Online KYC with the document chip: what CodeB does for customer due diligence today
Banks, payment and crypto companies, telecoms and gaming operators must know who their customers are – online, fast and audit-proof. The weak point of many processes is the document check: photos and video streams can be edited, replayed or generated. Every passport and every EU ID card issued since August 2021 carries a chip whose data is signed by the issuing country. This article shows what CodeB does with that chip today, how EU wallets and qualified signatures fit in – and, just as clearly, what CodeB does not do.
Why the chip and not a photo of the document
A photo of an ID card shows what the camera saw – or what someone fed into it. Edited images, printed copies, deepfakes and injection attacks make optical checks harder every year. The chip is different: name, date of birth, document number and the holder's photo are stored there and digitally signed by the issuing country (ICAO Doc 9303). Change one letter and the signature breaks. A copied chip cannot answer the original chip's own key test.
Chips are everywhere: passports have carried them for years, and every ID card issued in the EU since 2 August 2021 must have one (Regulation (EU) 2019/1157). Most of your customers already have a chip document in their pocket.
What CodeB does today: the chip check through the customer's phone
Your server reads, the phone only passes messages on. You send the customer a link or QR code. CodeB Wallet shows who is asking and what will be read; the customer agrees, enters the card access number (CAN) or scans the machine-readable zone, and holds the document to the back of the Android phone. The server of phone.codeb.io acts as the card reader: it talks to the chip end to end over an encrypted, authenticated channel (PACE, Chip Authentication, Secure Messaging). A manipulated app can stop the reading, but it cannot invent a result.
What is checked. Passive Authentication: the chip data must be signed by the issuing country's document signer, chaining to its country certificate from the German BSI master list (115 countries plus the EU and the UN), with revocation lists. Chip or Active Authentication: the chip proves with its own key that it is the original, not a copy. Genuine app on a genuine phone: Android Key Attestation and Google Play Integrity.
What you receive. The verdict (genuine or not, with reasons), the data of the document – name, date of birth, nationality, sex, document type and number, issuing country, expiry date – and the chip photo. Fingerprints are never read; they are reserved for border authorities.
Evidence. Every reading is stored as a hash-chained evidence record: method, algorithms, certificates, revocation state and result – for your audit trail.
More building blocks that work today
EU Digital Identity Wallets. With the CodeB EUDI Gateway your website accepts the person identification data (PID) from EU wallets with one OpenID Connect integration – OpenID4VP, SD-JWT VC and ISO mdoc, trust and revocation checks, evidence records. It is tested against the EU reference wallet; national wallets are tested as they become available. The German state wallet starts on 2 January 2027.
Qualified electronic signatures. Customers with a signature card – for example a Maltese eID, a D-Trust card or a German health professional card – sign your contract in CodeB Wallet with a qualified signature over NFC. In Germany, § 12 GwG names the qualified signature as one way to verify identity, together with a validation of the signature and a payment from the customer's own account. You validate the signature – for example with the EU DSS validation tool.
Re-checks. When a document expires or your risk rules ask for an update, send a new invitation link – the customer repeats the chip check in a minute.
Age only. Where you only need to know "over 18?", ask nothing else – age verification.
What CodeB does not do – please read this
A chip check proves that a genuine document was present – not who is holding it. CodeB does not compare the customer's face with the chip photo and does not run liveness detection. If your process needs that link between person and document, you add it – for example with your own face comparison against the high-quality chip photo you receive.
Not certified, no assurance level. CodeB is designed to follow eIDAS 2.0 and the EU Architecture and Reference Framework. It is not certified as an identity proofing service, and a chip check through CodeB is not an eIDAS assurance level ("substantial" or "high").
Your law, your supervisor. Whether a process with these building blocks meets your due-diligence duties depends on your sector, your country and your supervisor. The chip check needs an Android phone with NFC; plan another channel for customers without one.
The legal frame in brief
Germany today: § 12 (1) GwG lists the ways to verify a natural person's identity: an official photo ID document, the eID function of the German ID card, a qualified electronic signature (with validation and a payment from the customer's own account), a notified eIDAS eID scheme, and documents under the payment-account rules.
EU from 10 July 2027: the Anti-Money Laundering Regulation (EU) 2024/1624 applies directly. Its Article 22(6) names an identity document, passport or equivalent, and electronic identification means at assurance level substantial or high together with relevant qualified trust services.
EU wallets: under eIDAS 2.0 (Art. 5f) private relying parties that must use strong user authentication by law – banks, for example – have to accept the EU Digital Identity Wallets by December 2027.
Use case: account opening at a payment institution
Example scenario. A payment institution opens accounts online. In the sign-up, the customer taps "Check my ID with the chip". CodeB Wallet opens and shows the institution's name and what will be read. The customer enters the CAN of her ID card and holds the card to her phone.
Seconds later the institution's back office sees: document genuine, chip signed by the issuing country, not a copy – with the data and the chip photo, and an evidence record. The institution runs its own face comparison against the chip photo and its sanctions screening. The account contract is then signed in the same app.
How to start
- Try it yourself: read your own ID chip on the playground.
- Read the details of the remote ID verification and the CodeB EUDI Gateway.
- Ask for an integration demo: info@aloaha.com.
Sources
§ 12 GwG · AMLR (EU) 2024/1624 · eIDAS 2.0 (EU) 2024/1183 · Regulation (EU) 2019/1157 (ID cards) · ICAO Doc 9303 · BMI: EUDI wallet guidance · EU DSS validation tool
Questions about online KYC with the chip
What does the chip check prove?
That a genuine passport or ID card was present: the data is signed by the issuing country, unchanged, and the chip is not a copy. It does not prove who is holding the document.
Does CodeB do face matching or liveness detection?
No. You receive the chip photo and can run your own face comparison against it. CodeB does not do face comparison or liveness detection.
Why can a manipulated app not fake the result?
Because the server of phone.codeb.io reads the chip itself over an end-to-end encrypted channel. The phone only passes the messages on and cannot read or change them.
Which documents are supported?
Passports, ID cards and many residence permits with a chip following ICAO Doc 9303. Documents can be confirmed as genuine when their country certificate is in the BSI master list – 115 countries plus the EU and the UN in October 2026.
Is a chip check enough for anti-money-laundering rules?
That depends on your sector, your country and your supervisor. In Germany, § 12 GwG lists the accepted ways to verify identity; from 10 July 2027 the EU Anti-Money Laundering Regulation applies. Clarify your process with your compliance team.
Is CodeB certified?
No. CodeB is designed to follow eIDAS 2.0 and the EU Architecture and Reference Framework, but it is not certified, and a chip check through CodeB is not an eIDAS assurance level.
What does the customer need?
The passport or ID card with a chip, its card access number (CAN) or machine-readable zone, and an Android phone with NFC and CodeB Wallet.