eKYC & Face Recognition: Lessons from a Derailed Project
25/08/2026
Lessons from an eKYC Project That Slipped Behind Schedule
To be honest, over a year ago, I confidently committed to a mid-sized bank in Central Vietnam that our eKYC system would be operational within just three months. We had the algorithms, sample data, and an elite technical team. However, the harsh reality struck immediately during real-world testing.
The issue wasn't the source code. It was the lighting angle. A large portion of that bank's users typically registered accounts in the evening, inside convenience stores with yellow lighting, or under street trees. Our facial recognition model, despite achieving 99.8% accuracy in the lab, rejected nearly 40% of real users, flagging them as potential spoofing attempts.
We lost an additional two months retraining the model, collecting field data, and adjusting alert thresholds. That lesson was expensive. It reminded me that deploying eKYC isn't about installing software and waiting for sales. It is a battle between algorithms and the chaotic reality of daily life.
Today, sitting with you as someone who has stumbled, I want to share candidly what is truly necessary to build an identity verification process that is both secure and seamless.
What is eKYC and Why is It More Critical Than Ever?
Don't think of eKYC merely as taking a photo of an ID card and a selfie. It is a comprehensive digital identity verification process that allows businesses to validate document authenticity, match the user's face with the photo on the card, and, most importantly, ensure the person in front of the camera is a real human, not a photo or a spoofed video.
Why is it so hot in 2026? Because the line between real and fake is blurring. Deepfake technology is becoming increasingly sophisticated; creating a fake face can happen in an instant. If your business still relies on manual processes or outdated AI tools, you are opening the door to financial fraud.
For financial institutions, fintechs, or even e-commerce platforms, eKYC is no longer a "nice-to-have" feature. It is the first line of defense. A weak eKYC process can cost you money, reputation, and even your operating license from regulatory authorities.
Where Identity Verification Projects Often Stumble
There is a truth that many software vendors won't tell you: Facial recognition technology is prone to failure if the usage context isn't understood. Here are the three most common "traps" I have witnessed:
- Lighting and Image Quality: Users often take photos in low light, against the light, or with blurry phone cameras. If the algorithm is too strict, you will reject real customers. If it is too loose, you will let fraud slip through.
- Unintelligent Spoofing Detection (Liveness): Older techniques require users to turn their heads or blink. Users find this cumbersome and drop out. Meanwhile, modern spoofing techniques can mimic these movements. If your system cannot analyze depth, skin texture, or micro-reflections of light, you will fail.
- Fragmented User Experience: A good eKYC process should take under 60 seconds. If users must download a separate app, wait for email verification, or restart due to minor errors, your churn rate will skyrocket.
Do not sacrifice user convenience for security, nor trade security for a poor experience. This is the most difficult balancing act.
A Practical eKYC Approach: From Data to Experience
Instead of discussing theory, let's look at how we typically deploy at AIVISION to ensure stability. This process is not just about installing software; it is a chain of continuous optimization steps.
First is diverse data collection. We do not train models on "standard" datasets in the lab. We incorporate thousands of photos taken in real-world conditions: yellow lighting, complex backgrounds, users wearing glasses, hats, or with darker skin tones. The more the model "sees," the less it is shocked by edge cases.
Next is intelligent spoofing detection. We apply Liveness technology based on micro-analysis. Instead of forcing users to perform strange gestures, the system asks them to look at the screen and perform a few simple actions within 3 seconds. The algorithm analyzes light changes on the skin surface, eye blur, and other biometric signals to detect 2D photos, 3D masks, or video replays.
Custom AI software is the key here. Every business has different operational workflows. Some need direct integration into a banking app, while others need a web portal for telesales staff to verify calls. Forcing a "one-size-fits-all" solution only creates bloat.
Measuring Effectiveness: The Numbers That Truly Matter
Don't just look at Accuracy on paper. Measure using metrics that directly impact revenue and risk.
| Metric | Realistic Target | Why It Matters |
|---|---|---|
| False Rejection Rate | Under 2% | To avoid annoying real users and losing customers. |
| False Acceptance Rate | Under 0.1% | This is the safe allowable limit, but requires strict control. |
| Average Verification Time | Under 45 seconds | Above 60 seconds, users begin to lose patience. |
| Regulatory Compliance | 100% | Ensures adherence to State Bank of Vietnam and Ministry of Public Security regulations. |
A good system is one that can automatically adjust thresholds based on the risk of each transaction. For example, a small loan might allow a slightly lower verification threshold to enhance the experience, while a large loan would require stricter verification.
The Future of Identity Verification and the Role of Agentic AI
We are standing at the threshold of Agentic AI—AI agents capable of autonomy. In the context of eKYC, this means the system can not only verify but also automatically investigate when suspicion arises.
Instead of reporting an error and stopping, Agentic AI can automatically request additional verification information or cross-reference with risk databases to make a decision accompanied by recommendations. This significantly reduces the load on human operations teams.
However, do not be deluded. AI cannot completely replace human oversight. It is a powerful support tool, but the ultimate responsibility remains with your business. Successful eKYC deployment requires a combination of advanced technology, quality data, and a flexible operational process.
We have seen many businesses succeed when they did not try to find a "perfect" solution immediately, but instead built a platform capable of learning and adapting. If you are planning to upgrade your identity verification system, start by re-evaluating your current process and potential weaknesses. Caution and realism are always the keys.
Frequently Asked Questions
Does eKYC comply with State Bank of Vietnam regulations?
Yes, provided the system uses validated algorithms and stores data according to security regulations. Modern solutions come with integrated Compliance modules to ensure safety.
Is the cost of deploying AI-based eKYC higher than manual processes?
The initial cost may be higher due to technology investment, but in the long run, operational costs will decrease by approximately 70-80% compared to manual processes. You save on manpower, processing time, and minimize fraud risk.
What if the user does not have an ID card (CMND/CCCD)?
Advanced eKYC systems can integrate verification via passport or even other biometric methods like fingerprints or iris scans if permitted by law. However, in Vietnam, the ID card (CMND/CCCD) remains the most common and mandatory method today.
AIVISION helps enterprises turn AI into working systems. Explore our enterprise AI solutions, read more on the AIVISION blog, or talk to our team about your own use case.