AI voice agents for KYC and identity verification handle the calls around a check, including onboarding drop-offs, flagged accounts, re-KYC reminders, card activation and login callbacks. The agent asks the questions your program lists, sends the answers to your system and reads back only its result. Your system makes the decision, and documents and codes stay off the call.
Key Takeaways
- The agent asks your program's questions, and your system returns match, no match or review.
- Documents, full card numbers, PINs and one-time codes never go on the call.
- The caller's voice is never proof of identity, because AI can now copy voices.
A phone number finds a customer record, but never proves who picked up. This guide covers the five KYC calls a voice agent can take, why checking comes before disclosing, what stays off the line and how the check runs in Dograh. You can self-host Dograh or run it on Dograh Cloud.
Which KYC calls a voice agent can take
Most KYC work on the phone is outreach and confirmation around the identity check, and that is the part a voice agent can take. Five calls come up again and again. A customer stops halfway through onboarding and needs help to finish. A new sign-up needs its details confirmed, or the risk system flags an account. An existing customer is due for a KYC update. A new card has shipped and is not active yet. A login or a payment looks unusual and needs a quick yes or no.
These calls sit right where fraud meets the phone. The FTC received 3 million fraud reports in 2025, with $15.9 billion in reported losses. The Federal Reserve's survey of household well-being found that 20% of adults experienced fraud or a scam in 2025, and put non-credit-card fraud at an estimated $100 billion, of which $56 billion fell on consumers. A real identity call has to sound nothing like the scams your customers hear every week.
So every call in this guide keeps one line. The agent asks the questions your program lists, and your system checks the answers. The call is one input to your verification and never the decision. The US Customer Identification Program rule shows why. Before opening an account, a bank collects at least a name, date of birth, address and identification number, and its procedures must let it form a reasonable belief that it knows who the customer is. Contacting the customer is one of the listed ways to verify without documents, so a call can feed that belief. The belief itself stays with the bank. Your program and your counsel decide which steps a call may cover, so confirm your setup with them before the first call.
Card payments the customer did not make are a close cousin of these calls. AI voice agents for fraud-alert callbacks covers confirming a flagged card transaction, where the agent tells and never asks.
Greet, verify, then disclose
A phone number finds a record, but it does not prove who is on the line. So any call that shares or collects account details checks who is on the line before it names any of them. The Greeting Text on the Start Call node plays fixed words, so it always names your bank or company the same way. Where your program wants customers told up front that an automated assistant is calling, or local law demands it, that line belongs in the same fixed greeting. A customer can talk over that greeting while Allow Greeting Interruption keeps its default of on, so turn the setting off on the Start Call node whenever the greeting carries a notice.
Pre-Call Data Fetch can load the customer's record as the call connects, so the agent knows which case it is calling about. The prompt then keeps every detail from that record unspoken until the check passes. Your program sets the check. A common pair is the date of birth plus the last digits of an account number, never a full number. A customer who fails the check hears no account details at all, and the agent logs a request for a callback. One call runs lighter. An outbound callback about a sign-in shares nothing from the account, so it asks for nothing either, as the login section below explains.
The caller's voice never counts as proof. In a speech on deepfakes, Federal Reserve Governor Michael Barr warned that bank identity checks that use voice detection may become vulnerable to generative AI tools. A cloned voice can say the right words in the right accent. The check rests on what the caller knows and what your system holds, never on how the caller sounds.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
What never goes on a KYC call
Documents, selfies, full ID numbers, full card numbers, CVVs, PINs, passwords and one-time codes stay off the call for good. Whatever a caller says is in the transcript and the recording, word for word. A safe design keeps secrets from being spoken at all, instead of hoping to clean them up later.
Documents go through your app. When a customer needs to upload a passport or a proof of address, an HTTP API tool asks your app or messaging provider to send the secure upload link during the call. The agent says the link is on its way and what to upload. It never asks the customer to read a document number aloud.
Callers answer by voice, so every question the agent asks must be one the customer can say out loud safely. If a caller starts reading a card number anyway, the prompt tells the agent to stop them and point to the app. What was said before that point is already in the transcript, so your team deletes it from your own storage. Our post on handling payment-sensitive (PCI) calls in a voice agent explains why pausing a recording does not fix this. Self-hosted, recording can be switched off only server-wide, and transcripts are still saved.
How the check runs in Dograh
The agent never compares anything itself. It passes what the caller said to your system and waits for the answer. An HTTP API tool does the work. Its parameters are values the model fills from the conversation, such as the date of birth the caller just gave, and the tool sends them to your verify endpoint.
Your endpoint answers with match, no match or review, and never with the stored value. The agent receives the whole response body, so anything in it, the agent can say. A verify service that returns only the result keeps the real date of birth out of the call. The tool can also play a message when it starts, such as "Let me check that", while the request runs, and a later update like "I'm still checking" if the lookup takes a few seconds.
Tools attach to each step of the call flow separately. Put the tools that read account details only on the step after the check, so a caller who fails never reaches them. AI voice agents for banking and credit unions uses the same order. If your endpoint times out or returns an error, the agent gets one error result, so the prompt tells it to say it can't confirm right now and someone will call back.
A review result goes to a person. Transfer Call works on Twilio, Telnyx, Plivo, Cloudonix and Asterisk ARI. The reviewer's phone rings first, and the customer is joined only once someone there picks up. With Twilio numbers, the agent can introduce the customer to the reviewer out loud before the two connect. No summary travels with the call, so an HTTP API tool writes the details to your system first. A bank calling on Exotel or Vobiz numbers gets a callback request logged for the customer in place of a live transfer.
Onboarding calls in fintech
The onboarding call goes to someone who started opening an account and stopped. Your app knows the step they left at. It starts the call through the API Trigger, the agent verifies the customer, and only then names the open step.
Most of the call is confirming what the customer already typed, such as the spelling of a legal name or an address, and saying exactly what is still missing. Documents and ID numbers go through the app, never the call. In a bank partnership, the partner bank's identification program usually sets the questions, and your contract says who owns which step. AI voice agents for KYC and identity verification in fintech walks through the drop-off call.
BNPL sign-up and flagged accounts
A buy now, pay later lender uses two identity calls, a sign-up confirmation and a check on an account its risk system has flagged. Automated checks on documents and selfies run in the app at sign-up. The call is narrower. It confirms details the customer already entered, or answers the questions the risk system asks after an unusual login or a new device.
The risk system starts the call with the API Trigger and passes the reason as context. The agent asks its questions, and the system returns pass, fail or review. The agent never explains the flag in detail before the check passes. A flagged customer who is also behind on payments goes to your collections flow, which our post on missed-payment recovery in BNPL covers. AI voice agents for KYC verification in BNPL covers both calls.
Re-KYC and periodic updates in banking
Re-KYC calls remind existing customers that their KYC is due and take a simple update when nothing has changed. In India, the Reserve Bank of India's KYC (Amendment) Directions, 2025 ask banks to send at least three advance notices before the due date and three reminders after it. At least one in each set must be a letter, and each one is recorded against the customer.
Calls can fill the other slots, and the letter still goes out. A Webhook node at the end of each call sends the outcome to your system, so the reminder is logged against the customer the moment the call ends. If the customer has moved, the agent records the new address as stated and says how to send proof through the app or a branch. Under US rules, banks update customer information on a risk basis instead of a fixed cycle. AI voice agents for KYC verification in banking covers both markets.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
Card activation calls
An activation call is a service call about a card the customer asked for. The agent names the bank, runs the check, and confirms the card arrived. It never asks for the card number.
If your bank allows activation by phone, the agent asks your system to activate the card once the check passes, and your system's response is the only thing that activates anything. Otherwise, the agent tells the customer how to finish in the app. Any offer, such as a credit limit increase or a second card, belongs on a separate call with its own consent. AI voice agents for card activation covers both the outbound reminder and the inbound "I want to activate my card" call.
Login and transaction callbacks
A callback about a sign-in or an account change confirms an event your system already saw, and it takes nothing from the customer. The agent calls the number on file, names the bank and says the call is about a sign-in it wants to confirm. It asks for no personal details and no code, only a yes or a no. Since the call reveals nothing from the account, it needs no identity check. A "that wasn't me" goes straight to your app or to a person on your fraud team, or the agent asks the customer to call the number on the back of their card.
Proof that the customer holds their phone stays in your app, where they approve or deny the request. Nothing secret crosses the call, which is out-of-band verification done the safe way. The FTC's advice to consumers is plain, since a real caller from a bank never asks for a verification code. A flow that asks for one teaches customers the exact habit scammers rely on, and the code sits in the transcript afterwards. Calls the customer starts keep the full check, because the agent may then discuss the account. AI voice agents for OTP and identity verification callbacks covers both directions, including the rare inbound flow that still needs a code read back.
Where KYC call data sits
Identity calls carry names, dates of birth and account digits, so decide where the audio and transcripts live before the first call. Dograh is self-hostable. When a bank hosts it on its own servers, none of its customers' call data ever passes to Dograh as a company.
In this setup Dograh runs the call flow, the verify tools and the telephony, while the speech and language models form a separate layer the bank picks. Using the bank's own keys (BYOK) with a model provider puts the models under the bank's own contract with that provider, but the customer's audio still travels to it. Call audio stays in-house only with open-weight models on your own servers, such as Qwen3.8 27B for language, Parakeet TDT 0.6B v2 for speech-to-text and Magpie TTS for the voice. The phone carrier stays on the call either way.
Out of the box, a self-hosted install reports anonymous usage telemetry, so a bank that wants nothing leaving its network sets ENABLE_TELEMETRY=false and deletes POSTHOG_API_KEY. The self-hosting guide covers the install. On cost, a self-hosted bank pays no per-minute platform fee but still pays for its servers, model keys and phone minutes, while Dograh Cloud adds a 1¢-a-minute platform fee.
Start with re-KYC reminders or activation calls, where the check is simple and nothing secret is needed. Add terms such as KYC and your product names to the Dictionary in the agent's Settings, then test on a real phone line, because phone audio is harder for speech-to-text than a browser test. Each call above has its own deep dive:
- AI Voice Agents for KYC and Identity Verification in Fintech
- AI Voice Agents for KYC Verification in BNPL
- AI Voice Agents for KYC Verification in Banking
- AI Voice Agents for Card Activation
- AI Voice Agents for OTP and Identity Verification Callbacks
Glossary
- Customer Identification Program (CIP)
- The US rule that tells banks what to collect before opening an account and how to verify it. A voice call can be one input, but the reasonable belief that the bank knows the customer is the bank's own judgment.
- Non-documentary verification
- Checking a customer's identity without documents, for example by contacting the customer or checking a credit bureau. A KYC call fits here, and its answers go to the bank's system for the decision.
- Periodic updation
- India's term for re-KYC: refreshing a customer's KYC records on a schedule. The RBI asks for three notices and three reminders, with a letter in each set, logged against the customer.
- Out-of-band verification
- Proving identity through a second channel the customer already controls, such as approving a request in the bank's app. On a callback, it keeps codes from being spoken on the call.
