Shufti

Document checks, facial biometrics, chip reads and liveness detection run through one AI engine built in house, and without it the verification product has nothing left to decide. Sanctions and watchlist screening and video calls with know your customer experts would remain, but they sit beside the core rather than carrying it.

A client chooses between four published verification modes. Rapid is fully automated AI verification in 10 to 15 seconds, and Shufti warns that accuracy may suffer for the speed. Smart Hybrid sends steps where AI confidence is low to Shufti's human experts and answers within 60 seconds, Rapid Plus adds a human review of every AI result within 24 hours, and Live Guard has human experts run the whole check in one to three minutes.

The confidence threshold that triggers review is not given in figures. Journeys are set per market in a journey builder and escalate to stronger checks when a rule or jurisdiction requires it, and a compliance officer can pull the full evidence package for any user, with AI confidence scores and liveness results, in under 30 seconds.

Error rates for face matching and document checks, and validation mapped to a supervisory framework, are not published. Passive liveness passed ISO/IEC 30107-3 presentation attack testing at Level 3 with iBeta in May 2026, with 0 percent attack acceptance and 0 percent bona fide rejection in that test, and every verification carries AI confidence scores in its evidence package.

Misterb&b halved chargebacks and lifted verification pass rates from 77 to 88 percent, and BigCash puts fraud mitigation at up to 95 percent across more than 50 countries. Among financial customers, ACU Credit Union in Curaçao reports an 86.9 percent verification approval rate on fully digital member onboarding built with Axioma, and QQ Pay, a cross border remittance provider, cut manual reviews by about half with verification and screening on one platform. Macropay is named without figures.

Shufti does not say whether one client's verification data trains the models every client uses, or whether a client can opt out. What it does publish is a deletion schedule for biometric data and retention a client can configure.

Shufti acts as data processor under Article 28 of the General Data Protection Regulation, processes biometric data under a documented legal basis with deletion on schedule, and holds QG-GDPR certification, awarded after a UK accreditation body audited its data protection processes. Retention is configurable per client, and the privacy policy reaches people verified on a client's behalf, including Washington's treatment of face templates as consumer health data.

A public trust center lists SOC 2 Type II, ISO 27001:2022, UK Cyber Essentials and a penetration test among its documents, each released on request rather than downloaded. Listed with their assessors are SOC 2 Type II covering twelve months of controls, a Payment Card Industry Data Security Standard assessment by a qualified security assessor across all twelve control domains with its attestation available to a customer's auditor, ISO 27001 and both tiers of the UK Cyber Essentials scheme.

Shufti positions itself as a technology supplier to regulated firms and maps its product to the EU anti money laundering directives, the coming anti money laundering regulation and eIDAS 2.0, with native eID authentication for high assurance markets. Its own credentials are third party certifications rather than a supervisory license or register entry.

Face matching and liveness decide who gets through onboarding, and Shufti publishes nothing on how either performs across skin tone, age or gender. Its liveness testing measures resistance to attacks, a different question from demographic fairness.

Shufti offers no guarantee or indemnity for a wrong verification. It does publish a falsifiable figure for the case a refused customer cares about most: 0 percent bona fide rejection in iBeta's Level 3 liveness test, with the method named.

The data sources behind screening and database checks go unnamed. Shufti describes its verification technology as built in house, which keeps outside model providers out of the chain where face and document decisions are made.

Shufti names no core banking or origination system, though at ACU Credit Union the digital banking provider Axioma embedded its verification in member onboarding. One application programming interface (API) and documented software development kits for web and mobile carry identity, business verification, screening and monitoring, with an embeddable frame for quick journeys and verification tools offered to AI assistants through a Model Context Protocol server.

Cloud, hybrid, private cloud and on premises deployment are all offered. Biometric liveness, document verification and face matching can run inside a bank's own infrastructure, installed by Shufti's engineers, while screening runs in regional clouds in the EU, UK, US, Asia Pacific and the Middle East with configurable retention.

Pricing is per verification, not per user or seat. A free tier covers up to 10 verifications a month, the Essentials plan is pay as you go at $1.50 a verification with no minimum commitment, and Enterprise terms are agreed on volume, coverage and compliance needs.

Banks get their own maintained material covering the whole customer lifecycle, from sign up and account opening to transfers and closure, and fintech, crypto asset service providers, crowdfunding, gaming, travel and marketplaces carry pages of their own. Verification reaches more than 240 countries and territories in more than 150 languages.