Sumsub
Sumsub sells identity verification and financial crime compliance software to fintechs, banks, crypto platforms and gaming operators. One platform covers individual and business onboarding, sanctions and politically exposed person screening, transaction monitoring, Travel Rule messaging and fraud prevention. Document, liveness, face match and deepfake checks run across more than 220 countries and territories and over 14,000 ID types, and a no code workflow builder turns a compliance policy into verification flows. More than 4,000 companies use it, and Sumsub publishes per verification prices starting at $1.35. Founded in 2015, it is based in London, with offices in Singapore, Dubai and Miami among others.
Capability Axes
Capability grades
15 of 15 axes rated · 13 graded A or B
Models handle the checks that need judgment, among them liveness and deepfake detection, document reading across scripts and device intelligence, and Summy is an AI copilot for analysts. Screening, database validation and Travel Rule messaging are deterministic, and that compliance platform would still work without the models. Newer modules extend AI into the workflow, from a builder that drafts flows for a person to approve to a Know Your Agent module that checks AI agents connecting through MCP.
Policy becomes verification logic in a no code workflow builder, and risk based flows pass low risk users while sending flagged ones through extra steps. Workflows drafted by AI do not go live until a person approves them. Summy, the AI copilot, suggests while the human reviewer keeps the final judgment, and decision trails are kept for regulator inquiries.
The liveness checks carry accredited testing. iBeta Level 1, 2 and 3 presentation attack reports are viewable in the trust center, and the Level 3 test in October 2026 recorded no successful attacks across 900 attempts on Android and iOS. No false rejection rate is published alongside it. A monthly public changelog tracks product changes, while model documentation, validation summaries and drift monitoring are not published.
Named customers report figures, though none carries a period. Paysend reports a 95% pass rate, a median verification time of 8.7 seconds and 20% fewer fraud cases, and Yolo Group reports pass rates up 142%. More than 4,000 companies use the platform, and Sumsub says it verifies over 2 million people a day. Forrester studies Sumsub commissioned put the return at 240% for the verification platform and 272% over three years for transaction monitoring, each with payback inside six months. Analyst recognition includes Gartner and Forrester leader positions in 2025 and KuppingerCole's overall leader rating in September 2026.
The training question is answered in the service delivery notice. Sumsub may use personal data to train, test and improve its technologies when its clients permit it, and verified people can object. Fraud patterns are analyzed across sessions, services and clients, so one client's signals do inform detection for others. Azure OpenAI data is stored in Sweden, with inference possible in any region. What is missing is the retention term model providers work under and how long pseudonymized calibration data is kept.
The service delivery privacy notice, updated in March 2026, addresses the people Sumsub verifies for its clients. Data is kept no longer than the client contract and deleted within 30 days of a request, and biometrics carry their own limits, three years at most for Illinois residents. A public list dated November 2026 names about 40 third party processors and nine Sumsub affiliates. Pseudonymized data is kept to calibrate fraud models for a period the notice does not state, and nothing addresses safeguards obligations for a United States bank buyer.
Certificates can be opened without asking, for ISO 27001, 27017, 27018 and 22301 among others, along with ISO/IEC 29115 and 29003 for identity assurance, ETSI conformity for eIDAS work and the PCI DSS attestation. iBeta Level 1, 2 and 3 presentation attack reports are also viewable. A SOC 2 Type 2 report, a SOC 1 Type 1 report and penetration test results come through a request form, and the SOC 2 period is not shown.
Company and data protection registration numbers are printed on the site, and the product reaches formally specified regimes, from Travel Rule protocols to goAML format reports for financial intelligence units. Qualified electronic signatures under eIDAS are issued by a trust service provider Sumsub does not name, with Sumsub doing the identity proofing, and ETSI conformity certificates for that work sit in the trust center. Its only stated regulated status is registration as an electronic system operator in Indonesia. As a supplier, it holds no financial license.
Face matching and liveness decide who gets an account, and those checks are known to perform differently across skin tone, age and gender. Sumsub publishes presentation attack results and customer pass rates, but no accuracy by demographic group, no bias testing method and no independent fairness evaluation of its own checks.
An institution can reconstruct and reverse a verification outcome through case management, and verified people can object to processing or ask for deletion under the service delivery notice. A rejected applicant is not told which system judged them or given a route to revisit the decision, and no accuracy guarantee or indemnity is published.
A public list of third party processors names the model providers and hosts. OpenAI, Amazon Bedrock and Azure OpenAI supply AI models, and AWS, Google Cloud, Huawei Cloud and Cloudflare carry hosting and delivery. Screening data can come from ComplyAdvantage, LSEG World Check One or Quantifind under the customer's own contract, so an institution controls which list underpins a screening decision.
Delivery runs through a REST API with SDKs for web, mobile, React Native and Flutter, hosted no code flows and public documentation with a status page. Bring your own key connections let customers keep existing screening contracts with ComplyAdvantage, LSEG World Check One or Quantifind. An MCP server lets AI agents work with the platform, and a HubSpot integration arrived in October 2026.
Personal data is stored and processed on dedicated servers in Germany, on AWS by default, in European data centers rated Tier 3 or better. Google Cloud is used where AWS is not available, and Huawei Cloud holds data in Turkey on request. Where a law requires local storage Sumsub offers the region, with Bahrain as its example, and clients may choose where processing happens. The platform runs as a hosted service.
Per verification rates are published: Basic at $1.35 with a $149 monthly minimum, and Compliance at $1.85 with a $299 minimum adding money laundering screening and monitoring. Only successful verifications are charged, a 14 day trial includes 50 free checks, and business verification and transaction monitoring sit in a quoted custom plan.
Coverage reaches more than 220 countries and territories and over 14,000 ID types, and its SDKs support 56 languages. Jurisdiction pages carry local regulatory context for 29 markets. Separate material serves financial services, banks, crypto, payments and gaming. Its government page describes policy work with regulators rather than a product.
Product updates
Material product, regulatory, evidence and commercial changes at Sumsub, each verified against a live source and tagged to the capability axis it bears on. Funding rounds and awards are not product changes and are not logged.
Sumsub launched a KYA Module for MCP, a filtering layer between a business's AI agents and the data sources they connect to. It screens each agent request, strips personal and other sensitive data before it reaches the agent, keeps an agent activity log, and can require a live human verification when an agent attempts a flagged action. It works first with Amazon Bedrock AgentCore Gateway.
Sumsub launched Workforce Verification, which brings document checks, biometric liveness and background screening into enterprise identity and HR platforms. It triggers checks at high risk moments across the employee lifecycle, from hiring to help desk account recovery, and works with tools such as Okta and Ashby.
Sumsub released a Brazil-localized onboarding solution for betting platforms that retrieves identity data and a document image from local databases through local partnerships, so a player supplies a CPF number and a selfie liveness check rather than photographing a document. Sumsub states the retrieved IDs and biometric evidence are retained in the dashboard for audit purposes and that retrieval requires explicit user consent under the LGPD.
Compared With
Most editorial comparisons pair two vendors the index assesses as direct competitors for the same buyer. Some pair vendors that are adjacent rather than rival, where the useful question is where one ends and the other begins. Each carries a verdict, the buyer conditions that favor each vendor, and a graded side by side.
Alternatives to Sumsub
Vendors in the same categories as Sumsub whose profiles look most alike, each with a line on what the product does. Similar is not the same: check that each one does the job you need. No vendor pays for placement.
iDenfy is a Lithuanian regulatory technology company providing identity verification, business verification, anti money laundering screening and monitoring, transaction monitoring and fraud…
Alloy is an identity risk orchestration and decisioning platform for banks, credit unions and fintechs.
Fenergo sells client lifecycle management software to banks, asset managers, fund administrators and other regulated institutions: onboarding, know your customer (KYC) and anti money…
Signzy sells digital onboarding, identity verification and compliance automation to banks, non bank lenders, payment providers and global enterprises.
Know Your Customer sells know your business (KYB) and know your customer (KYC) software to banks, payment firms, corporate service providers and other regulated businesses that onboard companies.
Complead, known until September 2026 as Sanction Scanner, sells an AML, KYC and fraud platform to banks, payment and electronic money firms, fintechs, insurers, crypto businesses and gaming operators.
The index publishes no overall score or ranking. See what we assess and the methodology.
Pricing
Vendor-published figures are labeled as such. Figures labeled “Estimated” are derived from third-party sources and have not been confirmed by the vendor.
| Entry Price | Pricing Basis | Data Protection Terms | Implementation | Source |
|---|---|---|---|---|
|
From $1.35 per verification on the Basic plan, with a $149 monthly minimum. Compliance is $1.85 per verification with a $299 monthly minimum. Custom plans are quoted.
|
Charged per successful verification against a monthly minimum commitment. Basic, at $1.35 per verification and a $149 monthly minimum, covers identity verification, liveness and face match, Sumsub ID, reusable identity checks, email and phone verification and Travel Rule. Compliance, at $1.85 per verification and a $299 monthly minimum, adds anti money laundering screening, ongoing monitoring and address verification. Non document verification, database validation, business verification, transaction monitoring and fraud prevention are in a quoted custom plan. Plans can be changed at any time and are payable by card. | Not tiered on the pricing page. | No implementation fee is published. A 14 day free trial includes 50 free checks. | Vendor Published |
Rates apply to successful verifications only, and a feature included in a bundle is charged at full cost even when it goes unused. Volume discounts sit in the custom plan.