Capture is the easy half. The half that decides whether a file survives review is what happens to exceptions.
A great deal of eKYC discussion stops at capture: the identity document is photographed, the fields are read, a liveness check confirms a live person is present, and iAM Smart can confirm the identity directly. All of that is real, and all of it is now routine.
The part that determines whether an onboarding file holds up is what happens when the check does not come back clean. Poor image quality, a name that transliterates differently across documents, a device that fails liveness twice, a partial match against a watchlist. Each of those needs somewhere to go and someone named to resolve it.
A silent failure is the worst outcome, because it produces no record at all. An exception queue with an owner produces a file that shows what was unclear, who looked at it, what they concluded and when. That is the difference between a system that verified an identity and a system that can demonstrate it did.
Consent is the other half that gets compressed. The purpose for which identity data is collected governs what may later be done with it, and "we collected it during onboarding" is not a general licence. Under the Personal Data (Privacy) Ordinance the lender is the data user; the collection statement, the retention expectation and the handling of an access or correction request all sit with the lender, not the vendor.
For anyone evaluating eKYC software, pass rate is a poor comparison metric on its own. A high pass rate can mean accurate matching or it can mean a low threshold. The more useful questions are what happens to the cases that fail, what evidence is retained for the ones that pass, and whether a reviewer can see the source alongside the extracted value rather than only the result.
Covenant Desk publishes regulatory context for Hong Kong lending operations, not legal advice. Confirm how anything here applies to your licence with your own advisers.