ICAO 9303

What is ICAO Doc 9303?

ICAO Doc 9303 is the international technical standard for Machine Readable Travel Documents (MRTDs) — including passports, identity cards, and visas. It is issued by the International Civil Aviation Organization (ICAO), a specialised agency of the United Nations.

The standard prescribes the physical layout and data structure of the document, the security features (holograms, UV inks, microprinting, intaglio printing), the Machine Readable Zone (MRZ) format and check-digit algorithm, and — for electronic MRTDs — the NFC chip data groups, cryptographic protocols, and biometric specifications covering face, fingerprint, and iris.

Doc 9303 is the reason a passport issued in Tokyo can be read and authenticated at a border crossing in Lima, an airline check-in desk in Frankfurt, or a bank's eKYC flow in Dubai. Without it, international travel and cross-border identity verification would be operationally impossible at scale.

The standard is now in its eighth edition (2021), published in multiple parts covering physical document layout, MRZ specifications, e-passport (eMRTD) requirements, visas, and machine-readable official travel documents.

Why ICAO 9303 matters

Doc 9303 is the global interoperability standard for travel documents and the foundation on which modern remote identity verification is built. The same workflow that works for one passport works for passports from 193 countries.

It serves different stakeholders in different ways:

• Border control — enables automated immigration gates that read MRZ and chip and complete a biometric match in seconds
• Airlines — powers automated check-in, document validation, and APIS reporting
• Financial institutions — underpins remote onboarding with consistent MRZ parsing, document forensics, and chip reading
• Governments — ensures interoperability between national identity systems and supports international cooperation against document fraud

Compliance with ICAO 9303 is effectively mandatory for any country wishing its passports to be accepted internationally — see our practitioner deep-dive on how facial biometrics work in digital identity for the holder-side match that pairs with the document side.

The Machine Readable Zone (MRZ)

The most operationally visible element of Doc 9303 is the Machine Readable Zone (MRZ) — the two or three lines of OCR-friendly text printed at the bottom of the passport data page (or back of the ID card) in a distinctive fixed-width typeface.

The MRZ encodes the document type and issuing country, the holder's name, the document number and nationality, the date of birth, sex, and expiry date, plus a series of check digits computed using a 7-3-1 weight cycle to detect transmission and parsing errors.

The MRZ is intentionally human-readable for cross-checking against the visual zone of the data page, but its primary purpose is to be machine-readable: a smartphone camera, scanner, or kiosk can capture and parse it in milliseconds.

MRZ formats

Doc 9303 specifies three MRZ formats for different document types:

Format	Layout	Used on
TD1	3 lines × 30 characters	ID cards
TD2	2 lines × 36 characters	Some ID cards and visas
TD3	2 lines × 44 characters	Passports

Modern document-verification systems parse all three formats automatically.

E-passports (eMRTDs) and the NFC chip

Since 2003, Doc 9303 has specified the electronic Machine Readable Travel Document (eMRTD) — better known as the e-passport — which embeds a contactless NFC chip beneath the data page.

The chip carries a structured set of data groups:

• DG1 — digital copy of the biographical data, mirroring the MRZ
• DG2 — digital facial image
• DG3 — fingerprints (optional)
• DG4 — iris (optional)

A Security Object Document (SOD) signed by the issuing state's signing certificate cryptographically guarantees the integrity of the data groups. The issuing state's certificate itself is published through the ICAO Public Key Directory (PKD), so any state or institution can verify the chip's signature without bilateral agreement.

Reading the chip during a verification flow lets the institution confirm three things. The document is genuine — the SOD signature verifies against the issuing state's PKD certificate. The data on the chip matches the MRZ and visual zone — any discrepancy indicates tampering. And the holder is the person pictured on the chip — via biometric match between DG2 and a live selfie with liveness detection.

Security features in ICAO 9303 documents

Beyond the chip, Doc 9303 specifies a layered set of physical security features designed to prevent forgery — holographic and kinegram elements visible at specific viewing angles, UV-fluorescent inks that appear only under ultraviolet light, microprinting that resists reproduction, intaglio (raised) printing with a tactile feel, anti-copy guilloche patterns, tamper-evident lamination, and a laser-engraved photograph bonded to the document substrate.

Modern document-verification flows combine chip authentication, MRZ parsing and check-digit validation, visual forensics, and liveness-confirmed biometric match to reach a comprehensive verdict on document and holder authenticity.

How ICAO 9303 is used in KYC and eKYC

For financial institutions, telecoms, and other regulated businesses operating remote onboarding, ICAO 9303 is the standard that makes passport verification at scale tractable. A modern eKYC platform runs a passport through the full sequence in seconds — capturing the image, parsing the MRZ, validating the check digits, reading the NFC chip via the customer's smartphone, verifying the SOD signature against the ICAO PKD, running document forensics on the visual zone, comparing the chip-stored facial image against a live selfie with liveness, and returning an approve/refer/reject decision.

The same workflow handles passports from virtually any issuing country — the standard does the harmonisation work that would otherwise require country-by-country integration. See our writeup on online passport verification for the practitioner walkthrough.

This is why ICAO 9303 is foundational to high-assurance eKYC and KYC for cross-border financial services. It gives the institution a single, internationally consistent, cryptographically anchored way to verify identity documents from anywhere in the world. Our writeup on how passport verification helps in identity verification covers the end-to-end onboarding context.

ICAO Public Key Directory (PKD)

The ICAO Public Key Directory is the global infrastructure that distributes the digital certificates needed to verify e-passport chip signatures.

The certificate chain works in three layers. Each issuing state generates a top-level Country Signing Certificate Authority (CSCA) certificate. The CSCA signs Document Signer (DS) certificates issued for batches of e-passports. And each e-passport's SOD is signed by the relevant DS certificate.

By publishing CSCA certificates to the ICAO PKD, an issuing state allows any other state, airline, or regulated institution to verify the authenticity of its passports without needing a bilateral exchange of certificates. Participation in the PKD is voluntary but widely adopted, and for any institution running global identity verification at scale, PKD participation is a key trust-anchor.

ICAO 9303 and other travel documents

Doc 9303 covers more than passports. It applies to e-passports (eMRTDs) — the largest and most common application — as well as Machine Readable Visas in the ICAO-standardised format, national identity cards with international travel use (e.g., Schengen-area ID cards), and other machine-readable official travel documents such as diplomatic and service passports, refugee documents, and certain emergency travel documents.

The standard's modular structure — separate parts for separate document types — allows it to evolve in step with changing issuing-state practice while preserving global interoperability.