Sumsub
Identity verification and KYC/AML compliance platform.
About Sumsub
Sumsub runs identity document verification, liveness checks, and AML watchlist screening against a single API-based workflow. In practice, a fintech or crypto exchange plugs it into their onboarding flow and Sumsub checks passports, national IDs, and selfies against sanctions lists, PEP databases, and adverse media in real time. Ongoing monitoring then flags existing customers when their risk profile changes—a named individual appears on a new sanctions list, for example. Most accounting practices will encounter Sumsub as a vendor their clients use, not as software they implement themselves. It fits regulated financial services firms—banks, neo-banks, crypto platforms, FX brokers, and payment processors—that need to meet FCA, FinCEN, or MiCA onboarding requirements at scale. A 50-person CPA firm doing standard client due diligence does not need this. The platform's depth is also its main drawback for smaller or peripheral users. Configuration is technical—expect developer time to integrate via API and map your compliance workflows before any analyst sees a dashboard. The integration ecosystem is narrow: Salesforce is the headline CRM connection, otherwise you're working through webhooks and custom builds. No free evaluation tier means you're committing budget before validating fit.
Best for
Financial services companies needing automated KYC/AML compliance and identity verification
Key Features
- Automated KYC document verification
- Real-time AML screening and monitoring
- Biometric identity verification
- Regulatory compliance reporting
Pros & Cons
Pros
- Checks government-issued IDs from 220-plus countries against a single verification queue, reducing manual document review in high-volume onboarding
- Real-time AML screening covers OFAC, EU, and UN sanctions lists, PEP databases, and adverse media simultaneously rather than requiring separate vendor checks
- Biometric liveness detection catches spoofing attempts that static photo checks miss, which directly satisfies FCA and FinCEN anti-fraud requirements
- Ongoing monitoring automatically re-screens existing customers when watchlists update, removing the need to schedule periodic manual reviews
- Compliance reporting exports audit-ready verification records, which simplifies evidence packages for regulatory examinations
- Configurable risk scoring lets compliance teams set thresholds by jurisdiction or product line rather than applying a single global rule
- Webhook-based event triggers push real-time status updates into downstream systems without polling, keeping onboarding pipelines moving
Cons
- No free tier and no self-serve trial—pricing is quote-only based on verification volume, which makes budget comparison against competitors like Onfido or Veriff difficult before contract
- Integration outside Salesforce requires custom API and webhook development; non-technical compliance teams cannot deploy this without engineering support
- Volume-based pricing means costs scale sharply during customer acquisition surges, with no published cap or flat-rate option visible in public materials
- Smaller user community than Onfido or Jumio means fewer third-party implementation guides and slower community-sourced troubleshooting
- Overkill for standard CDD at accounting or advisory firms—the biometric and ongoing monitoring layers serve no practical purpose outside regulated financial services
- Dashboard configuration for multi-jurisdiction rule sets has a steep learning curve; compliance analysts typically need several weeks before the workflow runs without IT support
Ledger Brief Take
This is purpose-built compliance infrastructure for financial services, not an accounting tool per se—most practices will encounter it when clients use it for customer onboarding rather than implementing it themselves. The biometric verification and ongoing monitoring capabilities go well beyond basic KYC checks, making it overkill for typical CPA firm compliance needs but essential for clients in banking, fintech, or crypto.
Frequently Asked Questions
Common questions accountants ask about Sumsub.
How does Sumsub pricing work?
Sumsub does not publish a price list. Contracts are quote-based and tied to monthly verification volume. There is no free tier and no self-serve trial. Expect to negotiate directly with their sales team, and get per-check pricing in writing—costs can escalate quickly during onboarding campaigns.
Does Sumsub integrate with QuickBooks or Xero?
No. Sumsub has no native integration with QuickBooks, Xero, or any accounting software. Its published integrations are Salesforce and custom connections via REST API and webhooks. It is compliance infrastructure, not a bookkeeping or practice management tool.
How does Sumsub compare to Onfido and Jumio?
All three cover document verification and biometric checks. Onfido and Jumio have larger partner ecosystems and more third-party implementation support. Sumsub competes on AML monitoring depth and jurisdictional coverage. For crypto or fintech clients facing MiCA or Travel Rule requirements, Sumsub's ongoing monitoring is more purpose-built than Onfido's standard offering.
Is Sumsub relevant for a CPA or accounting firm?
Rarely as a direct implementation. Most practices encounter it when advising fintech, banking, or crypto clients on their compliance stack. If your firm performs AML compliance reviews for financial services clients, knowing how Sumsub works helps you audit their KYC processes. Running it yourself for client due diligence is unnecessary.
How does Sumsub handle data security and GDPR?
Sumsub is ISO 27001 certified and GDPR-compliant, with data residency options for EU-based storage. Biometric data is processed under explicit consent flows built into the SDK. For client work involving EU data subjects, confirm the data processing agreement terms before contract—standard DPA is available but regional storage costs extra.
What does ongoing AML monitoring actually do after onboarding?
After initial verification, Sumsub continues screening each customer against updated sanctions lists, PEP databases, and adverse media sources. When a match or change occurs, it fires an alert and can trigger a re-verification workflow automatically. This removes the compliance team's obligation to run scheduled batch rescreens manually.