-- Duplicate-customer detection by BVN/NIN without storing the number: a keyed HMAC
-- fingerprint (see lib/kyc-crypto.js). The unique index makes the database itself refuse a
-- second customer with the same BVN/NIN, even if two agents submit at the same moment.
ALTER TABLE customers
  ADD COLUMN kyc_hash CHAR(64) NULL AFTER kyc_encrypted,
  ADD UNIQUE KEY uq_customers_kyc_hash (kyc_hash);