The short answer: guest ID verification for a Malaysian homestay means checking, before check-in, that the person arriving is a real, named person with a document. Airbnb already verifies its own guests but never shows you the document. Agoda, Booking.com and direct guests need your own step, and only some of them need a full eKYC scan.
This is the second operator article this month about what happens between "booking confirmed" and "guest at the door". The first was about condo gate passes. This one is about the identity step that sits right before it, written from how we run it across a little over 100 units in Johor Bahru and Desaru, not from a feature list.
What does Airbnb already verify, and what do you actually see?
Airbnb says it requires booking guests to complete identity verification for all stays, and that a guest who does not finish within 12 hours of booking does not get the reservation confirmed (Airbnb help 450). Accepted documents include a passport, driving licence or national identity card. Airbnb said in 2023 that it expected 100% of guests booking homes globally to be verified by the end of June that year (Airbnb news).
What the host gets from that is a "verified" status, not the passport photo. Vendors who write about this point out the obvious gap: Airbnb's check covers Airbnb bookings only, and the details stay inside Airbnb (Chekin).
So the honest picture for an operator in Malaysia looks like this:
| Booking source | Platform checked the guest? | What you hold afterwards |
|---|---|---|
| Airbnb | Yes, by Airbnb | A verified badge and a name. No document |
| Agoda / Booking.com | Not in a way you can rely on | A name, often a platform relay email, sometimes a phone |
| Direct booking | No | Whatever your own checkout collected |
| Walk-in / extension by WhatsApp | No | Whatever the colleague typed in |
The second, third and fourth rows are where your own step matters. And even on the first row, if the building's guard house wants a document, Airbnb's badge does not help you at the barrier.
Who decides whether eKYC is compulsory: you or the building?
This is the part most articles skip, and the part we got wrong first.
In our system there are two switches, and either one makes eKYC compulsory for a listing:
- The building management's switch. This only exists on condos that run AntlerQR, our own visitor system sold to the management. If the management ticks "require eKYC and ID photo before entry", every guest of that property must do it. No operator setting can turn it off, because the guard house decides who its barrier lets through.
- The operator's own switch, in Setting > Operation. It can add the requirement. It can never lift the building's.
On a condo that uses a third-party guard app instead (the kind where our worker fills in the app's form and brings back a QR, as in the gate pass article), there is no management of ours in the loop and the app only asks for name, unit and plate. eKYC simply does not apply there.
Our mistake: the building switch used to default to ON at the database level. On 14 August 2026 we found that the rule had been reading that default on properties where nobody had ever made a decision. All 35 approved bindings at the time were third-party apps, and each one "required" eKYC only because the column said 1. We now only read the switch on AntlerQR properties, and since 19 October 2026 it defaults to OFF. A default nobody chose is not a decision.
eKYC, Singpass/MyDigital ID or a typed-in IC: which one do you need?
There are three ways a guest can prove who they are in our guest portal, and they are not interchangeable:
| Method | What it checks | What it gives you | When we use it |
|---|---|---|---|
| eKYC scan (document photo + selfie, Alibaba Cloud ID Verification) | Document is real and the face matches | Name, ID number, document images | When the building or operator requires it |
| Singpass or MyDigital ID login | The government account is real | Verified name and ID. No photograph | Fast route for Singaporeans and Malaysians |
| Typed-in form (name, IC or passport, phone with country code, document photos) | Nothing automatically | What the guest typed and uploaded | When eKYC is not required |
Two rules came out of real cases:
- Verify first, then type. When eKYC is required, the typed-in form is withheld until the guest has verified, because a typed IC number is not something an AntlerQR barrier accepts. After verifying, the form is open again, because Singpass hands back no photo and a scan can miss a field the operator needs.
- If eKYC is required, the document is required too. A property that verifies but keeps nothing has verified into thin air.
Individuals only: the form accepts Malaysian, Singaporean and foreign individuals. A company cannot be "the guest".
What does one eKYC scan cost, and who pays?
In our system a guest eKYC scan is charged to the operator in credits from the AntlerHub prepaid balance, but only in one case: the operator switched the requirement on. A guest who verifies on their own, or because the building demands it, costs the operator nothing on our side (on AntlerQR the management pays on its own account). Only a successful scan is charged. A failed attempt is free, and a retried result is never charged twice.
We are not printing a per-scan number here, because the AntlerHub pricing page does not list one today. What the page does list: each active unit uses 10 credits a month, a credit costs RM 1.50 up to 100 units, RM 1.00 from 100 units and RM 0.80 from 500 units, and new accounts get 50 credits. Ask us for the current eKYC rate in writing before you switch it on.
The trade-off you should know about: when the operator's credit reaches zero, the operator's own eKYC requirement is skipped and the guest checks in without the scan. We chose that over stranding arriving guests at a screen they cannot pass. The building's requirement is never skipped this way. If identity checks matter to you, watch the balance.
Does verifying a guest let you skip the deposit?
It can, and only if you set it up. Our deposit rules include a "trusted guest" rule. A guest skips the deposit only when all of these are true: the portal account's email matches the booking, the identity was verified by Singpass/MyDigital ID or eKYC (a typed-in IC does not count), and the guest has enough reviews from earlier stays. The default thresholds are at least 10 reviews averaging 8 out of 10, and the operator can change them or limit the rule to some units. Everyone else pays the deposit as normal (RM200 by default, see the check-in guide).
Most first-time guests will never reach that bar. That is intended.
What should you keep, and for how long?
Once you hold IC and passport images, you are holding personal data under Malaysia's Personal Data Protection Act. The 2024 amendments came into force in phases during 2025; the data protection officer and breach notification duties took effect on 1 June 2025 (Baker McKenzie, DFDL). We are not lawyers and this is not legal advice; ask yours how long you need to keep guest documents and who in your team should see them.
Practical rules we follow:
- Collect the document once, against the guest's own account, not as a photo forwarded in a WhatsApp group.
- Never create an account on a platform relay email (Agoda, Expedia, Trip.com style addresses). Every guest of that platform shares it, and a password sent there goes to the platform. The guest gives their own email or the colleague asks them for it.
- One identity, one account. If the same IC is already bound to another account, the system refuses rather than quietly creating a second person.
What still goes wrong?
Honestly, these:
- The two surfaces disagreed. In August 2026 AntlerChat told a guest "eKYC required, no typed IC" while the website portal offered the typed form for the same booking. Whichever screen the guest used decided whether they reached the barrier with acceptable ID. Both now read one function.
- A silent write. A guest finished eKYC in August and the booking still had no email, because one save demanded all three fields at once and failed quietly. Partial updates are now accepted.
- Lookup failures open, not closed. If the database hiccups, the rule answers "not required" and logs it. We would rather one guest do a manual ID a colleague checks than block every check-in in progress. If you need strict, ask the building to use the guard-house check as well.
- Typed IDs are not proof. A typed form is a record, not a verification.
Is a separate verification step worth it for a small host?
If you run two or three units, mostly on Airbnb, in a condo whose guard app only wants a name and plate, probably not. Airbnb's check plus a deposit covers most of it. It starts to matter when you take Agoda, Booking and direct guests, when a building demands verified ID at the gate, or when you have had a problem guest and want to know who actually stayed. The identity step then feeds the door code and gate pass that follow it.
If that is where you are, see how AntlerHub runs check-in, or compare the pricing first.