The evaluation folder on the operations head’s desk at an NBFC in Pune holds five vendor decks. Each one shows OCR, video KYC, liveness and an AI badge. Each demo read a crisp PAN card in under a second. Her real files look different: a blurred Aadhaar photo taken on a moving bus, a rent agreement scanned sideways, a salary slip that does not match the bank statement.
The right way to choose KYC automation software for banks and NBFCs is to test it on your worst files and your strictest controls, not on the vendor’s polished demo. Below is the checklist we would use if we were on the buying side, grouped by the questions that actually separate one product from another.
The demo is the least useful part of the evaluation
A demo is built to succeed. The documents are clean, the customer answers every prompt and nothing needs a second look. That tells you the product can read, which every serious option can.
What a demo hides is the exception path. Ask the vendor to run a pack of your own masked files through the flow, including the ugly ones. Watch what happens when a document is missing, when the name on the PAN differs from the name on the bank statement, and when the address proof is older than your policy allows. If you want a structured way to compare the two operating models first, our guide on manual vs automated KYC verification lays out the trade-offs step by step.
Where the customer starts decides your drop-off
Many products assume the customer will download an app or find an upload portal. In India, many applicants already spend their day on WhatsApp, and asking them to install something new adds a step where some of them stop.
Check three things. Can the customer send documents on WhatsApp, the web or at a branch? Is a missing item requested in the same conversation, or does the customer get an email asking them to start again? Can a video-KYC slot be booked inside the same chat? Each break in the conversation is a day lost and an applicant who might not come back.
Your credit and KYC policy has to stay yours
A good tool applies your rules the same way every time. A poor one quietly applies its own. Ask who writes the rules and bands, and whether you can see them in plain language.
Then ask what happens outside the band. The answer you want is that a person decides, and the file reaches them with the reason it was flagged. Ask also how registry checks are controlled. PAN, CKYC and account-aggregator lookups should run only where your policy allows them, not by default because the integration exists. Confirm the specifics against your own KYC policy with your compliance team.
Write access is the question that separates vendors
Reading a document changes nothing. Writing to your core banking or loan system changes a record that an auditor will later ask about. That is why the most revealing question in any evaluation is simple: what can this software change, and who decided that?
| Question to ask | Answer to look for |
|---|---|
| What does it do by default? | Reads; writes nothing until you open an API |
| How are writes controlled? | Only through APIs you choose to open |
| Who approves below a threshold? | A second person, maker-checker, before any write |
| Can one agent be stopped alone? | A kill switch per agent |
| Where is the evidence? | One audit log for every read, decision and write |
If a vendor cannot answer these crisply, the gap will show up later in an audit rather than in procurement. Our KYC maker-checker exceptions playbook covers how to set thresholds and who sits on each side of the check.
The question that separates KYC vendors is not what the software can read. It is what the software can change.
A scored test pack beats a feature matrix
Here is an illustrative example, not a customer result. Say you assemble a test pack of 50 masked files from one loan journey: 30 clean salaried files, 15 self-employed files with income documents and 5 files with poor photos or a missing proof.
Score each vendor on three outcomes. Clean files handled without a person, out of 30. Exceptions flagged with a correct reason, out of 20. Missing items requested in the same conversation, out of the 5 files that needed one.
Suppose Vendor A clears 27 of 30 clean files and gives a correct reason on 12 of 20 exceptions. Vendor B clears 24 of 30 but explains 18 of 20. Both request all 5 missing items in the chat, so that column does not separate them. Weight the exception score double, because a wrongly cleared exception costs more than a clean file a person reviews. Vendor A scores 27 + (12 × 2) = 51. Vendor B scores 24 + (18 × 2) = 60. The vendor with the flashier straight-through rate loses once you count what matters to compliance.
The numbers are invented. The method is the point: test on your files, weight by your risk, and write the scores down before anyone sees a price.
Re-KYC and deployment belong in the same evaluation
Onboarding gets the attention, but periodic re-KYC is where branch queues and frozen accounts come from. Ask whether the same product can run re-KYC on WhatsApp by risk segment, with self-declaration where nothing changed and documents where something did. Ask how campaign progress is tracked, and whether you get branch lists for the customers who still need a visit. The periodic re-KYC process guide walks through what that campaign looks like in practice.
Deployment is not a footnote either. Your information security team will want to know whether the product runs on managed cloud, in your own VPC or on-premises, who holds the keys and where data sits. Settle this early. A product that only runs one way can end an evaluation in the final meeting.
The case for a shorter checklist
The strongest objection is that a checklist this detailed slows procurement. The business wants faster onboarding this quarter, applicants are dropping off now, and a long evaluation feels like the same delay in a new form.
We take that seriously. The answer is not to skip the questions but to run them on one journey. A 50-file test pack takes a few days to assemble, and the five write-access questions take one meeting. That is far cheaper than discovering after go-live that the software writes to your core in ways compliance never approved. Starting narrow is also how the work actually lands, which is the argument of our post on starting KYC automation with one journey and one metric.
What to do this week
- Pick one product journey and pull 50 recent files, masked, including the messy ones.
- Write down the five write-access questions from the table above and send them to every shortlisted vendor.
- Agree with compliance how exceptions will be weighted in the score.
- Ask each vendor to show re-KYC by risk segment, not only onboarding.
- Confirm with information security which deployment options are acceptable.
A careful evaluation is not caution for its own sake. It is how you end up with a system your operations team uses, your compliance team trusts and your auditor can follow. More on each step is in the AutoKYC guides.