What is ID verification / KYC?
Know Your Customer (KYC) is the process of verifying that a user is who they claim to be — typically by checking a government-issued identity document (passport, driver's licence) and confirming the person presenting it is live and present. It's a regulatory requirement for businesses operating under Australia's Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) Act.
In practice, the user photographs their ID document, takes a selfie or completes a liveness check, and a third-party verification service compares the document to the selfie and checks the document's authenticity. Your app receives a pass/fail result with a confidence score, and the verified identity is linked to the user's account.
KYC is not just for large financial institutions — any business holding an Australian Financial Services Licence (AFSL), offering buy now pay later, operating a crypto exchange, or facilitating payments at scale is likely subject to AML/CTF obligations that require some form of identity verification.
When does your app need it?
- You're building a fintech product, lending platform, crypto exchange, or any service regulated by AUSTRAC
- Your AFSL or credit licence conditions require customer due diligence before onboarding
- You're facilitating high-value transactions and need to verify the identity of parties involved
- You want to reduce fraud and charge-back risk by confirming user identity at onboarding
- Your insurance or legal product requires identity verification before a binding agreement is created
- You're operating a marketplace with high-trust requirements (rental platforms, gig economy apps) where identity verification builds user confidence
How much does it cost?
Adding ID verification / KYC typically adds 8–16 hours of development — roughly $1,000–$4,000 AUD.
At the lower end: integrating a single provider via their hosted flow (e.g., Stripe Identity's pre-built UI). The user is redirected to the provider's hosted verification page, completes the check, and your app receives a webhook with the result. Minimal custom UI, mostly webhook handling and status management.
At the higher end: a fully embedded, branded verification flow using a provider's SDK, custom handling for different document types (passport vs driver's licence vs Medicare card), retry logic for failed checks, manual review workflows for edge cases, storing verification status and audit records, and compliance reporting. There are also ongoing per-verification costs from the provider — typically $1–$5 AUD per check depending on volume and provider.
How it's typically built
The major providers used in Australian apps are:
- Stripe Identity — straightforward integration if you're already using Stripe, with a hosted or embedded flow. Good for lower-volume use cases.
- Onfido — widely used globally, strong document coverage including Australian licences, supports liveness detection.
- Jumio — enterprise-grade, higher cost, used by larger financial institutions.
- FrankieOne — Australian provider with strong local document support and direct AUSTRAC reporting integrations. Worth considering for AUSTRAC-regulated businesses.
The integration pattern is consistent across providers: initiate a verification session server-side, pass the session token to the client SDK, the user completes the flow in the provider's UI, and a webhook notifies your server of the result. The result is stored against the user record as a verification status (pending, verified, failed, expired).
Document data (ID numbers, date of birth) should be handled carefully. Minimise what you store — in many cases you only need to store the verification outcome and the provider's reference ID, not the raw document data.
Questions to ask your developer
- Which provider are you using, and does it support Australian documents? Australian driver's licences vary by state and must be explicitly supported. FrankieOne and Onfido both have strong local coverage.
- Hosted flow or embedded SDK? Hosted is faster to build and shifts compliance burden to the provider; embedded gives a smoother user experience but takes longer to build.
- How are verification failures handled? Users whose documents are rejected need a clear path — retry, manual review, or support escalation.
- What data is stored after verification? Confirm that raw document images and sensitive ID numbers are not retained longer than necessary, consistent with Privacy Act obligations.
- What are the ongoing per-check costs? At scale, KYC verification costs can be significant. Get a per-check rate and model it against expected monthly verifications.
See also: Email & password login · Two-factor authentication · One-off payments · App cost calculator