What the BCT asks for remote onboarding
Circular 2025-06 sets the minimum requirements when a bank collects, checks and keeps identification data electronically. It works together with Circular 2017-08 on AML/CFT internal controls. In short: the customer consents to the processing of their data, the document's authenticity is checked, a reliable technology proves the customer is alive and present, the face is matched against the identity data, and a KYC sheet is produced and kept with its integrity protected.
The circular also asks for governance around the process: a board-approved procedure and risk map, pre-production testing that tracks the false acceptance rate, penetration testing by an auditor accredited by the National Cybersecurity Agency, an audit every two years, and a file sent to the BCT before going live. When a provider is involved, the bank keeps the responsibility and the contract must give the BCT access.
How Konnect ID covers each step
- Consent: the welcome screen tells the customer what is collected and why before any photo is taken; record their agreement in your onboarding, just before the session starts.
- Document checks: screens, prints, edits and reused images are flagged, and printed data is checked for consistency.
- Proof of life: a guided challenge (turn, blink or smile) proves a live person is in front of the camera.
- Face match: the selfie is compared with the document photo against a threshold you set per flow.
- KYC sheet: every case has a report with the document, the selfie, each check, the decision and who made it.
- Traceability: automatic decisions record the rule that fired, and every reviewer action is logged.
The Tunisian ID card, read properly
The CIN has no machine-readable zone and is printed in Arabic. Konnect ID was trained on it: it reads the number, names, dates and the back of the card, and refuses to guess when the reading is doubtful. Passports from any country are read through their machine-readable zone, so foreign residents and the diaspora can be verified in the same flow.
Business verification on RNE extracts
For merchants, corporate accounts and agents, the KYB flow collects the RNE extract, the tax registration (patente) and any other legal file you require, verifies the identity of the person acting for the company, and records beneficial owners. Your compliance team reviews everything as one case.
Hosting: our cloud or your data center
Some Tunisian institutions prefer to keep identity data on their own infrastructure, which also simplifies the outsourcing conditions of the circular. The self-hosted edition runs on your servers with your database and storage, activated by a signed license key. The flow, the review desk and the API are the same as in the cloud.