that Circular 77/2025 requires presentation attack detection at ISO 30107 level 2 or an equivalent.
5. How should a custom eKYC system handle deepfakes?
Pair presentation attack detection (PAD) with injection attack detection. PAD catches photos, screen replays and masks held up to the camera. Deepfakes are often injected straight into the video stream, which current PAD standards do not cover. Image inspection and device signals add two more layers at low cost.
- Presentation attack detection. ISO/IEC 30107-3 is the test standard. Independent labs such as iBeta test vendors against it; level 1 covers printed photos and screen replays, level 2 adds 3D masks.
- Injection attack detection. Checks whether the video comes from a real camera on the device, not a virtual camera or a tampered app. Gartner notes that current PAD standards do not cover these attacks.
- Image inspection. Looks for traces that generated or edited faces leave in the image.
- Device and behavior signals. Rooted phones, emulators, and the same device opening many accounts are cheap signals that catch fraud rings.
Ask any vendor for its PAD test report, which levels it passed and when. Then run your own test with the attacks your fraud team already sees. Singapore’s guidance expects that kind of in-house assessment, and it is good practice everywhere. Our article on photos and biometrics in banking security covers the biometric side in more depth.
6. How much does custom eKYC cost compared with buying?
Published prices for buying eKYC ran from about $0.33 to $1.89 per verification in November 2026. Didit lists a full KYC check at $0.33, and Veriff charges $0.80 to $1.89 per verification. A custom build is mostly fixed engineering cost, so the gap depends on your monthly verification volume.
The Didit and Veriff prices come from the vendors’ own pricing pages, checked in November 2026. Veriff sets monthly minimums from $49 to $209. Its entry plan includes document checks and liveness, and sanctions and PEP screening cost $0.64 more per verification. Didit’s $0.33 bundle covers ID verification, passive liveness, face match and device analysis. Many enterprise identity vendors publish no prices at all.
| Cost item | Buy (per-check vendor) | Build or hybrid |
|---|---|---|
| Identity checks | Price per verification, often with a monthly minimum | Engineering team for models, flow and testing |
| Screening | Add-on per check | Licensed watchlist data plus integration |
| Manual review | Included in some plans, otherwise your own staff | Your reviewers and the exception queue you build |
| Infrastructure | Included | Cloud or on-premise compute, storage for images and audit logs |
| Certification and upkeep | Vendor holds PAD test reports | You fund PAD testing, model retraining and security reviews |
For a build or hybrid, engineering time is the main cost line. Savvycom’s 2026 rates are $22 to $48 per hour for most roles, with senior AI and data roles reaching $55. At about 160 hours a month, one engineer-month for most roles comes to roughly $3,500 to $7,700. The budget is that figure times team size and months, plus compute and PAD testing.
Per-check pricing grows with every customer, while a build is mostly fixed cost. Compare both against your expected monthly verifications, not today’s volume. Our fintech app development cost guide shows how eKYC fits into the full budget of a banking, lending or wallet app.
Break-even example: when does building pay off?
Here is an illustration, not a quote. Assume four engineers for six months, or 24 engineer-months. At the rates above, that build costs roughly $84,000 to $185,000. Divide that by the per-check price to see how many verifications it equals.
| Per-check price | Verifications equal to a $84,000 build | Verifications equal to a $185,000 build |
|---|---|---|
| $0.33 (Didit full KYC) | About 255,000 | About 561,000 |
| $0.80 (Veriff entry plan) | About 105,000 | About 231,000 |
| $1.89 (Veriff top plan) | About 44,000 | About 98,000 |
Spread over two years, a lender running 10,000 checks a month at $0.80 would spend about $192,000 on per-check fees. That is close to the top of the build range. At 2,000 checks a month, buying stays far cheaper. The example leaves out upkeep, compute and PAD testing on the build side, and screening on both sides, so treat it as a first filter.
7. How do you implement custom eKYC, and what results are realistic?
Implement custom eKYC in six stages, from mapping the rules for each product to running the new flow beside manual review and automating clear cases. For a Philippine digital finance provider, Savvycom’s AI eKYC platform cut manual verification workload by over 60% and onboarding processing time by over 50%.
| Stage | What you do | Output |
|---|---|---|
| 1. Scope | List the checks each product needs in each market, and the cases that must go to a person | Rule map per product and market |
| 2. Baseline | Record review time per case, approval rate, drop-off per step and confirmed fraud | Numbers to prove the result later |
| 3. Design | Decide what to buy and what to build, and test PAD on your own attack samples | Architecture and vendor shortlist |
| 4. Pilot | Let the system decide in parallel while staff still review, and compare the two | Accuracy on your own customers |
| 5. Launch | Approve high-confidence passes automatically and send the rest to an exception queue | Automated flow with human review |
| 6. Operate | Track false rejects, fraud caught and review load monthly, and retrain as attacks change | Monthly quality report |
The client offers online loans and account registration. Manual identity checks had created backlogs that could not keep pace with growth. Inconsistent document quality and spoofing attempts, including fake identities, slowed reviewers further.
Savvycom built an AI eKYC platform. Document AI extracts ID data, and computer vision runs real-time face matching and liveness detection. An exception workflow sends only flagged cases to human review. It runs on YOLOv8, OCR and embedding models with Python, OpenCV, PostgreSQL, MinIO, REST APIs and Docker, on a hybrid AWS setup. Read the full AI eKYC case study.
The exception queue mattered as much as the models. Reviewers stopped checking every application and handled only the cases the system flagged. These results reflect this client’s documents, volumes and setup. Treat them as a reference point, not a forecast.
A partner like Savvycom fits when the identity checks need your own flow, risk rules and exception queue around them. The same applies when they must link into core banking and loan systems. If a ready-made verification API already covers your products and markets, a vendor alone is the faster and cheaper choice.
Frequently asked questions
Does eKYC verification cost money, and how much per check?
Published prices in November 2026 started at $0.33 for a full KYC check (Didit) and reached $1.89 per verification (Veriff), which also sets monthly minimums. Sanctions screening, manual review and retries cost extra. High-volume contracts are usually negotiated, so ask vendors for pricing at your expected monthly volume.
Can a custom eKYC system use PhilSys, VNeID or Myinfo?
Yes, within each country’s access rules. BSP Circular 1170 lets Philippine institutions run eKYC on digital ID systems, including PhilSys under the PSA’s guidelines. Vietnamese banks match biometrics against chip-based citizen IDs or VNeID. Singapore’s MAS recognizes Myinfo as a source of verified identity data. Plan these integrations early.
How do you do KYC for a digital loan?
Verify the borrower before disbursement. Capture the ID, run liveness and face match, and screen the name against sanctions lists. Add duplicate identity and device checks to catch repeat or synthetic applicants. Route doubtful cases to a reviewer, and keep an audit log of every check.
Is eKYC as safe as in-branch verification?
eKYC can approach the safety of a branch check when it combines document authenticity checks, tested liveness detection, face matching and screening. People should still review doubtful cases. FATF guidance says reliable digital ID can make identification more secure. Weak liveness checks, however, expose the bank to deepfakes.
What is eKYC, and how is it different from KYC?
KYC is the legal duty to verify customers and assess their risk. Electronic KYC meets that duty remotely. The customer submits an ID photo and a live selfie, and software checks the document, liveness, face match and watchlists. The obligation stays the same; only how evidence is collected and logged changes.
Planning custom eKYC for a bank, lender or wallet in Asia-Pacific? Talk to Savvycom’s digital banking team about your markets, volumes and existing systems.
Looking for a Trusted Tech Partner That Delivers Business Impact?
Savvycom is a Vietnam-based software company with 16+ years of delivery, 100+ enterprise clients and work in 30+ countries. Our digital banking team designs, builds and operates digital onboarding, eKYC, lending and AI platforms for banks across Asia. It also integrates them with core banking, payments and cards.
Explore: Digital Banking Solutions
