> ## Content Index > Fetch the complete content index at: https://research.finbox.in/llms.txt > Use this file to discover other available public pages before exploring further. # How borrower verification is becoming part of credit infrastructure in Southeast Asia - URL: https://research.finbox.in/blog/borrower-verification-southeast-asia/ - Published: 2026-10-21T09:51:47.000Z - Updated: 2026-10-23T07:22:32.000Z - Description: Vietnam builds biometrics into transactions, the Philippines is opening PhilSys to lenders, Malaysia puts consent in the borrower’s hands. Verification is becoming something lenders use long after onboarding. - Author: Shivani Mishra - Tags: Digital Lending, identity decisioning, Fraud detection, Sentinel, philippines, Vietnam, Malaysia, Southeast Asia, KYC, #Sentinel For years, borrower verification in Southeast Asia was largely built around onboarding. Complete KYC, verify the borrower, meet the regulatory requirements, and move on to underwriting and disbursement. That is starting to change. In markets such as the Philippines, Vietnam, and Malaysia, verification is becoming something lenders use beyond onboarding. Identity information can help with fraud checks, credit decisions, and monitoring what happens to a borrower after a loan has been disbursed. Regulation is part of the reason, but it is not the only one. Digital lending has grown quickly, fraud is getting harder to spot, and a KYC check done when someone takes out a loan does not tell a lender much about that person months or years later. For lenders, that makes verification more than a compliance exercise. Keeping those checks relevant throughout the lending relationship can help catch unusual activity earlier, reduce fraud losses and give lenders more information when making decisions, particularly as they move into new products and markets. The initial KYC check still matters. But it is only the starting point. What matters just as much is what happens after the borrower has been approved. ## **The SEA lending environment: why verify once no longer fits reality** Southeast Asia’s digital lending market is growing quickly. The region’s digital loan book went from around [$62 billion in 2023 to roughly $90 billion in 2025](https://www.glinsight.com/southeast-asia-digital-lending-adoption-story/?ref=research.finbox.in). Separate estimates cited by [Singapore’s Ministry of Trade and Industry](https://www.theasset.com/article/56995/asean-digital-lending-tipped-to-hit-us200-billion-by-2030?ref=research.finbox.in) put the market at around $200 billion by 2030, up from about $70 billion in 2024\. These estimates come from different sources and methodologies, so the figures are not directly comparable. But lenders are not operating under one set of rules. Licensing requirements, data regulations and consumer-protection expectations vary across the region, so a verification process that works in one market may not work the same way in another. At the same time, traditional credit signals are not always enough: - **Many borrowers still have thin or no credit files -** Lenders are turning to alternative data, wallet activity, telco records, merchant transactions and payroll data, for a fuller picture, an approach [Southeast Asian lenders are building into thin-file underwriting](https://www.axefinance.com/resources/news-blogs/lending-in-southeast-asia-cashless-era-credit-risk-management-strategies/?ref=research.finbox.in) for [borrowers credit-invisible to traditional bureaus](https://fintechnews.ph/72920/lending/alternative-data-southeast-asia-unbanked-borrowers/?ref=research.finbox.in). - **Lending is moving faster -** Authorisation, disbursement and repayment can happen almost instantly, leaving little time to assess affordability or spot fraud. Checks that once ran in batches now need to happen in real time: [open banking APIs in Singapore, Malaysia and Thailand have cut underwriting from five days to five minutes](https://www.asialifestylemagazine.com/asean-digital-economy-fintech-growth/?ref=research.finbox.in), and [lenders in Indonesia, the Philippines and Vietnam now approve in minutes and disburse same-day](https://fintechasia.net/2026/08/10/how-digital-lending-platforms-are-driving-financial-inclusion-across-asia/?ref=research.finbox.in). - **Identity fraud is getting harder to spot -** [iProov's 2026 Threat Intelligence Report](https://www.iproov.com/press/iproov-issues-annual-threat-intelligence-report?ref=research.finbox.in) recorded a 720% increase in identity attacks across Southeast Asia in Q3 2025 and describes the region as a testing ground for newer fraud techniques, including virtual camera attacks and stolen KYC identity packages. - **Regulators want proof,** not paperwork – Lenders increasingly need to show what happened, when, and whether there's a clear audit trail: [the Philippines' BSP issued its first AI governance framework for financial institutions in 2026](https://worldngayon.com/bsp-stars-framework/?ref=research.finbox.in), requiring oversight from planning through ongoing monitoring, and [Indonesia's OJK now requires model governance records, bias-testing reports and audit trails from fintechs](https://www.theleveragedyears.com/ai-regulation-news/indonesia-ojk-ai-governance-banking-2026?ref=research.finbox.in). All of this makes a one-time verification check harder to rely on. A borrower’s circumstances, behaviour and risk can change after the loan is approved. The verification process needs to be able to change with them. ## **How lenders in SEA are approaching borrower verification and risk** More lenders in Southeast Asia are starting to look beyond the initial loan approval and pay closer attention to what happens after the money is disbursed. That is changing where verification and risk checks happen during the lending process. | Risk dimension | What lenders are doing | Why it matters | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | | Cash flow monitoring | [Tracking changes](https://www.axefinance.com/resources/news-blogs/ai-in-lending-how-southeast-asias-biggest-banks-transform-credit-risk-management/?ref=research.finbox.in) in income, seasonal patterns and post-disbursal cash flow, and flagging sudden week-on-week drops in income deposits. | Early warning before missed payments, and support for proactive collections and limit management. | | Multi-point risk checks | [Checking device signals](https://www.cgap.org/research/publication/solutions-to-protect-consumers-fraud-in-digital-finance?ref=research.finbox.in), behavioural biometrics and beneficiary-risk scores during origination and disbursement, rather than waiting for the borrower to log in again. | Helps catch mule accounts or synthetic identities before funds leave the lender. | | Total debt view | [Monitoring](https://www.aseanexchanges.org/content/fintech-and-embedded-finance-from-hyper-growth-to-sustainable-scale/?ref=research.finbox.in) BNPL balances, credit cards and wallet-based loans, and watching for instalment stacking, rising minimum-payment ratios and repeated short-term refinancing. | Prevents over-leverage, and enables earlier limit or pricing adjustments. | | Auditability | [Logging](https://worldngayon.com/bsp-stars-framework/?ref=research.finbox.in) what checks were run, when, and how they affected decisions, and moving beyond “KYC completed” to “here is the decision trail”. | Supports model governance, explainable AI and regulatory examinations. | This is where continuous verification starts to matter. Verification becomes part of the ongoing risk process, alongside the checks lenders already use to set limits, price loans and manage collections. It is no longer something that happens at onboarding and then disappears into the compliance process. ## **Three markets, three different approaches to borrower verification** The Philippines, Vietnam and Malaysia are all trying to solve the same basic problem: how do you know the person using a financial service is really who they say they are? But each market is approaching it differently, and that affects how lenders can use verification. ### **Vietnam: biometrics built into transactions** Vietnam has moved biometric verification closer to the transaction itself. Decision [2345/QD-NHNN](https://vietnamnet.vn/en/unverified-bank-accounts-face-transaction-restrictions-starting-january-2025-2353708.html?ref=research.finbox.in) made biometric authentication mandatory for certain high-risk online transactions, following a rise in online banking fraud. The rules have since become stricter. From 5 January 2026, [Circular 45/2025/TT-NHNN](https://www.biometricupdate.com/202512/vietnam-integrating-biometrics-into-daily-life-in-digital-transformation-drive?ref=research.finbox.in) requires banks to complete a face-to-face biometric check before issuing a new bank card. The card cannot be used for electronic transactions until the check is complete. For lenders, this means verification can happen when a transaction takes place, rather than only when the borrower first signs up. Disbursements, repayments and card issuance can all become points where the lender checks that the person making the transaction is still the right person. ### **The Philippines: using national ID for more than onboarding** The Philippines has taken a different approach. It first built out a large national ID system and is now connecting financial institutions to it. By late October 2025, 90.29 million Filipinos, or around 80% of the population, had registered for [PhilSys](https://techpilipinas.com/bsp-require-banks-e-wallets-link-national-id-system?ref=research.finbox.in). The next step is making that system more useful to financial institutions. [On 6 August 2026, BSP published a draft circular that would require most BSP-supervised institutions to integrate with PhilSys' National ID Authentication Services (NIDAS)](https://bworldonline.com/banking-finance/2026/08/07/768645/bsp-wants-banks-to-use-national-id-authentication-in-kyc-processes/?ref=research.finbox.in). Universal and commercial banks, digital banks, e-money issuers and virtual asset providers would have three months to submit their onboarding applications, while other supervised institutions would have six months. For digital lenders, this could make PhilSys useful beyond the initial KYC check. Instead of treating the national ID as something verified when the borrower signs up, lenders could use the service to confirm the borrower’s identity again later in the relationship. ### **Malaysia: putting the borrower in control** Malaysia is taking a more deliberate approach. [Eighteen banking institutions are participating in the second sandbox phase for MyDigital ID, with ten actively integrating and two having completed the process as of early 2026, according to Malaysia's Ministry of Finance](https://www.thestar.com.my/business/business-news/2026/01/23/mydigital-id-phase-2-sandbox-involves-18-banks?ref=research.finbox.in). The main difference is the role of the borrower. MyDigital ID is built around consent, so the customer actively approves an access request on their own device. That means the verification does not always happen instantly like a database lookup. For lenders, that creates a different kind of workflow. The system has to account for the fact that the borrower may not approve the request immediately. The customer has more control over when their identity is accessed, but the lender’s verification process also needs to handle that extra step. ### **Why identity can't be established once and left alone** A "verify once at onboarding" model made sense when lenders could reasonably assume that a borrower's risk would stay more or less the same after approval. That's much harder to assume now, given how quickly lending and fraud are changing across the region. Lenders don't just approve a loan and walk away. They manage that relationship for months or even years. Top-ups, limit increases, refinancing and changes to repayment methods can all create new risks that a check completed at onboarding won't pick up. Vietnam offers a good example of why this matters. As part of its [account clean-up, the State Bank of Vietnam found that, out of roughly 200 million bank accounts in the country, only 113 million individual accounts and around 711,000 organisational accounts remained valid](https://vietnamnews.vn/economy/1721534/more-than-86-million-bank-accounts-to-be-terminated-from-september-1.html?ref=research.finbox.in) after biometric authentication requirements were applied. Nearly 86 million other accounts were flagged as inactive, unregistered or linked to fraudulent activity, with deletion starting on 1 September 2025\. For lenders, that has a practical implication. An account that looked valid when a borrower was onboarded may not remain usable or trustworthy later. If a lender's systems assume otherwise, it can end up making decisions based on an identity or account that has effectively fallen out of the system. The fraud data points in the same direction. [iProov's report recorded a 741% full-year increase in injection attacks targeting iOS devices](https://www.iproov.com/press/iproov-issues-annual-threat-intelligence-report?ref=research.finbox.in), a platform that had generally been considered harder to compromise. The takeaway for lenders is fairly simple: identity can't be treated as a permanent fact established on day one. As new signals appear and borrower behaviour changes, the confidence a lender has in that identity needs to be checked again. ### **How this plays out on the ground** Once borrower verification becomes something lenders use throughout the loan, rather than a one-off check at onboarding, the way their systems work starts to change. Take re-KYC. Instead of checking every borrower on the same schedule, lenders can trigger another verification when something specific happens: - A transfer or disbursement crosses a certain threshold, as Vietnam's rules already require. - The borrower changes their repayment account or method. - The borrower asks for a top-up or an increase in their credit limit. - Someone logs in from an unfamiliar location or device, or their behaviour suddenly looks different. That's a different approach from either checking everyone on a fixed calendar or not checking again after the initial KYC. The decision to verify again is based on what is happening with the borrower. Malaysia introduces a different practical challenge: the borrower's approval can take minutes or even hours to come back, since it depends on them acting on their own device. That can be difficult for verification systems built around an immediate database response. If the system expects an answer straight away, a delayed approval could look like a failed check. The flow needs to be able to wait, check again when the borrower responds and continue without automatically treating the delay as a rejection. Verification can also move beyond a simple pass-or-fail result. Lenders can work with different levels of confidence. High confidence might support the standard limit and pricing. Medium confidence could trigger another verification step or a lower initial limit. Low confidence could send the borrower for manual review or result in a decline. That confidence can then change as new information comes in. Instead of making one identity decision at onboarding and leaving it there, lenders can keep reassessing how much confidence they have in the borrower throughout the relationship and use that information in underwriting, limit management and collections. ### **The infrastructure lenders actually need** Making this work takes more than connecting a few verification providers. Lenders need a layer that can sit above the different market-specific systems and manage how identity information moves through the rest of the lending stack. That layer needs to: - **Understand how verification actually works in each market**, and trigger it accordingly, rather than forcing every market into the same workflow. - **Hide the complexity of individual integrations.** Verification results from different providers should feed into the same decisioning layer in a consistent format. That way, a lender operating across several markets can work from one risk picture instead of trying to piece together three separate systems. - **Keep a clear audit trail.** BSP, SBV and BNM do not have identical requirements, but lenders still need to show when verification happened, what checks were run and what the outcome was. That means keeping records of verification events, timestamps, outcomes and relevant session data for the required retention periods. The idea is simple: build the decisioning and orchestration once, then adapt it to each market instead of rebuilding the entire verification flow every time a lender enters a new country. That is also the thinking behind [Sentinel Superflows](https://www.finbox.in/sentinel?ref=research.finbox.in). The focus is on bringing different borrower signals together and orchestrating them throughout the lending journey, rather than treating verification as a single check at onboarding. ### **How this changes credit decisioning** Once verification becomes an ongoing process, it becomes part of how lenders make decisions throughout the loan, not just another KYC step at the beginning. A borrower with medium identity confidence might need an extra check. Higher identity risk could mean a lower limit or different pricing. If that confidence drops later, the lender could trigger a fraud review, take another look at the account or place temporary restrictions on it. The question lenders ask changes too. It's no longer just, "Has this borrower been verified?" It becomes, "Are we still confident this is the right person today, and has anything changed since they signed up?" That gives lenders something they can act on. They can approve a top-up when the borrower's identity still looks consistent, flag an account when something changes unexpectedly, or show an auditor how the borrower's identity and risk profile changed over time rather than relying on a KYC check from months or years ago. ### **Where this leaves lenders** Southeast Asia's borrower verification landscape is fragmented because each market has built its identity infrastructure differently. Those approaches make sense within their respective markets. The challenge comes when a lender operating across the region tries to fit all three into the same KYC process. For lenders expanding across Southeast Asia, the more practical approach is to have an identity layer that can work with the way verification actually happens in each country. It also needs to keep feeding those verification signals into lending decisions after onboarding, rather than treating KYC as something that happens once and then disappears into the compliance stack. So the question isn't really which KYC vendor a lender should choose. It's whether the identity infrastructure behind the lending product can keep up as the borrower, the risk and the market change. That is where [Sentinel Superflows](https://www.finbox.in/products/superflows?ref=research.finbox.in) fits in. It gives lenders one layer for managing different verification flows across markets, without forcing them all into the same process.