Identity Document Capture Fails: What to Record

Identity document capture is the process of photographing or reading an identity document so its details can be extracted and checked. When capture or a government-source check fails, the officer pauses verification, tells the customer, and records the outcome and the reason for the decision. Section 28 of the AML/CTF Act 2006 (Cth) requires reasonable steps to establish that an individual customer is who they claim to be, and section 111 requires you to keep customer due diligence records. The OAIC’s guidance pulls the other way on copies of identity documents, so the record has to be careful as well as complete.

TL;DR:

• After two failed image attempts, switch to a current document, supported digital identity, or supervised sighting instead of requesting another capture.
• Do not start the designated service until identity is established on reasonable grounds (section 28), unless your program lawfully delays it (section 29). Tell the customer what is needed, and escalate blocked credentials or unexplained mismatches.
• Record the capture time, device, document details, government source check result, and the officer’s reason for accepting, rejecting, or escalating the case.
• The Act’s minimum retention period for CDD records is seven years; AML Guard’s audit trail holds records for 8 years, above the Act’s seven-year minimum. Privacy guidance favours minimising and protecting images.
• You are not required to retain document copies; record details sighted, restrict image access, and delete images or remove identifying details when no longer needed.

Table of Contents

• How does automated identity document capture work?
• Why do identity document captures fail?
• What should the officer do next, and what should be recorded?
• How do privacy law and AML/CTF record-keeping fit together?
• How do capture outcomes feed into CDD, risk scoring and the audit trail?
• How does AML Guard record capture, checks and officer review?
• Where conventional advice on capture falls short
• How AML Guard helps your firm handle failed captures
• FAQ
• Sources

How does automated identity document capture work?

Most capture tools run the same pipeline, and each stage explains a failure you may see later. Knowing which stage is automated and which needs a person tells you where to look first when something goes wrong.

• Image guidance and quality gating: the camera prompts the customer to hold the document flat, and the tool rejects frames that are blurred, glared or cut off before anything is read.
• Edge detection and autofocus: the software finds the four corners of the card or passport page, crops to them and refocuses, which is why a thumb over a corner can stop a capture dead.
• Data extraction: optical character recognition reads the printed fields, while the machine-readable zone on a passport and any barcode or QR code are parsed separately and compared with the printed text.
• Authenticity checks: the tool analyses the colour profile, looks for security features such as holograms and microprint, and may read the chip through NFC where the document and device allow it.
• Biometric checks: a selfie is compared with the portrait on the document, and liveness detection tests that a real person is present rather than a photo or screen.
• Government-source checks: the extracted details are sent to an authoritative source, such as the Document Verification Service, and the match or non-match result returns to the case.

Capture proves that a document looks genuine and that its data is readable. It does not prove that the person in front of the camera is the person named, which is why the selfie, liveness and source checks sit alongside it. You can see the available services and the document-matching tools at Idmatch. For the list of documents worth requesting in the first place, see our guide to acceptable ID documents.

Why do identity document captures fail?

Failures fall into recognisable groups, and each one points to a different next step. Treat the first signal as a clue, not a verdict on the customer.

1. Blurry or cropped images. OCR and security-feature detection both need a sharp, complete frame. Glare over the portrait or a missing corner leaves the software guessing, so it fails the capture instead of risking a wrong read. Repeated attempts also mean more copies of a personal document, which cuts against the data-minimisation principle in the OAIC’s ID scanning guidance. If two attempts fail, change the route rather than ask for a third.
2. Expired documents. An expired passport can look entirely authentic, so authenticity and validity are separate questions. The capture may pass the image checks and still be unacceptable as primary evidence. Ask for a current document, or for secondary evidence that supports the first.
3. Name mismatches. The name on the document may differ from the name on the application because of a typo, a middle name left out, a different naming convention or a recent change by marriage or deed poll. Check the spelling against the customer’s own details first, then ask for evidence of the change before proceeding.
4. Unreadable machine-readable zone, QR code or barcode. Wear, lamination damage or a cracked chip stops automated validation of that element. The photo page may still be readable by eye, but the automated cross-check is gone, so an officer must decide whether supervised verification is needed.
5. Government-source check failures. A non-match may come from a transcription error, a document the source does not cover, or a customer whose credential has been blocked on the Credential Protection Register because it was reported compromised. A blocked credential is not proof of wrongdoing by the customer; it means the document cannot be relied on until the customer deals with the issuer.

Each failure also tells you something about the customer’s circumstances, so keep notes factual and avoid labelling the person. A customer who cannot pass a remote capture may still verify through a supervised route, covered in our guide to verifying identity remotely.

What should the officer do next, and what should be recorded?

The officer’s first move is the same in every case: do not start providing the designated service until the customer’s identity is established on reasonable grounds, and tell the customer what is needed. Section 28 of the Act bars you from commencing the service until then; the only exception is a delay under section 29, which has conditions of its own and has to be provided for in your program. AUSTRAC’s initial CDD guide for individuals sets out how to verify identity, and its guidance on identifying individuals who do not have standard ID covers customers who cannot provide standard documents.

• Offer alternatives: request a current passport or other acceptable document, a supported digital identity such as myID, or an attended sighting where the customer can present the original in person.
• Decide whether a reliable copy is enough: a certified or otherwise reliable copy may be accepted where the original cannot be sighted, provided the officer records why.
• Escalate when risk rises: a repeated failure, a blocked credential or an unexplained name mismatch can raise the customer’s ML/TF risk. Where it becomes high, enhanced customer due diligence applies (section 32 of the Act), so your program should say who decides what happens next.
• Record the outcome: the capture timestamp, the device type, notes on image quality, the document type and the details sighted or recorded, the government-source result, and the officer’s reasoning for accepting, rejecting or escalating.
• Keep the decision rationale: an inspector reading the file later should be able to see why the officer acted as they did, not only what happened.

You are not required to keep copies of the documents you verify against; you can record their details instead. Australia has no national identity card, so there is no single document to anchor the check, and the 100-point check belongs to the Financial Transaction Reports Act, not this regime. AUSTRAC does not approve any capture method or vendor, so the responsibility for choosing a reliable method stays with you.

Pro Tip: Write the reason for the decision in one plain sentence at the time you make it. A note such as “name differs by middle name, deed poll sighted, accepted” is worth more at an inspection than a long reconstruction months later.

Our tamper-evident audit trail keeps a decision retrievable and holds records for 8 years, above the Act’s seven-year minimum.

How do privacy law and AML/CTF record-keeping fit together?

Two sets of duties apply at once, and they push in different directions. Privacy law asks you to collect and hold as little as you reasonably need. AML/CTF law asks you to keep enough to prove what you did.

The OAIC’s ID scanning guidance says organisations covered by the Privacy Act must only scan identity documents when reasonably necessary, explain why they are scanning, protect what they collect, and destroy or de-identify it once it is no longer needed. The regulator’s wider direction is set out in its strategy to make ID verification more secure and privacy protective, which favours reducing repeated sharing of identity documents.

In that strategy the OAIC lists biometric information, data retention and ID verification services and practices among the areas where it will focus proactive regulatory efforts. Capture, liveness and retention are exactly where you are likely to be asked questions.

The AML/CTF Act 2006 (Cth) sets the record-keeping obligations. You keep customer due diligence records for 7 years from the end of the business relationship or the completed occasional transaction (section 111), and transaction records for 7 years from the day the record is made (section 107). AML Guard’s audit trail holds records for 8 years, above the Act’s seven-year minimum. Practical controls that keep both duties in balance:

• Record the details of the document you sighted rather than storing every image attempt.
• Encrypt stored images and limit access to the officers who need them.
• Keep access logs so you can show who viewed a record and when.
• Redact or de-identify images once the file no longer needs them, while keeping the verification record.

How do capture outcomes feed into CDD, risk scoring and the audit trail?

A capture result is only useful if it stays attached to the customer file. Every outcome, whether pass, fail or escalated, should link to the customer’s record so the full picture is visible at the point of approval.

• Link to the file and ownership work: for a company, the pathway runs on its ACN; for a trust or SMSF, it runs through the corporate trustee, which has its own determination on its own ACN.
• Officer approval: the officer approves the determination before customer due diligence proceeds, and the reasoning is recorded. Recording the reasoning lets you show your judgement later.
• Automation with human override: automated checks feed risk scoring and re-screening, but a person decides when a flagged result or a persistent failure outweighs an automated pass.
• Searchable, tamper-evident storage: indexed records let you retrieve a decision quickly during an inspection or when preparing a suspicious matter report or threshold transaction report.

Our guide to Tranche 2 customer due diligence shows where identity verification sits within the wider program.

How does AML Guard record capture, checks and officer review?

AML Guard brings document capture, government-source checks and biometric liveness into one customer due diligence record, with an officer reviewing the outcome. The reasoning is stored with the result. The audit trail is tamper-evident and holds records for 8 years, above the Act’s seven-year minimum.

Where conventional advice on capture falls short

Most advice treats a failed capture as a technical nuisance to be solved with a better photo. That misses the point. A failed capture is a decision point, and the quality of the record you make at that moment matters more than the quality of the image.

Teams tend to chase pass rates, retrying until the software accepts something. That produces more copies of personal documents, more privacy exposure and a file that hides the very signal the failure carried. A name mismatch or a blocked credential is information, and repeated attempts to obtain a clean pass can bury it.

Put the record first. Decide in advance what your officers do after repeated capture failures and when a government-source check cannot confirm a document. Then make sure the reasoning is captured in plain words. The technology will keep improving, but an inspector will always want to see the judgement, and judgement only counts if it was written down.

How AML Guard helps your firm handle failed captures

When a capture or a government-source check does not go to plan, we give your officers a guided path and a complete record. Built for Tranche 2 reporting entities, AML Guard offers:

• Capture, government-source checks and liveness in one record, with an officer reviewing the outcome.
• A tamper-evident audit trail that holds records for 8 years, above the Act’s seven-year minimum.
• An integration with REX CRM that passes status indicators only, never the underlying CDD data.

Book a demo to see a failed capture handled from intake to record, or see how fees work on our pricing page.

FAQ

Can I open a bank account in Australia without a photo ID?

Banks usually need some form of verified identity, but a photo document is not the only route. Alternatives such as a supported digital identity or other acceptable documents may be accepted, depending on the institution and the customer’s risk.

What is classed as an identity document?

An identity document is an official document that establishes who a person is, such as a passport or driver licence. Which documents a reporting entity accepts depends on its AML/CTF program and the risk of the customer.

What is a verified document?

A verified document is one whose details have been checked against a reliable, independent source, or whose authenticity has been confirmed by sighting or by a government-source check. The check and its outcome should be recorded.

How can I verify my ID online in Australia?

You can use a supported digital identity such as myID, or complete an online document and selfie check with the organisation requesting it. If an automated check fails, the organisation should offer a supervised alternative.

Sources

• ID scanning | OAIC
• OAIC: Our strategy to make ID verification more secure and privacy protective
• Legislation: Anti-Money Laundering and Counter-Terrorism Financing Act 2006
• AUSTRAC: Initial customer due diligence for individuals
• AUSTRAC: Identifying individuals who do not have standard ID
• Idmatch: Identity verification services
• myID: Australian Government Digital ID app

Recommended

• KYC document capture that holds up under audit
• Acceptable ID documents for Tranche 2 firms
• Verifying identity remotely under Tranche 2
• AML record keeping: the seven-year clocks