Pakistan CNIC verification API: 13-digit structure, province codes and NADRA record checks

Field layout of the 13-digit CNIC

Province and region codes

• 1 Khyber Pakhtunkhwa
• 2 Former FATA (now part of Khyber Pakhtunkhwa)
• 3 Punjab
• 4 Sindh
• 5 Balochistan
• 6 Islamabad Capital Territory
• 7 Gilgit-Baltistan
• 8 Azad Jammu and Kashmir

Overseas Pakistanis hold a NICOP, which uses the same number format as the CNIC.

Response contents of a Pakistan CNIC verification API

A parse result tells you whether a number is well formed. A verification response tells you whether the person in front of the camera owns it. deepidv runs one session: document capture with OCR and the AI document fraud check, face liveness with a 1:1 match to the document photo, the NADRA record check, PEP and sanctions screening, and an optional 1:N match that flags the same face behind a second account.

• One decision per session, with an outcome for every step, delivered by webhook (session.status.verified, session.status.rejected, session.status.failed).
• Fields as printed on the document, with a normalized Latin form in its own field where the document uses another script.
• A reason for every non-pass outcome, separating malformed input, a record that was not found, a mismatch between document and record, and a registry that did not answer.
• A signed verification receipt with a UTC timestamp per step, anchored on Base L2 with zero personal data on chain, checkable at proof.deepidv.com.

Urdu OCR on the CNIC

The Smart National Identity Card prints the name, father's or husband's name and address in Urdu and English. A recogniser trained only on Latin script misses the Urdu fields and cannot compare them. deepidv reads both, returns the Urdu as captured with a transliteration in its own field, and flags a mismatch between the two.

NADRA record checks

NADRA's Verisys service returns the record held against a CNIC: name, father's or husband's name, date of birth and photo. Biometric verification by fingerprint is required in several flows, including SIM issuance. deepidv compares the record with the captured card and the live face in the same step.

Liveness, biometrics and SBP rules

The State Bank of Pakistan's AML/CFT/CPF Regulations require customer due diligence, NADRA verification of the CNIC and ongoing monitoring, with suspicious transactions reported to the FMU through goAML. For remote account opening, the SBP's Customers' Digital Onboarding Framework sets the parameters for digital channels, including the Asaan Digital Account, and allows instant activation once a biometric thumb impression is verified against NADRA. deepidv runs passive liveness, face match and PEP and sanctions screening, and Arbiter drafts the STR for review.

How deepidv runs Pakistan verification

deepidv is a verification engine and agentic compliance suite built from the ground up, without third-party verification APIs underneath. The engine is SOC 2, ISO 27001 and PCI DSS certified, and deepidv is a member of DIACC and the AVPA. Luna, the verification agent, builds and sends Pakistan verification workflows from the platform or from any LLM through MCP. Arbiter, the compliance agent, maps the workflow to the State Bank of Pakistan's AML/CFT/CPF Regulations requirements, monitors accounts after onboarding and drafts suspicious transaction reports for the FMU for your team to review.