Whatever process is/will be used, Mondo should try to avoid keeping government identity documents. Once they have been used for KYC purposes, a record should be kept that the comparison was done and the outcome, and then delete the document files. They are too valuable and when/if lost/stolen/copied, the event is a significant problem for the person. Build this into data retention/deletion policy and processes.
Minimise the number of staff/others who have access to the identity documents, and log/monitor access while they are processed.