Cookie settings

Choose which optional cookies we can use. You can change this at any time from Cookie settings at the bottom of every page.
Guide

Onfido KYC: how it works, checks and results

Onfido KYC is the identity verification platform now sold by Entrust, which bought Onfido in April 2024. It checks that a photo ID is genuine, matches the face to a live selfie or Motion capture, and can screen for sanctions and PEPs. Results come back as clear or consider through an API and SDKs.

By Matt Collis·Updated 21 October 2026·Reviewed 21 October 2026·Version 5·4 min read

This guide is for compliance staff and developers weighing Onfido for customer identity checks in Australia. Product facts come from Entrust’s own pages and developer documentation, checked on 21 October 2026.

What is Onfido KYC?

Onfido is an identity verification platform owned by Entrust. Entrust completed its acquisition of Onfido on 9 April 2024, and now sells the product as Entrust Identity Verification, formerly Onfido IDV.

The Onfido name lives on in the technology and the developer tools. The API addresses still sit on onfido.com, so most teams still call it Onfido.

At its core it answers one question: is this person who they say they are? It does that by checking a photo ID and matching the face on it to a live selfie or video, one building block of KYC compliance.

What can an Onfido check include?

Entrust sells the checks as separate reports, and you choose which ones run. The main ones are:

  • Document report: checks a passport, national ID card or driver’s licence is genuine, from more than 2,500 document types across 195 countries
  • Facial Similarity report: compares a selfie, video or Motion capture with the face on the document, to prove the person owns it
  • Watchlist report: screens the name against sanctions, politically exposed persons (PEPs) and, in the AML variant, adverse media
  • Known Faces report: flags a face that has already been through your own verification flow, a sign of repeat fraud
  • Identity Enhanced report: cross-checks a person’s details against verified databases

Most Document reports are automated and processed in seconds. Hard cases, such as poor images or sophisticated forgeries, go to an Entrust manual review team.

Motion is Entrust’s liveness check. The person turns their head on camera, and the report scores whether the capture is real and live, not a photo or a replay. Learn more about biometric identity verification and the Onfido document check in our other guides.

How does an Onfido check run?

How an Onfido check runs, in order

A Workflow Studio run, from your server to the result

  1. Step 1

    Create an applicant

    Your server sends the person’s name and details to the API.

  2. Step 2

    Start a workflow run

    The run returns an SDK token for your web or mobile app.

  3. Step 3

    Capture ID and face

    The person photographs their document, then takes a selfie, video or Motion capture.

  4. Step 4

    Reports run

    Document and Facial Similarity, plus Watchlist or Known Faces if you added them.

  5. Result: clear or consider

    The run lands on approved, review or declined, and a webhook tells your system.

Sources: Entrust documentation, Quick start guide; Entrust documentation, Workflow Studio Reviewed

Your server sets up the check, the person completes capture in the SDK, the reports run, and the result comes back as clear or consider.

Checks run inside Workflow Studio, Entrust’s no-code builder. You drag the capture steps and reports into a workflow, and the software development kit (SDK) shows the person the right screens.

Your server creates an applicant and a workflow run through the API. The run returns a token that starts the SDK in your web or mobile app.

The SDKs cover iOS, Android, Web, React Native and Flutter. Captured images pass straight to the reports in your workflow, and a webhook tells your system when the run finishes.

What results do you get back?

Each report returns clear or consider. Clear means it passed. Consider means something needs a look, and the breakdowns say what.

The workflow run then lands on a status such as approved, review or declined, depending on the rules you built. You can read results in the Entrust dashboard or pull them through the API.

Results stay in Entrust until your systems fetch them. Getting them onto the client record in your customer relationship management (CRM) system is your own integration work, or a partner’s.

Does Onfido meet AUSTRAC customer due diligence?

Onfido can verify identity, which is one part of customer due diligence. AUSTRAC’s rules ask for more than an identity match.

Key point

Under Australia’s AML/CTF Act, a reporting entity must complete initial customer due diligence before it starts providing a customer with a designated service.

According to AUSTRAC’s initial CDD guidance, you must also establish beneficial owners and anyone acting for the customer. You check whether any of them is a PEP or under sanctions, and you rate the customer’s risk.

You must keep records of how you established each matter, for 7 years after the relationship ends. A verification result is part of that record, not all of it.

What privacy rules apply to biometric checks?

A face match uses biometric information. The OAIC treats it as sensitive information under the Privacy Act 1988.

Key point

Under Australia’s Privacy Act 1988, a covered business must generally get a person’s consent before collecting their biometric information.

The Act covers businesses with annual turnover over A$3 million, and some smaller ones. Our guide to the Australian Privacy Principles explains the rest.

Also check where data is stored. Entrust’s documentation lists region-specific addresses for Europe, the US and Canada, so plan for overseas storage.

Frequently asked questions

Is Onfido the same as Entrust?

Yes. Entrust bought Onfido in April 2024 and now sells it as Entrust Identity Verification. The developer documentation and API still carry the Onfido name.

Does Onfido screen for sanctions and PEPs?

Yes, through its Watchlist reports. The anti-money laundering (AML) variant adds adverse media, and ongoing monitoring can re-screen a person every 24 hours once enabled on your account.

Can I test Onfido before going live?

Yes. Sandbox API tokens return templated responses and are not charged. Live checks need billing details on your account.

Next steps

Choosing a verification provider is one decision. Running every check from the place your team already works is the other, along with sanctions screening and a risk rating.

StackGo’s IdentityCheck triggers checks from a pipeline stage in your CRM and writes verification, screening and risk back onto the contact. See how IdentityCheck works with your CRM or how it supports AUSTRAC Tranche 2 compliance.

Sources

The facts on this page come from these sources, checked on 21 October 2026. Product facts come from Entrust:

Australian rules come from the regulators:

Ready to make onboarding minutes, not hours?

Start free and run your first check today, or book a demo and we will walk you through it.

Start freeBook a demo