Hong Kong eKYC guide · Free workflow checklist
eKYC software for Hong Kong lenders
eKYC is not complete when someone photographs an identity card. A lender needs a traceable journey joining identity capture, proof that a live person is present, data matching, consent, exception handling and staff review before the result enters underwriting.
Core definitions
Put similar concepts in the right place
Each component solves a different problem. Complete lending operations depend on clear data and workflow hand-offs.
| Item | What it does in practice |
|---|---|
| 01Identity data capture | Collect names, HKID fields and required evidence through an approved channel while retaining source, time, consent version and case number. |
| 02Liveness and face checks | Confirm that a live person is participating and retain the result and failure reason rather than only a pass label. |
| 03iAM Smart confirmation | Support iAM Smart authentication or form data in the application journey, subject to official API, registration and data-handling requirements. |
| 04Human exception review | Route poor images, inconsistent data, device problems and higher-risk results to assigned staff and retain the decision reason. |
Workflow
Seven stages of an auditable eKYC workflow
- 01
Explain purpose and obtain consent
Present the data purpose, required fields, retention arrangements and applicable privacy-notice version before collection.
- 02
Capture identity data
Read or enter HKID data and check format, image quality and whether the case duplicates an existing record.
- 03
Confirm a live person
Run liveness and any required face matching while retaining the provider, result and threshold version.
- 04
Use iAM Smart where enabled
Record the authentication response, authorised scope and match to the correct applicant.
- 05
Cross-check the record
Compare name, HKID, telephone, documents and existing-customer records using controlled rules.
- 06
Handle exceptions
Send low-confidence, conflicting or failed results to authorised staff rather than treating a technical result as the final decision.
- 07
Attach the evidence
Keep the result, time, sources, consent and human decision with the borrower and application record.
Printable worksheet
Free: 12-point eKYC procurement and workflow checklist
Review each item with credit, frontline, compliance, privacy and technology teams. This is an operational self-assessment, not legal or compliance advice.
Practical evaluation
Do not compare eKYC products by pass rate alone
Inspect the evidence chain
Operations must be able to explain what was collected, where it came from, which rules were used and who handled an exception.
Inspect data minimisation
The ability to collect data does not mean every item should be retained; purpose, access, retention and less intrusive alternatives matter.
Test real failure conditions
Use older phones, low light, name differences, duplicate customers and unavailable iAM Smart sessions to see whether frontline staff can finish a case.
Frequently asked questions
Quick answers
Can eKYC replace staff judgement completely?
A single test result should not become the final decision. Software can collect, match and flag data, while low-confidence, conflicting and higher-risk cases follow the lender’s review policy.
Is Covenant Desk the operator of iAM Smart?
No. Covenant Desk is lending operations software that can support an iAM Smart integration workflow. iAM Smart is provided by the Hong Kong SAR Government Digital Policy Office and access follows its official arrangements.
Where is the eKYC evidence kept?
Covenant Desk attaches results, sources, time, consent and human review to the borrower or application record for authorised staff to use during underwriting.
Primary sources
Official sources and editorial note
This guide reflects official material available on the review date. Requirements can change; each institution should check the latest licence conditions and obtain legal or compliance advice. This page is not legal advice. Read our editorial and corrections policy.
- Digital Policy Office: iAM Smart functions and technical information
- Office of the Privacy Commissioner for Personal Data: compliance guide on identity card numbers and identifiers
- Office of the Privacy Commissioner for Personal Data: Code of Practice on Consumer Credit Data
- Companies Registry: AML/CFT guideline for licensed money lenders
Next step
Bring eKYC results, evidence and human review into one loan application.
Try Covenant Desk to explore HKID data, liveness, iAM Smart confirmation, exception queues and the connected borrower record.
Covenant Desk is lending operations software. It does not provide loans, issue credit reports or replace the lender’s final credit decision.