Can you run KYC without storing passports? Yes. Here's the difference between keeping a passport scan and keeping verification evidence, and how to do it.
Table of contents
- KYC without storing passports is possible, and increasingly expected, because the law requires you to retain evidence that verification happened, not necessarily a copy of the passport image itself.
- Most firms store passport scans out of habit and convenience, not because a regulator demands the raw image, and every stored scan becomes a liability in a breach.
- Record-keeping rules such as FATF Recommendation 11 and the EU's retention requirements oblige you to keep the data and documents used to verify identity, which verification evidence can satisfy.
- Reading the NFC chip in a modern document, instead of uploading a photo, lets you verify identity against cryptographically signed data and keep only what you need.
- Decentralised, sharded storage means even the data you must retain is never pooled into one breachable database, which is the practical route to holding no plaintext passport images.
- Zyphe verifies via chip read with no image upload, shards retained data across more than 60,000 nodes under a customer-held key, and issues a reusable credential, so this is the default behaviour, not an add-on.
KYC without storing passports means verifying a customer's identity and meeting record-keeping obligations without retaining a copy of the raw passport or ID image, keeping instead the cryptographic and data evidence that proves verification occurred. It relies on data minimisation: reading signed chip data rather than photographs, retaining only what regulation requires, and never pooling it centrally.
TL;DR
The practice is possible because regulators require you to keep evidence that you verified a customer, not a copy of the passport photo. Firms store scans out of habit, and each one is breach liability. By reading the signed NFC chip rather than uploading an image, you can verify identity and retain only the minimal evidence the rules demand. Decentralised, sharded storage then ensures even that evidence is never pooled into one database. Together these let a firm satisfy FATF and EU record-keeping obligations while holding no plaintext passport images, which is both a security and a data-minimisation win.
Can you do KYC without storing passports?
Yes. The approach is not only possible, it is increasingly the better-engineered default. The confusion arises because people conflate two different things: verifying an identity, and warehousing the document used to verify it. You must do the first and prove you did it. You do not have to keep a photograph of someone's passport indefinitely to satisfy that proof.
The reason this matters is risk. A database of passport images is one of the most attractive targets a criminal can find, because each record is a complete, reusable identity. Breaches of identity data have repeatedly caused lasting harm precisely because the stolen material was rich and permanent. So the question is not whether the approach is allowed, but how to design verification and record-keeping so that you retain the evidence the law wants while holding none of the raw images an attacker wants.
Why do firms store passport scans in the first place?
Most firms store passport scans for reasons that have little to do with what regulation strictly requires. The dominant reason is convenience and precedent: early flows asked users to photograph or upload a document, the image was easy to keep, and keeping everything felt safer than deciding what to discard. Over time, retaining the full scan became a default that few teams revisited.
A second reason is misplaced caution about audits. Compliance teams reasonably want to show a supervisor what they relied on, and storing the original image feels like the most complete answer. But completeness of evidence is not the same as keeping the raw document, and the instinct to hoard often creates more risk than it resolves. A third reason is technical inertia: the verification vendor stored the image, so the firm inherited a copy, and no one re-examined whether that was necessary. None of these are regulatory mandates. They are habits, and habits can be redesigned, which is the whole premise here.
What does the law actually require you to keep?
The relevant obligation is record-keeping, and it is more specific than people assume. The FATF standards, through Recommendation 11, require obliged entities to keep records of the data and documents obtained through customer due diligence for at least five years, sufficient to reconstruct the verification and respond to authorities. The EU framework imposes comparable retention requirements. The key phrase is records of the data and documents used, which is about being able to evidence and reconstruct the verification, not about preserving a particular file format such as a photo of a passport page.
At the same time, data-protection law pushes against hoarding. The GDPR's data-minimisation principle in Article 5 requires that personal data be adequate, relevant and limited to what is necessary. Holding a full passport image when a smaller set of verified data fields and cryptographic evidence would satisfy the record-keeping obligation is in tension with that principle. Read together, the rules point toward keeping verification evidence and the minimal necessary identity data, retained securely for the required period, rather than a permanent library of document photographs. That is exactly the space this approach occupies.
What is the difference between a passport and verification evidence?
The distinction at the heart of the matter is between the document and the proof. Storing a passport means retaining the raw image or scan of the physical document, a rich artefact that contains far more than the verification needed and that, if stolen, hands an attacker a complete identity. Keeping verification evidence means retaining a defensible record that verification occurred: which data fields were checked, against what source, when, with what result, and the cryptographic signatures or audit references that let you reconstruct the decision.
Verification evidence answers every question a supervisor or auditor will actually ask, namely whether you identified the customer, verified them against a reliable independent source, and can demonstrate it. It does so without preserving the one thing a criminal most wants. This is the same logic that underpins an audit-ready compliance stack: the value is in the trail, not the trophy. Once a firm internalises that the obligation is to evidence the verification rather than to keep the document, the idea stops looking radical and starts looking like basic data hygiene.
How do you verify identity without storing the image?
The practical route starts at capture. Instead of asking a user to upload a photo of their document, read the NFC chip embedded in modern passports and ID cards. That chip stores cryptographically signed data to the ICAO Doc 9303 standard, so you can verify the document is authentic and unaltered without ever taking or keeping a picture of it. Removing the image upload also removes a major deepfake and tampering surface, because there is no photograph to forge or manipulate.
From there, combine the chip read with liveness to confirm a real person is present and bound to the document, then extract only the data fields you need and the proof of the check. Retain that minimal evidence for the required period, and discard everything else. The result satisfies the record-keeping obligation while holding no plaintext passport image. This pairs naturally with reusable credentials: once a user is verified this way, a KYC passport lets them re-present their verified status to the next service without re-uploading anything, with proof of address handled on the same minimal-retention basis. The deepfake-resistance benefits of skipping image upload are covered further in our guide to deepfake detection in KYC.
Does decentralised storage enable KYC without storing passports?
Decentralised storage is what makes the approach robust rather than merely minimal. Even when you reduce what you retain to the necessary verification evidence, that evidence is still personal data, and if it sits in one central database it remains a single point of failure. Decentralised, sharded storage solves that by splitting the retained data across many locations so that no single node holds a complete record, and reconstruction requires a threshold of nodes to cooperate.
This is the architecture behind decentralised PII storage and decentralised KYC. It means there is no honeypot to breach, because there is no single place where a complete identity record lives. It also pairs with privacy-preserving verification techniques, including the zero-knowledge proof approach to KYC, where a relying party can confirm a fact about a user, such as that they passed KYC or are over a certain age, without receiving the underlying data at all. Combined, chip-based capture, minimal retention and decentralised sharding turn the practice from an aspiration into a default posture.
How does Zyphe do KYC without storing passports?
Zyphe is built so that this is the standard behaviour, not a configuration you have to engineer. Verification reads the NFC chip in modern documents to the ICAO 9303 and eIDAS standards, with two-step liveness and no image upload, so there is never a passport photograph to store in the first place. Only the minimal verified evidence required for record-keeping is retained.
That retained evidence is then sharded across a network of more than 60,000 nodes under a scheme that requires a threshold of nodes to reconstruct anything, with a customer-held key and no master key, so there is no central store to breach. Verified users carry a reusable credential, removing repeat capture and repeat storage across services. Data residency can be pinned per region, integration takes around fifteen minutes through a single API, and the audit trail remains complete and exportable, so meeting record-keeping obligations never requires keeping the raw document. The outcome is verification that satisfies FATF and EU retention rules, respects GDPR data minimisation, and holds no plaintext passport images anywhere. Book a demo to see it running end to end.
The bottom line
KYC without storing passports rests on one clarifying distinction: the law wants proof that you verified a customer, not a permanent copy of their passport. Once a firm separates the document from the evidence, the path is clear. Capture identity by reading the signed chip rather than uploading an image, retain only the minimal verification evidence the rules require, and shard that evidence across a decentralised network so it never forms a central honeypot. The result satisfies FATF and EU record-keeping, honours GDPR data minimisation, and removes the single richest target in most compliance stacks. Storing passport scans was always a habit, not a requirement, and it is a habit worth retiring.
Related resources
- What is decentralised PII storage?
- What is a KYC passport?
- Deepfake detection in KYC
- Zyphe decentralised KYC
- Building an audit-ready compliance stack
Cited sources
Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.