KYC on Makan, and why the whole marketplace is being built around it

Every Makan agent and every registered account can go through KYC (Know Your Customer) — the same identity check a bank would run before opening an account, except we make it take under two minutes.

Personal identity — powered by Didit

When an agent or a serious buyer opens their profile settings and hits Verify identity, we hand the flow to Didit, a licensed identity-verification provider. The user takes a picture of their Omani Civil ID (passport, GCC ID, and driving licence also work), does a short liveness selfie, and the check runs against the document's machine-readable zone in real time. Face-match, liveness, document authenticity, and IP/device analysis all have to pass. There's no cost to the user; there's no follow-up form.

When Didit returns an approved decision, our system immediately stamps the account as verified. From that moment onwards a small blue KYCchip appears on the agent's public card, next to their listings, and beside any inquiry they send. Buyers see it as they browse.

Didit is the identity-verification layer running the agent-side check on Makan today.

Company identity — reviewed manually, for now

For agencies, developers, and service providers, we ask for the company's Commercial Registration (CR) number, expiry date, and a copy of the CR document. Our admin team reviews them and stamps the profile as verified against the Ministry of Commerce's records. It's manual, but it's traceable — every verified agency has a CR reference the buyer can cross-check.

Oman's Ministry of Transport, Communications and IT (MTCIT) launched Theqa, the national digital-identity programme. Theqa lets any resident authenticate themselves with a scan of a QR code — no document upload, no waiting. It's anchored to the Civil ID via NFC and face verification, and the assertion carries legal signature weight.

We've started the onboarding conversation with MTCIT to become a Theqa Relying Party. When it lands:

• Every user with the Theqa app can verify their identity by scanning one QR code on Makan — no document uploads at all
• Agency CR verification stops being manual — the government API confirms the registration on our behalf
• Digital-signature support means an agent's offer or a buyer's intent-to-purchase can be signed with the same legal weight as a paper contract

Didit stays. When Theqa activates, users get the choice of provider; agents who prefer to keep their Didit-verified state can. We'll never remove a verification path — we add.

Anyone who has rented in Muscat has heard the story: a listing appears at a suspiciously good rent, the "landlord" asks for a deposit to secure the unit before a viewing, the money goes to a personal bank account, and the listing vanishes. The Royal Oman Police (ROP) issues public warnings about this pattern periodically, especially around university intake and Ramadan turnovers when demand spikes.

The reason it works isn't sophistication — most fake listings reuse photos scraped from other platforms and can be spotted with a reverse-image search. It works because there's no identityattached to the listing. On most sites, anyone with an email address can post a "house for rent" without ever proving who they are. Once the money is sent, the victim has no counterparty to take legal action against — the bank account belongs to someone else and the number, email, and photos all lead back to nothing.

KYC directly kills this. When identity is anchored to the listing, a scam attempt puts a real person's Civil ID on a paper trail before a single Rial changes hands. It doesn't make fraud impossible — nothing does — but it moves it from "essentially free to try" to "traceable to a real identity." That's the gap.

The verification flow is voluntary right now because we're still growing the base of listings — a hard gate on day one would keep the platform empty. But the trajectory is clear:

The word for the emerging field is RWA tokenisation — Real-World Assets recorded on a blockchain in a way that makes them fractional, transferable, and cheap to settle. Instead of buying a whole villa, an investor buys a 1% share of it as a token; instead of five buyers pooling into a paper trust with a lawyer taking a slice, the ownership is recorded on-chain and the rent distributes automatically.

Every serious RWA framework — Dubai's VARA regime, Singapore's Project Guardian, Switzerland's DLT Act — is built on top of one requirement: every counterparty is KYC-verified before they can hold or trade the token. Without KYC, tokenised real estate can't comply with anti-money-laundering rules and can't be listed on any regulated exchange. With KYC, the same rails that let a Muscat resident buy a share of an Al Mouj apartment let a Dubai-based investor do the same.

Makan is being built for that world. Every KYC-verified user we onboard today is a counterparty who could hold a tokenised share tomorrow. Every CR-verified agency we onboard is a trust anchor that could issue one. Our goal is to be the first platform to bring RWA tokenisation of property to Oman — and the KYC layer you see running now, quietly under the profile page, is the foundation for it.