When you're building a fintech, it is easy to add verification checks as new needs come up. You start with an identity lookup, add liveness when you need biometric confirmation, then bring in AML screening or fraud monitoring later. The problem is that these checks can end up working separately, leaving gaps in the verification process.

A complete identity verification stack connects these checks from the start. This guide breaks down the five layers, what each one covers, and what to consider when choosing a provider to run them effectively.

Layer 1: Identity Foundation

Once your fintech starts gaining traction and onboarding users, the first step is to confirm that the identity being submitted is real and matches an authoritative record.

To build this layer effectively, focus on these things:

• Start With a Government Database Lookup: In Nigeria, you can verify BVN or NIN against the relevant database, while Ghana uses the Ghana Card through NIA and Kenya uses its National ID records through IPRS. The CBN requires electronic retrieval of BVN or NIN information from NIBSS or NIMC for new individual accounts and wallets.
• Know What the Check Confirms: A database match confirms that the submitted details correspond to an existing identity record. It does not confirm that the person submitting those details is the actual holder. That is where biometric verification comes in.
• Plan for the Markets You Serve: The identity rail you can use depends on where you operate. Expanding from Nigeria to Ghana, for example, means supporting Ghana’s identity infrastructure rather than relying only on Nigerian ID rails.

But confirming the identity is only the first step. You still need to confirm that the person presenting it is the real holder.

Layer 2: Biometric Confirmation

Two checks work together here:

• Liveness Detection: Liveness checks whether a real person is present during verification. It helps detect presentation attacks, such as using a photo or pre-recorded video instead of a live person.
• Face Match: Face matching compares the face captured during verification with the photo linked to the submitted identity. This helps confirm that the person presenting the identity is its actual holder.
• Why Both Checks Matter: Liveness can confirm that a real person is present, but it cannot tell you whose identity they are presenting. Face matching helps establish that connection, while liveness helps protect the face comparison from presentation attacks. Both checks therefore address different parts of the same verification problem.

The biometric check covers the person. You also need to verify the document they are presenting.

Layer 3: Document Verification

This layer checks the document itself, separate from the database check.

Here’s how this layer fits into your verification process:

• When Database Coverage Is Limited: Not every document type in every African market has a live database connection. Document verification gives you another way to assess whether the document is authentic when a database check is unavailable.
• As an Additional Check: For higher-risk use cases, you can run document verification alongside a database check. This adds another authenticity check and can help detect forged or altered documents that contain genuine identity details.
• Know What the Check Confirms: Document verification assesses whether the document is genuine and whether its details are internally consistent. It does not establish that the person presenting it is the legitimate holder.

A genuine document is only part of the picture. The next step is checking whether the identity carries any compliance risk.

Layer 4: AML and Compliance Screening

A customer can pass every identity check and still appear on a sanctions list, qualify as a PEP, or be linked to adverse media.

Here’s what this layer needs to cover:

• Sanctions, PEP and Adverse Media Screening: Before onboarding, the verified identity should be screened against sanctions lists, PEP databases and adverse media. A person may not appear on a sanctions list but could still be a PEP or linked to credible adverse media that requires further review.
• Ongoing Re-screening: A customer who passes screening at onboarding may become a match later as sanctions lists and other risk information change. Ongoing screening helps identify those changes after the account is active.
• Keep Screening Connected to the Identity Record: Screening results should remain connected to the verified customer record. This gives the compliance team a clearer audit trail and reduces the manual work involved in matching screening results to identity verification records.

AML screening covers risk identified through external sources. The final layer looks at what happens on the platform after the customer is onboarded.

Layer 5: Post-Onboarding Monitoring

Passing onboarding checks does not mean the risk stays the same after an account goes live. A customer's behaviour can change after verification.

Here’s what to watch for:

• Behavioral Monitoring: Behavioral monitoring looks at how an account normally behaves and flags significant changes. New devices, unusual login activity, or navigation patterns can indicate account takeover or social engineering.
• Transaction Monitoring: Transaction monitoring tracks activity against the account's own history. Unusual transaction velocity, new counterparties, or unexpected fund movements can reveal patterns associated with mule activity, APP fraud, or coordinated fraud.
• Why Onboarding Checks Alone Are Not Enough: A customer can pass all the checks at onboarding and still become a risk later. Mule account activation, KYC farming, and sleeper account schemes can develop after verification. These patterns become visible through ongoing behavioural and transaction monitoring.

With all five layers in place, the focus shifts to choosing a provider that can run them effectively.

What to Look for When Choosing a Provider

Not every provider covers all five layers, and those that do may not offer the same level of coverage or accuracy across African markets.

Here’s what to consider:

• African ID Rail Coverage: Look for live connections to the identity systems used in your target markets, such as BVN and NIN in Nigeria and Ghana Card verification in Ghana. Document verification should not be treated as a replacement for a live database connection where one is available.
• First-Try Pass Rates and False Positives: Poor accuracy with local documents or faces can lead to failed verifications and unnecessary customer drop-off. Ask for market-specific pass-rate and false-positive data, rather than relying only on global figures.
• Unified Stack vs Multiple Vendors: Using separate providers for database checks, liveness, AML screening, and transaction monitoring can leave you managing multiple integrations and fragmented customer data. A provider that covers the full stack through one integration can simplify that setup.
• Compliance Reporting Support: For identity verification infrastructure in a Nigerian fintech, verification logs, audit trails, and screening results should be easy to access when your compliance team or banking partner needs them. The provider should also support reporting for requirements relevant to your market, including CBN examination and NFIU reporting.

This is what Dojah's verification infrastructure is built to deliver for African fintechs.

How Dojah Covers All Five Layers in One Platform

The five layers can be handled through Dojah’s verification infrastructure. This means you can manage identity checks, biometrics, compliance screening, and post-onboarding monitoring without separate vendors.

With Dojah, these five layers work together in one platform:

• Government database lookups: Verify identities using BVN and NIN in Nigeria, Ghana Card in Ghana, and other supported African identity systems through Dojah's government ID verification capabilities. 
• Liveness detection and face match: Liveness checks and face matching work together to help establish that a real person is presenting the identity. 
• Document verification: When database verification is unavailable, this provides another way to check whether an identity document is genuine. It can also add an extra authenticity check for higher-risk use cases.
• AML and compliance screening: Dojah's AML Watchlist supports screening for sanctions, PEPs, and adverse media, with ongoing monitoring available for changes after onboarding. 
• Post-onboarding monitoring: Profiled Risk and Easy Detect provide risk and fraud monitoring capabilities beyond the initial verification process.

For African fintechs, the goal is to have these checks work together as verification needs grow. Dojah brings the five layers into one integration.

Ready to move beyond fragmented verification? See how Dojah brings your identity and fraud checks together in one stack.

Frequently Asked Questions About How to Build an Identity Verification Stack for Your African Fintech

1. What should an identity verification stack for an African fintech include?

A complete stack should cover identity database checks, biometric verification, document verification, AML screening, and post-onboarding monitoring. Each layer addresses a different verification or risk gap.

2. What is a KYC stack in Africa?

A KYC stack in Africa is the combination of tools and processes a fintech uses to verify customers, check their identity documents, screen for compliance risks, and maintain reliable verification records.

3. Do Nigerian fintechs need more than BVN and NIN verification?

Yes. BVN and NIN verification can establish that an identity matches an authoritative record, but they do not by themselves confirm the person presenting the identity or identify risks that emerge after onboarding.

4. How do I choose identity verification infrastructure for a Nigerian fintech?

Look for strong African ID coverage, accurate verification, connected verification layers, and reliable compliance reporting. This helps the infrastructure scale without unnecessary integration work.

5. Can one provider handle an entire identity verification stack?

Yes, some providers offer multiple layers through a single integration. This can reduce the need to manage separate vendors for identity checks, biometrics, AML screening, and post-onboarding monitoring.