How to vet a national digital ID before you build KYC on it

Expanding into a new market usually means accepting a new national ID for onboarding. Teams often treat that as a document-template problem. It is bigger than that. A national ID carries an assurance level, a legal regime, a set of standards, and a verification path, and getting those wrong creates fraud gaps or compliance exposure. Here is the checklist we use, with the references to move quickly.

The seven-point check

1. What type of scheme is it? A document-based national ID card, a bank-led eID, a government login, and a wallet credential verify in completely different ways. Identify the type first. Each entry in the digital ID directory is tagged by type.

2. What is the assurance level? An eIDAS "high" eID, a NIST IAL2 proofing, and a self-asserted app account are not interchangeable. Match the assurance to the risk of what you are onboarding for.

3. Which standards does it use? ICAO Doc 9303 for passport chips, ISO/IEC 18013-5 for mobile driver licenses, eIDAS for EU schemes. Standards tell you how to read and trust the credential. See the standards deep dives.

4. Who issues it, and what is its status? A live, government-issued card is different from a pilot or a planned scheme. The directory records the issuer, launch year, and status for each.

5. What does the privacy law require? Verifying identity means processing personal and often biometric data. Check the country's rules before you collect anything. Every scheme links to its data-protection regulation, mapped to identity impact.

6. Which verification vendors support it? You rarely verify a foreign document yourself. Know which identity verification providers cover the document, and confirm coverage with them directly, because it varies by region and document.

7. How broad is coverage, and is it mandatory? A near-universal mandatory ID gives you reach. A voluntary or early-rollout scheme means you still need fallbacks. Coverage notes are on each scheme page.

A worked example

Say you are onboarding customers in India. The scheme is Aadhaar, a document and biometric national ID. Assurance is high, but verification is special: Aadhaar e-KYC is licensed and India-specific, so you use India-focused verification vendors rather than a generic global one. The governing law is the DPDP Act, which shapes consent and data handling. In four clicks you have the type, the law, and the verifier path.

The point

KYC built on a shallow read of a national ID is how fraud slips in and how compliance findings happen. Spend twenty minutes on the seven points before you write the integration. The digital ID directory, the regulations directory, and the verification vendor profiles are built to make that twenty minutes fast.