The green checkmark is a user-interface decision. It is not a records decision. A new customer uploads an ID and a selfie, a payment app or an online broker says they are in, and that is the end of their task. It is the start of a filing system. One photograph can become several records at once, held by different companies, under different clocks, sometimes in different countries. None of those copies has to disappear because the screen said yes.
That pattern shows up wherever digital onboarding has replaced a branch visit: payment apps, online banking, broker platforms. It is a description of how these stacks commonly behave, not a floor plan of any single firm.
If you are buying the stack, the screenshot is the wrong document to trust. The examples below (FATF record-keeping, the EU’s incoming anti-money-laundering regulation, Indonesia’s personal-data rules) are illustrations, not a compliance program, and not legal advice. What you must keep, delete, or send abroad depends on your role, your licenses, and the jurisdictions you actually touch.
What the upload actually becomes
In a typical flow, software pulls a name, a birth date, and a document number off the image. Automated checks look for signs of tampering and compare details with registries the firm is allowed to query. A face match compares the selfie with the photo on the document. Liveness detection tries to confirm a living person is in front of the camera, rather than a printout or a replay.
Those checks do not all leave the same residue. Verification vendors often keep the original document photo and a biometric template (a mathematical sketch of facial geometry, not the picture itself). The financial firm more often receives the extracted text, a pass or fail, and a bundle of risk signals. Some vendors hand back raw images and raw scores through an API. Others return only yes or no. Creating a template does not, by itself, tell you whether the original image must go. That is a policy and contract question, and many agreements never answer it.
A blurry frame, glare on a laminate, a typo, or an ID layout the system has not seen can send the case to a person. A flag is a quality problem until someone shows it is something worse. The same humility applies to sanctions screening. A name match is a prompt to look, not a finding that the customer is sanctioned. It still creates a record: the alert, the analyst’s note, the case file. Those can outlive the upload that triggered them.
Then the copies multiply in places nobody put on the architecture slide. Reviewer notes, webhook logs, support exports, and spreadsheet pulls often land in internal queues. In many implementations those duplicates do not share an audit trail with the file everyone calls official. Closing the account often does not sweep them. Deleting the photo the customer can see often does not either.
The stack writes records the customer never typed
This is where AI automation in onboarding stops being a speed feature and becomes a data problem. The customer typed a name and held up a card. The stack may also have logged a device signature, an IP and proxy read, how fast the session moved, and a pattern match against earlier fraud, including synthetic-identity signals the person never entered. Most of that is telemetry and fraud rules. Some of the scores beside it are model outputs. Both are records. Deleting the selfie does not explain them, and it does not remove them.
NIST’s digital identity guidance, SP 800-63-4, discusses device fingerprinting, IP and proxy analysis, transaction velocity, and historical fraud indicators as fraud-management controls in identity proofing. The same guidance expects a credential service provider to document why it collects, uses, and retains biometrics, and to keep a policy covering retention, protection, and deletion of personal, sensitive, and biometric data, including what happens if the provider shuts down or transfers the operation. It also expects a privacy-risk assessment before fraud technology goes live, and a practice statement that relying parties can actually obtain.
Those are duties for that class of US provider. They are not a map of how an Indonesian bank, a payments app, or a broker is built. Borrow them as procurement questions. “Stored securely” is not one of the answers.
Encryption in transit and at rest, role-based access, and audit logs are necessary. They are still not enough. A stolen administrator credential walks past encryption, because the thief is using a key the system already trusts. A support ticket with a passport image attached is a leak that never touches the bucket everyone calls secure.
Five years is a baseline for some records, not a timer for every copy
People reach for a single number and then apply it to everything. Don’t.
FATF Recommendation 11 is the baseline most compliance teams are trained on. Keep transaction records for at least five years. Keep customer-due-diligence records (copies or records of identification documents, account files, business correspondence, and the results of analysis) for at least five years after the business relationship ends, or after the date of an occasional transaction. Ending a relationship and finishing a one-off payment do not start the same clock.
That is a minimum for those specified records. It is not a timer for every selfie, template, or vendor-side copy, and it is not a ceiling. Some regimes run longer for particular files. Sanctions record-keeping is a common example of a clock that does not match the ordinary customer file. A vendor’s advice to “keep the longest period that might apply” is a recommendation, not a statute. So is the heuristic that any data used to make a compliance decision must be kept long enough to defend that decision. Useful as a prompt. Not a citation. Ask counsel whether a given biometric, template, or case note falls inside a required record, and for how long.
From July 10, 2027, Regulation (EU) 2024/1624, the EU Anti-Money Laundering Regulation, is due to apply directly and replace a patchwork of national retention rules. That date is the application date. It is not, by itself, the retention period, and it is not a license to treat a vendor’s article number as the rule. If a summary cannot state the period and any permitted extension in plain language, read the regulation with counsel before you redesign the archive.
Extra copies still need a defined purpose and an end date. A backup or a general archive is not a retention program unless the record can be isolated, dated, and produced when someone asks.
Ongoing monitoring sits on top of signup: watching transactions, updating the file, looking into activity that does not fit. Higher-risk profiles can bring enhanced due diligence and a request for more paper: tax forms, bank statements, source of funds. In many jurisdictions a suspicious-activity review creates its own retention duty. It does not, by itself, reset every copy of the original onboarding pack onto one timer.
A server country is not a legal answer
Indonesia is a clear worked example of the mess buyers actually inherit. A personal-data statute is in force, the implementing regulation is still a draft, and the product pattern is familiar: a local brand, a reviewer who may sit somewhere else. The questions travel. The article numbers do not.
OneAsia Lawyers reads Indonesia’s Personal Data Protection Law, Law No. 27 of 2022, as a sequence, not a permission slip. The destination should offer protection equal to or greater than Indonesia’s. If it does not, the controller must put adequate and binding protection in place. Consent is the fallback only when those routes fail. That is not blanket permission to export identity images or biometrics.
The consent fallback is the part teams misuse. On OneAsia’s summary of the draft regulation, it would be confined to non-recurring transfers, a limited number of people, a necessary purpose that is not detrimental, plus a risk assessment, safeguards, and notice to the data-protection committee and the person. Draft article numbers can move. That account does not point to a finished list of approved destinations, or to committee standard clauses that would make the other routes operational. Binding corporate rules, where recognized, work inside one corporate group, not for an outside vendor. Get the transfer instrument and the evidence in writing. Repeated onboarding through the same overseas reviewer does not fit that narrow consent box.
Naming a server country misses the test. Storage location, the place a reviewer sits, and the right to reuse the data are three different facts. A bank and a fintech can share a vendor and still have different duties. In the European Union, the Court of Justice’s Schrems II judgment required extra measures where contract clauses cannot restrain foreign government access. On OneAsia’s reading, Indonesian rules do not yet deal with that problem. Weigh it for identity images and biometrics. It is not proof that any particular transfer is unlawful.
What to demand before you sign the vendor
Ask for the controlling legal entity and a privacy contact, not a brand name. In many contracts the firm sets the purpose and the vendor runs assigned checks. Some vendors also claim their own purposes, such as fraud tooling or model improvement. Ask which legal entity controls each copy. Ask which vendors and subprocessors receive which fields, and for what purpose: verification, fraud tooling, model improvement, support. Ask for server countries and for where people can open the file. Ask for the retention window on each class of record, and for the event that starts the clock: end of the relationship, completion of a transaction, or the close of an investigation.
Then ask for the documents a serious identity provider should already have. Why are biometrics collected? How long is each type kept? How does deletion work? What happens if the vendor ceases operations or transfers the data? Which fraud tools are deployed, and was a privacy-risk assessment done before they went live? A public summary of the practice statement is a reasonable request. “Stored securely” is not an answer.
Customers will ask the same questions, often after a scare. Train support on the dull habit that actually works: send people to the official app, or have them type the firm’s domain. An unexpected upload link is how fake document requests travel.
If onboarding is supposed to finish in minutes, budget for the filing system behind the checkmark. The stack can be fast. The copies it creates are not free, and they do not share a delete button.
Questions worth settling before the next vendor call
-
Does approval mean the selfie is gone?
No. The screen can clear while the firm, the verification vendor, and support systems still hold different versions of the same upload, on different schedules.
-
Is five years the rule for every photo and biometric template?
No. FATF Recommendation 11 sets a five-year baseline for specified transaction and customer-due-diligence records, not a timer for every image or vendor file. Ask counsel whether a biometric used in a compliance decision must be kept long enough to defend it, and put an end date on every extra copy.
-
Can we rely on customer consent to send identity data to an overseas reviewer?
Not as the normal path, and not on the strength of a draft. Under Indonesia’s in-force personal-data law, as OneAsia Lawyers reads it, equivalent protection or adequate and binding safeguards come before consent, and the draft’s narrower consent route (numbers that can still move) would not cover repeated onboarding of many customers even if adopted as written.
-
Is “the server is in this country” a complete privacy answer?
No. The test is destination status, the transfer instrument, the evidence you keep, and who can actually open the file (reviewers and subprocessors included). Storage, access, and reuse rights are different facts.
-
Does an automated flag mean the customer committed fraud?
Not by itself. Blur, glare, and odd document layouts can route a case to a person, and a sanctions name match is a prompt to check, not a verdict, though the alert and the analyst notes can outlive the upload.
-
Does closing the account wipe the history?
Not automatically. Ending a relationship, completing a transaction, and opening a suspicious-activity review are different triggers, and the last of those depends on the jurisdiction. A backup you cannot isolate, date, and produce is still a copy you should be able to account for.