What IDEC is and what its response means for customer checks
How Kazakhstan’s IDEC works, who sends a request, what photo matching checks, and why a positive result does not approve a bank service.
Date checked: 18 October 2026.
A customer takes a selfie in a banking app, and the system receives a positive match. Has the bank checked everything it needs and must it now open an account? Answering requires a distinction between one service’s result and the organization’s decision.
The Identification Data Exchange Center (IDEC) enables data exchange for customer-identification procedures. Its operator is the National Payment Corporation of the National Bank of Kazakhstan (NPCK). In practical terms, IDEC is infrastructure through which an organization receives data and check results for remote service. That describes its role; the actual operations depend on the service chosen. NPCK description; rules, paragraph 2.
The example below concerns photo matching during a remote bank application using synchronous exchange. It shows what IDEC returns, what remains for the bank, and why “verified” is misleading without naming the step.
Several parties stand behind one selfie
Imagine someone applying to become a bank customer remotely. This is a teaching example, not a description of any bank’s interface. The bank has selected IDEC’s photo-matching service. The customer supplies an image and the necessary consent. The participant sends a request, and the service compares the image with a reference portrait from a government database. It returns the result to the participant. This is the task described by the official service page.
Four roles matter in this route:
Party | Role in this example |
|---|---|
Customer | Supplies data and consent in the prescribed way |
Bank as IDEC participant | Runs the customer process, obtains consent for matching, sends the request, and decides on the service |
NPCK as IDEC operator | Operates the system and its services |
Biometric-solution provider | Supplies software for biometric operations; a separate role from the organization serving the customer |
Chapters 2–3 of the operator’s rules distinguish participants from providers. Choosing a face-comparison algorithm and connecting as a participant are therefore different tasks. Buying biometric software does not itself show that an organization is connected to IDEC.
What photo matching answers
In this example, the service assesses how closely a submitted image matches a reference image in a government database. It compares particular images. The official page names the documents whose photographs it uses: Kazakhstan citizens’ identity cards and passports, foreign residents’ permits, and Kazakhstan-issued stateless-person identity cards. That list does not establish support for every document from every country.
Photo similarity and protection against spoofing answer different questions. Matching assesses correspondence between images. Liveness checks look for presentation attacks using photographs, recordings, masks, or deepfakes. The IDEC rules combine these operations in their definition of biometric authentication, but the standalone photo-matching service has its own procedure. Before sending a matching request, a participant must make sure the customer is not using identity-spoofing means.
“The photographs match” does not describe the entire biometric-authentication journey. A product team should answer two concrete questions: where is spoofing ruled out, and where are the images compared? “IDEC does it” without naming the service does not show how the operations are divided.
A positive match does not open an account
The rules draw a direct boundary: the “Participant independently” decides the outcome of its procedures and whether to establish a relationship or provide a service. This is a short excerpt from NPCK rules, paragraph 73.
In our example, the bank receives a matching result and may use it in identity checks. It does not follow that the customer has been approved for a specific financial service. That requires another decision. Photo matching does not promise a creditworthiness assessment, and a positive similarity result is not universal proof that fraud is absent.
There is a less obvious limit. Under paragraph 60, IDEC does not establish the legal status of identity documents when providing services. “The document was verified through IDEC” needs clarification: was a reference portrait obtained, were images compared, or was document status checked separately? Those are different claims, supported by different evidence.
Instead of one vague status, “customer passed IDEC,” a team can describe the actual operation: “Positive photo-match result received; the bank’s process decides whether to provide the service.” This is an editorial example of a record, not an official API response format.
What the IDEC rules cover and who connects
The IDEC rules govern NPCK’s system operation, interaction with participants and biometric providers, services, consent, and disputes. These are the operator’s internal rules, distinct from regulators’ requirements for a particular banking or payment transaction.
Connection is available to organizations meeting the prescribed conditions. Paragraph 4 includes financial and payment institutions, National Bank organizations and subsidiaries, licensed AIFC participants, and other listed categories; other legal entities may be admitted at the operator’s discretion. Banks and microfinance institutions use IDEC in financial services, but a company’s everyday description does not settle its status or connection conditions. Under paragraph 5, participant status begins after the operator registers the service agreement.
For photo matching, the organization registers an app on NPCK’s portal, cabinet.npck.kz, and selects the service. The official page describes separate credentials for each app and requests sent to the operator. That is the connection sequence, not a promise of instant production access. Contracts and technical specifications need separate checks. NPCK instructions.
IDEC also offers biometric authentication, FinID two-factor authentication, and management of the E-sign cloud digital signature. Instructions for one service do not automatically describe the others. For biometric and two-factor authentication and cloud-signature use, the participant sends consent parameters, while the rules place collection, creation, and registration of that consent on IDEC’s side. Services.
Photo matching also depends on the exchange method. Under paragraph 67, the participant obtains consent itself and sends it with the request. For the synchronous method, paragraph 75 says an electronically signed request sufficiently evidences consent to the operator, while the participant remains responsible for actually obtaining it. The asynchronous method has a separate rule: under paragraph 76, IDEC obtains consent through the state service controlling access to personal data. The synchronous example cannot be applied to every matching request.
Whether a particular route is mandatory is a matter of applicable sectoral law. Separate biometric-authentication rules No. 99/72 apply to financial and payment organizations. Including IDEC in an architecture does not itself establish compliance with all those requirements. This article explains the system’s role, not a bank’s complete legal position.
Apply the distinction to your project
Return to the customer who took a selfie. To explain the route to colleagues or choose an integration, first answer three questions.
Which service is used? Photo matching, biometric authentication, FinID, and E-sign contain different operations.
What did its result confirm? Here, similarity of images within the photo-matching service. Do not silently attribute spoofing checks or document-status checks to that response.
Who makes the next decision? The participant determines the outcome of its procedures and decides whether to provide the service; the technical response is one input.
This short check exposes gaps in a process description but does not replace technical design or legal assessment. If the team cannot name the service and its result, start with NPCK documentation and a map of its own operations. If it needs to choose remote-verification components, it can discuss those with Biometric.Vision’s Kazakhstan team, while separately clarifying the required service, division of operations, and confirmed integration terms. Contacting a vendor does not establish its status in IDEC infrastructure.
Sources
NPCK: published PDF of the IDEC rules, especially paragraphs 2–5, 60 and 67–74.
Adilet: joint biometric-authentication rules No. 99/72, distinguishing operator rules from regulation.
Originally published in Russian. Adapted for English readers.
This article is for information only and does not replace advice from a qualified lawyer.
Ready to strengthen your customer checks?
500 free checks a month for a year · no card · no contract · no sales call.
