From a captured document to a controllable decision

Distinguish six functions

Reading a document is not identity verification. OCR recognises characters; extraction maps values to fields; document verification examines authenticity indicators. Biometrics compare a person’s characteristics, liveness checks look for evidence of live presence, and a KYC decision applies a business process and its obligations. These functions can contribute to one journey without becoming interchangeable.

The distinction prevents a design mistake: turning a correctly extracted name into a trust decision. NIST SP 800-63A-4 separates identity proofing operations. It is a technical reference, not regulatory approval of a KYC workflow or certification of an OCR engine.

Capture: obtain a usable image

Blur, glare and incomplete framing can make fields unreadable before inference begins. Define capture checks for a complete document, legibility, sufficient size, orientation and obstruction. Give understandable feedback and allow another capture without trapping users in a loop.

Keep quality rejection reasons separate from extracted content. A glare-rejected image is not evidence of fraud. Test devices and lighting conditions; measure capture attempts and the time needed to obtain a usable image.

Classification and correction

Identify the document family and variant before selecting relevant regions. An unknown category should remain unknown: forcing the closest template can produce convincing but incorrect extraction. Perspective correction and cropping should preserve links to the source image so reviewers understand what was read.

Test changes between document editions, front/back combinations, extra pages and out-of-scope documents. Classification may use models, rules or both; assess its errors separately from recognition errors.

Specialised OCR and vision-language models

Specialised OCR remains useful when fields, scripts and compute constraints are well defined. Vision-language models broaden options for varied layouts, but introduce different behaviour, costs and evaluation needs. Choose using a local corpus and output contract rather than a general leaderboard.

The 2026 PP-OCRv5 report and PaddleOCR multilingual documentation provide current references. Their results must not be attributed to Identity OCR or your documents without measuring the actual version and hardware.

Extraction and lossless normalisation

Define a schema including raw value, normalised value, source region, engine and version. Handle dates, identifiers and names through explicit rules. Normalisation must be traceable: it should not silently discard an unusual character or invent a date from an ambiguous string.

For missing or unreadable fields, return an unknown value with a reason. Do not fill gaps using linguistic plausibility. Check formats and cross-field consistency while distinguishing reading errors, document inconsistencies and business rule failures.

French, Arabic and display

Bilingual documents require evaluation by script and field. Preserve Arabic and Latin forms, handle reading direction and test similar-looking characters, digits and name variants. Different transliterations do not establish fraud or justify silent correction.

The Unicode bidirectional algorithm addresses display order, not semantic equivalence between names. Test review interfaces, exports and searches: a correctly stored string can become misleading when mixed writing directions are displayed badly.

Rules and scores: expose uncertainty

Separate model confidence, format checks, consistency checks and operational decisions. A high score is not necessarily a calibrated probability of correctness. Measure its relationship to observed errors by document type and field, then choose thresholds according to business error costs.

For MRZs, ICAO Doc 9303 provides structure and checking rules. A valid checksum can support reading consistency; it does not establish document authenticity or the holder’s identity. Expose these checks separately in the output.

Human review that people can use

Reviewers should see the field, source region, failed checks and useful alternatives. Provide confirmation, correction and rejection with understandable reasons. Preserve corrections as events distinct from initial extraction; make them auditable without unnecessarily exposing documents to others.

Measure review workload and disagreements between reviewers. A threshold sending nearly everything to people can erase operational value; one that artificially reduces escalations can allow costly errors through. Evaluate both effects together.

Confidentiality and on-premise deployment

Deploying inside the information system can help control access and data flows, but does not establish compliance automatically. Map images, fields, temporary files, logs, backups and any telemetry. Restrict networking, test data, retention and exports; check deletion on relevant storage media.

The CNDP describes data processing conditions in Morocco. The process owner must determine applicable requirements and filings. A local engine alone does not resolve purpose, minimisation, data subject rights or operational security.

Tests, performance and drift

Build an authorised, reviewed ground-truth dataset covering families, variants, languages, capture quality and out-of-scope cases. Separate development and validation documents, avoid near duplicates and retain versions. Measure field accuracy, severe errors, cases completed without intervention and human correction rates.

Test end-to-end latency, throughput under load, memory and queues on target hardware. Monitor new variants, devices and rejection rates. Corpus drift may require requalification even without a model change. Universal numerical thresholds cannot replace process-specific acceptance criteria.

Identity OCR: an extraction scope

The Identity OCR Lab documents detection, correction, French/Arabic OCR and extraction, with an operator console and on-premise architecture described by internal sources. The public service presents Moroccan identity cards, vehicle registration certificates, driving licences and passports. Its documentation describes CPU capabilities; this note does not turn them into guaranteed performance.

The Lab claims no biometrics, liveness, fraud detection or KYC decisions. It is a starting point for evaluating a document processing component. Business integration must qualify the corpus, specify validation and identify who authorises the next step.

From extracted fields to a controllable decision

The final contract must distinguish what was read, corrected, verified and decided. It should make the source, rule, version and human intervention retrievable. Decisions remain tied to a business policy and an identified owner.

Document Intelligence creates value through that continuity: preparing usable data, preserving uncertainty and exposing controls. This chain gives IT and operations a basis for release decisions beyond an attractive demonstration.