Why platforms ask for an identity card image and a selfie

Platforms ask for an identity card image and a selfie to verify that the person opening the account is the person named on the card. The documents can be used for other purposes. A careful reader shares them only with an entity whose identity and regulator are verified, and asks who the data controller is. Account renting puts the lender's name on the transaction trail.

What the identity check is for

A platform asks for an identity card image and a selfie to check that the account is being opened by a real person and that the person is who they say they are. The card shows a name and a face; the selfie shows a face. The platform compares the two faces. This is called identity verification.

The check is required by anti-money-laundering rules in many countries. The platform must know its customer. The card image and the selfie are stored. The platform's privacy policy should say how long they are kept and who can see them. The reader should read that policy before sending anything.

What can be done with the documents

An identity card image and a selfie can be used to open other accounts in the person's name. They can be used to apply for loans, to register for services, or to impersonate the person. The risk is real. The documents should be shared only with an entity whose identity is verified.

The entity's identity means its legal name, its registration number, and the regulator that authorises it. The reader should check those details on the regulator's own register before sending the documents. If the entity cannot be verified, do not send the documents. The selfie can be used to make a video that appears to be the person.

Who the data controller is

The data controller is the person or company that decides why and how the documents are processed. The platform should say who the data controller is. The data controller is responsible for protecting the documents and for answering requests to delete them. Ask the platform in writing who the data controller is.

The data controller may be in another country. The laws of that country may be weaker than the laws of Pakistan. The reader should ask where the documents will be stored and who will have access. If the answers are not clear, do not send the documents.

What account renting means

Account renting is lending a bank or wallet account to another person for a fee. The person who rents the account uses it to receive and send money. The account is in the lender's name, so the lender's name is on every transaction. When the police or a regulator looks at the transaction trail, they see the lender's name.

The lender may be held responsible for transactions they did not make. The lender may be accused of money laundering or fraud. The fee is not worth the risk. The transaction trail is a record that cannot be erased. The lender's name is on it forever.

What the transaction trail contains

The transaction trail is the record of money moving in and out of the account. It shows the account holder's name, the amounts, the dates, and the counterparties. The trail is kept by the bank or wallet provider. It can be obtained by regulators and law enforcement.

When a person rents their account, the trail shows their name on transactions they did not authorise. The trail does not show that the person was paid a fee. It shows only that the person's account was used. The person may have to prove they were not involved. That is hard to do.

What a careful reader does

A careful reader shares identity documents only with an entity whose identity and regulator are verified. The reader asks who the data controller is and where the documents will be stored. The reader reads the privacy policy. The reader does not rent their account to anyone.

If a platform asks for documents before it has been verified, the reader should refuse. If a person asks to rent the reader's account, the reader should refuse. The risk is not worth the fee. The reader's name is on the trail, and the reader may be held responsible.

The selfie ties the document to a live person at a particular moment

Platforms pair the identity card image with a selfie because the card alone can be reused by someone who is not its holder. The selfie records a face next to the document, often with a code or the day's date written on a slip of paper. That makes it harder to submit a stored photograph of a card found on a shared device. The check is meant to show the same person holds the card and is present at the time of the request.

The request is not unique to trading or crypto venues. Banks, mobile wallets and delivery services in Pakistan use similar steps when an account is opened remotely. A platform that asks for both items is following a common onboarding pattern. The pattern does not by itself prove the platform's business is lawful. It only shows the platform wants to collect a particular kind of evidence before it grants access.

Readers sometimes assume a selfie check means the platform is cautious and therefore reliable. That is not what the procedure establishes. A platform can collect identity documents and still operate without any Pakistani registration. The selfie requirement is a data-collection step, not a licence. The value of the step is limited to what the platform does with the images after they are received.

Account renting puts the renter's name on every movement of funds

When a person rents out an account, the bank or wallet record keeps that person's name as the account holder. Every incoming and outgoing transfer is then linked to the renter's identity, not to the person who actually controls the account. The renter's CNIC, address and phone number sit on the transaction logs. That record can be pulled long after the account is closed or the renter tries to move on.

The trail is not limited to the platform that asked for the documents. Banks and payment processors retain their own copies of the transaction history. Law-enforcement and regulatory bodies can obtain those records through formal requests. A renter who thought the activity was small may discover that the account name appears in a much larger set of transfers, each one carrying the renter's details.

The practical consequence is that the renter cannot later claim ignorance of what the account was used for. The records show the account was opened with the renter's own identity documents and a selfie. The account holder agreed to the bank's terms when the account was created. Those terms typically prohibit letting another person operate the account. The renter's name, not the operator's, remains on every entry.

A platform can store the images long after the account is closed

Once an identity card image and a selfie are uploaded, the platform controls the copies. Deleting the account or removing the app from a phone does not erase the files held on the platform's servers. The retention period is set by the platform's own policy, which may change after the upload. The user has no practical way to verify that the images have been destroyed.

The risk grows when the platform is not registered in Pakistan. A local regulator can inspect the data practices of a licensed entity. An overseas platform may store the images in another country, under different privacy rules. The user who sends the documents has no direct route to enforce deletion. The images may remain available to the platform's staff, contractors or successors.

Readers should treat the upload as a one-way disclosure. The documents are not returned, and the selfie is not a temporary snapshot. The platform may use the images for further identity checks, for dispute resolution or for sharing with partners. The user's only real control is the decision to upload in the first place. After that, the platform's storage practices determine what happens to the files.

The request for documents often comes before any legal relationship exists

Many platforms ask for the identity card image and selfie during the sign-up stage, before the user has opened an account or made a deposit. At that point the platform has not yet agreed to provide any service. The user is handing over sensitive documents in exchange for the possibility of access. The platform may reject the application after receiving the images, and the user has no remedy.

The sequence matters because the documents are not being submitted to a known regulator or a licensed broker. They are being submitted to a website that may have no presence in Pakistan. The user cannot confirm who will see the images or how they will be stored. The platform's terms, if any, are usually accepted by clicking a box before the documents are uploaded. That acceptance often includes broad permissions for data use.

A more cautious order of operations is to first establish what the platform is and whether it is registered with any Pakistani body. The user can ask for the legal entity's name and its registration number. If the platform refuses or gives vague answers, the document request should be treated as a warning sign. No legitimate Pakistani financial institution withholds its registration details before asking for identity documents.

The selfie can be reused for other accounts without the holder's knowledge

A selfie that shows a face next to an identity card is a reusable image. If the platform's storage is compromised, the image can be paired with the card to open accounts elsewhere. The person in the selfie may not learn of the misuse until a bank or a regulator contacts them. The face and the card details together are enough for many remote verification systems.

The reuse is not limited to the same platform. The images can be sold or shared with other operators who need to satisfy their own onboarding checks. A single set of documents can support multiple accounts, each in the holder's name but controlled by someone else. The holder's identity becomes a tool for activities the holder never authorised and may not understand.

The practical defence is to avoid sending the selfie to any platform that cannot be clearly identified as a Pakistani-regulated entity. A licensed broker or bank will have a named data controller and a complaints process. An unregistered website may provide no such information. The user who uploads the selfie to an unknown platform is giving away the very evidence that could later be used to impersonate them.

The documents are not proof that the platform is allowed to handle funds

A platform that collects identity card images and selfies may still be operating without a licence to hold customer money. The document request is not a registration certificate. It does not show that the platform is authorised by the SECP, the State Bank or any other Pakistani regulator. The platform may be using the documents to create a false impression of legitimacy.

Readers sometimes confuse the onboarding process with regulatory approval. A platform can ask for every document a bank asks for and still be outside the law. The test is not whether the platform requests identity documents. The test is whether the platform appears on a Pakistani register of authorised firms. The document request alone answers neither question.

The safest reading is to treat the document request as a neutral data-collection step. It tells you the platform wants to identify its users. It does not tell you whether the platform is allowed to trade, to take deposits or to send money abroad. Those questions must be answered by checking the registers, not by looking at the platform's sign-up page. The documents are not a substitute for registration.