Guide

Onfido document verification: how it works and is it safe?

Onfido document verification, now run by Entrust, checks an identity document’s data, security features and template, and most checks return a clear or consider result in seconds. It is ISO 27001 certified and SOC 2 Type II compliant, but under Australian AML/CTF law your business stays responsible for its customer checks.

By Matt Collis·Updated 21 October 2026·Reviewed 21 October 2026·Version 5·4 min read

Onfido document verification checks that an identity document is genuine and belongs to the person presenting it. Onfido is now part of Entrust, and the product runs as the Document report in Entrust Identity Verification. This guide covers how a check runs, what the results mean and what stays your job under Australian law.

What is Onfido document verification?

It is an automated check of passports, national ID cards and driver’s licences, run through an application programming interface (API) or software development kit (SDK). Following the acquisition, Entrust’s developer documentation describes Onfido as now known as Entrust.

The Document report uses data integrity, visual authenticity and database record checks. It can also compare the data on the document with the details your customer typed in.

Document verification answers one question: is this document real? Matching the document to a live face is a separate report. Our guide to Onfido KYC covers the full set of checks.

How does an Onfido document check work?

How an Onfido document check runs

Onfido, now part of Entrust: the Document report, step by step

  1. Capture

    The customer captures the document

    In your app or website, through the web or mobile SDK.

  2. Optional, mobile only

    Chip read by NFC

    Passports, ID cards and residence permits with a chip. A good chip read replaces the visual checks.

  3. Document report

    Data, visual and database checks

    Template, security features, tampering, data consistency, expiry, and a comparison with the details the customer entered.

  4. Optional

    Face matched to the document

    A Facial Similarity report compares a live photo, video or motion capture with the document photo.

  5. Result: clear or consider

    Most reports in seconds. Manual reviews return later by webhook.

Sources: Entrust Identity Verification, Document report; Entrust Identity Verification, NFC for Document report; Entrust Identity Verification, Facial Similarity reports Reviewed

Capture, an optional chip read, the document checks and an optional face match, then a result. Most checks finish in seconds; hard cases go to manual review.

The customer captures the document in your app or website using Entrust’s web or mobile SDK. The image then goes through the checks shown in the figure.

Most Document reports are automated and processed in seconds. Poor images or sophisticated forgeries go to Entrust’s manual review team, and those results arrive later by webhook.

On a phone, the SDK can also read the chip in a passport, national ID card or residence permit by NFC. The chip data is signed by the issuing authority, so when a chip read succeeds the visual checks are skipped. NFC works only in the mobile SDKs.

To confirm the person holding the document is its owner, you add a Facial Similarity report. It compares a live photo, video or motion capture with the face on the document. Our guide to biometric identity verification explains the options.

Which documents can it check?

The Document report covers passports, national ID cards and driver’s licences. In the Entrust dashboard you choose which issuing countries and document types you accept.

A document outside your list, or one issued by a country under comprehensive US sanctions, is flagged by the “supported document” check and rejected. Decide your accepted list before launch, because the customer sees the rejection.

For Australian customers, Australian Transaction Reports and Analysis Centre (AUSTRAC) does not require a particular document. Our document verification checklist covers what to collect and how to record it.

What do the results mean?

The four Document report sub-results

Sub-resultWhat it meansTypical next step
ClearAll underlying checks passedContinue onboarding
CautionA check failed but does not point to fraud, for example the name differs from the one the customer enteredCheck the mismatch with the customer
SuspectedThe document is suspected to be fraudulentBlock, or refer for manual review
RejectedThe check could not go further, for example a poor image or an unsupported documentAsk for a new image or a supported document

Source: Entrust Identity Verification, Document report Reviewed

The overall result is clear or consider; the sub-result says why, and decides what your team does next.

Every Document report returns an overall result of clear or consider. A sub-result tells you why, and that is what your team acts on.

The old idea of a single “rejected” result is out of date: rejected is one of four sub-results, used when the check cannot go further. Build your workflow around all four.

Is Onfido safe and legitimate?

Key facts Onfido document verification at a glance
Owner
EntrustOnfido is now part of Entrust Identity Verification
Certification
ISO 27001, certificate IS 660122Certified by BSI
Audit report
SOC 2 Type II
Speed
Most reports in secondsManual review cases return later by webhook
Data deletion
Rolling, from 48 hoursAn ad hoc deletion is permanent after 20 days

Sources: Entrust Identity Verification documentation; Entrust Identity Verification, Data deletion Reviewed

The vendor facts a compliance or security reviewer usually asks for, from Entrust’s own documentation.

Yes, it is an established, audited service. Entrust states that Onfido (now part of Entrust) is SOC 2 Type II compliant and certified by BSI to ISO 27001, certificate IS 660122.

You control how long applicant data is kept. Under Entrust’s data deletion policy, you set a rolling deletion period with a minimum of 48 hours. A one-off deletion request is permanent after 20 days.

Document images and face captures are personal information under Australia’s Privacy Act. If they are stored overseas, APP 8 asks you to take reasonable steps to check the recipient. Our guide to the Australian Privacy Principles explains what that involves.

Does it meet AUSTRAC’s customer due diligence rules?

A vendor can run the check, but the obligation stays with you.

Key point

Under Australia’s AML/CTF Act, a reporting entity that outsources identity checks remains responsible for meeting its customer due diligence obligations.

AUSTRAC’s outsourcing guidance expects you to do due diligence on the provider and sample its work. Your AML/CTF program records how you do both.

Keep the results, not necessarily the scans. AUSTRAC asks for records of your initial customer checks for 7 years, but not copies of the identity documents. Our customer due diligence checklist sets out each step, and the Verify workflow shows where document checks fit.

Next steps

If your team works in HubSpot, Salesforce or another customer relationship management (CRM), the check is easier to evidence when it runs there. StackGo’s IdentityCheck runs identity verification and AML screening from inside the CRM you already use, with each result kept against the client.

Sources

Ready to make onboarding minutes, not hours?

Start free and run your first check today, or book a demo and we will walk you through it.

Start freeBook a demo