How to choose a KYC provider: 10 questions to ask
Ten questions to put to any KYC provider, from liveness testing and sanctions screening to biometric privacy laws, security evidence, pricing and review tools.
Know Your Customer (KYC) checks confirm that a customer is who they say they are. To choose between KYC service providers, ask each one the same ten questions — about which checks are included, how liveness detection was tested, U.S. ID support, sanctions screening, business verification, biometric data retention, security evidence, vendor-risk fit, pricing and the review workflow.
The questions below draw on U.S. sources: the National Institute of Standards and Technology (NIST), the Treasury Department’s Office of Foreign Assets Control (OFAC), the Financial Crimes Enforcement Network (FinCEN), the federal banking agencies and state biometric privacy laws. They work for any shortlist of KYC verification software.
Questions about the checks themselves
1. Which checks are included, and which cost extra?
NIST Special Publication (SP) 800-63A-4, finalized in July 2025, describes identity proofing in three steps: resolution (collecting evidence and details about the person), validation (confirming the evidence is authentic, accurate and valid) and verification (confirming the person presenting the evidence is the person it was issued to). Those three steps are a useful way to map any vendor’s coverage.
Ask: Does the base price include document authenticity checks, data read from the document, a selfie compared with the ID photo (face match), liveness detection and database checks? Which are add-ons? A good answer is a written list for each plan, with every check named, not a single “verification” line item.
2. How was liveness detection tested?
Liveness detection is a form of presentation attack detection (PAD): spotting a printed photo, a screen replay or a mask held up to the camera. The testing standard from the International Organization for Standardization and International Electrotechnical Commission, ISO/IEC 30107-3:2023, sets methods for assessing PAD and reporting results for attacks “at the biometric capture device during presentation.” NIST SP 800-63A-4 says that a credential service provider collecting and comparing biometrics remotely shall use PAD that meets an impostor attack presentation accept rate below 0.07, tested in conformance with ISO/IEC 30107-3:2023. The guideline separately addresses injection attacks, where forged video is fed in between the camera and the server.
Ask: Was liveness tested by an independent lab against ISO/IEC 30107-3? Which version and attack types, and when? Can you read the report? How does the vendor handle injected video? A good answer names the lab, the date and the scope — or says plainly that no third-party test has been done and explains how the vendor tests instead.
3. Which U.S. IDs does it support, and does it read the barcode?
The American Association of Motor Vehicle Administrators (AAMVA) publishes a Driver License/Identification (DL/ID) Card Design Standard, and its 2025 version was updated to “ensure consistency in sharing Human and Machine-Readable data.” NIST’s guideline says that when a barcode is present, automated document checks shall compare its data with the printed data, and that documents shall be captured live to confirm they are physically present.
Ask: Which documents are supported — driver’s licenses and ID cards from every state, U.S. passports, others? Does the system read the barcode on the back of a license and compare it with the front? Does it capture the document live, or accept uploaded files? A good answer is a published list of supported documents and a clear yes on barcode cross-checks.
Questions about sanctions and business customers
4. Is sanctions screening included, and how are possible matches handled?
OFAC says “All U.S. persons must comply with OFAC sanctions.” In A Framework for OFAC Compliance Commitments, published May 2, 2019, OFAC describes compliance failures that include not updating screening software for changes to the Specially Designated Nationals (SDN) List and not accounting for alternative spellings of prohibited parties.
Ask: Which lists are screened, and how often are they refreshed? Does matching catch spelling variants? Is date of birth used to reduce false positives? Who reviews a possible match, and is the reason for clearing it recorded? Are customers re-screened when lists change? A good answer names the lists, gives a refresh schedule and shows you the review screen.
5. Can it verify a business and the people behind it?
Know Your Business (KYB) means verifying a business customer and the people who own or control it. For banks (FinCEN’s definition of “bank” includes credit unions) and other covered financial institutions, the Customer Due Diligence (CDD) rule at 31 CFR 1010.230 (Code of Federal Regulations) requires procedures to identify and verify the beneficial owners of legal entity customers: each individual who owns 25 percent or more, and one individual with significant control. A FinCEN order dated February 13, 2026 gives covered institutions optional relief from repeating this at every new account; it still applies when a legal entity customer first opens an account and in certain other cases.
Ask: Does the KYB product collect formation, tax and banking documents? Does it send an identity check to each owner and officer? Which facts are checked automatically against an outside source, and which are only collected for your reviewer? A good answer separates “verified against a source” from “collected for review.”
Questions about privacy, security and vendor risk
6. How long is biometric data kept, and how is consent collected?
Section 15 of Illinois’ Biometric Information Privacy Act (740 Illinois Compiled Statutes 14) requires a public written retention policy, destruction when the purpose is satisfied or within 3 years of the person’s last interaction (whichever comes first), and a written release before collection. Texas Business and Commerce Code § 503.001 requires notice and consent before capturing a biometric identifier for a commercial purpose and destruction no later than one year after the purpose expires, sets a civil penalty of up to $25,000 per violation, and, as amended effective January 1, 2026, excludes some artificial intelligence systems used to prevent fraud or identity theft. Washington’s biometric identifiers law bars enrolling a biometric identifier in a database for a commercial purpose “without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use” of it for that purpose. But it defines “commercial purpose” as selling or disclosing the identifier to a third party for unrelated marketing, excludes photographs and data generated from them, and doesn’t require notice and consent for collection “in furtherance of a security purpose,” which includes preventing fraud.
Ask: What is the default retention period for selfies, liveness video and ID images, and can you shorten it? What does the consent screen say, and is a record of consent kept? A good answer gives a number of days for each item and shows you the consent text. Definitions and exceptions differ by state, so confirm with counsel how each law applies to you.
7. What security evidence can you review?
A System and Organization Controls 2 (SOC 2) report is a certified public accountant’s (CPA’s) examination of a service organization’s controls relevant to security, availability, processing integrity, confidentiality or privacy, under standards set by the American Institute of CPAs (AICPA). It’s one kind of evidence: the federal banking agencies’ May 2024 guide for community banks lists SOC reports alongside independent assessments, industry certifications and audit reports as sources of due diligence information.
Ask: Is there a current SOC 2 report or other independent assessment, what does it cover, and can you read it under a nondisclosure agreement? If not, what documentation covers encryption, access controls, audit logs, incident response and subcontractors? A good answer is documents you can read, not a badge on a web page. You can see how we describe our own controls on our security page.
8. If you’re a bank or credit union, will it fit your third-party risk program?
On June 6, 2023, the Federal Reserve, the Federal Deposit Insurance Corporation (FDIC) and the Office of the Comptroller of the Currency (OCC) issued final Interagency Guidance on Third-Party Relationships, covering planning, due diligence and selection, contract negotiation, ongoing monitoring and termination. Their May 2024 guide for community banks asks, among other things, whether a third party relies on subcontractors and can show it complies with anti-money laundering (AML) rules. Credit unions can also look to the National Credit Union Administration’s (NCUA’s) Letter 07-CU-13, Evaluating Third Party Relationships, which NCUA lists as active.
Ask: Will the vendor provide a due diligence package, list its subcontractors, agree to contract terms on data access and audits, and support an orderly exit, including returning or deleting your data? A good answer is yes to each, in writing, before you sign.
Questions about cost and daily use
9. How does pricing work at your volume?
Ask: Is pricing published? Is there a minimum commitment? What counts as a billable verification — every attempt, or only completed ones? Are sanctions screening, re-screening and KYB included or extra? At your limit, are you charged overage, or do new verifications pause until you upgrade? A good answer lets you price a typical month and a busy month before you talk to sales. Our own pricing page, for example, publishes prices for the Starter, Growth and Business plans, and new verifications pause at the limit instead of incurring overage charges.
10. How will you integrate it, and what will reviewers and auditors see?
Some KYC onboarding software works with no code: you send customers a secure link. Deeper integrations use an application programming interface (API) and webhooks, which notify your system when a result is ready. Our identity verification service supports both, with API access on Growth plans and up. Records matter too: for banks, the Customer Identification Program (CIP) rule at 31 CFR 1020.220 requires records describing the documents relied on, the methods and results of verification, and how any substantive discrepancy was resolved, kept for five years after the record is made.
Ask: Are webhooks signed? Do reviewers see images, scores and extracted data side by side, and can they approve, reject or request a retry with a reason recorded? Is every view, download and decision logged, and can you export a report for each verification? A good answer includes a live demo of the review screen and API documentation you can read before you sign.
How to compare KYC service providers side by side
There’s no single best KYC software for every business. The right KYC provider is the one whose written answers fit your risks, your volume and the rules that apply to you. A simple way to compare:
- Send all ten questions in writing to every vendor on your shortlist, and follow up on any partial answers.
- Run a trial with a few real, consenting users.
- Share the answers with your compliance team or counsel before you sign.
If you want to put these questions to a live product, start a 7-day free trial — 20 verifications, no card required.
Related guides
Sources: SP 800-63A-4, Digital Identity Guidelines: Identity Proofing and Enrollment (NIST, July 31, 2025); SP 800-63A-4 full text (NIST, July 2025); ISO/IEC 30107-3:2023, Biometric presentation attack detection — Part 3: Testing and reporting (ISO, January 2023); AAMVA DL/ID Card Design Standard (2025) (AAMVA, accessed October 16, 2026); Who must comply with OFAC sanctions? (U.S. Department of the Treasury, OFAC, accessed October 16, 2026); A Framework for OFAC Compliance Commitments (OFAC, May 2, 2019); Publication of “A Framework for OFAC Compliance Commitments” (OFAC, May 2, 2019); 31 CFR 1010.100, General definitions (eCFR, current as of October 14, 2026); 31 CFR 1010.230, Beneficial ownership requirements for legal entity customers (eCFR, current as of October 14, 2026); Exceptive Relief from Requirement to Identify and Verify Beneficial Owners at Each Account Opening (FIN-2026-R001) (FinCEN, February 13, 2026); Biometric Information Privacy Act, 740 ILCS 14/15 (Illinois General Assembly, accessed October 16, 2026); Business and Commerce Code § 503.001, Capture or Use of Biometric Identifier (Texas Legislature, as amended effective January 1, 2026); RCW 19.375, Biometric identifiers (Washington State Legislature, accessed October 16, 2026); System and Organization Controls: SOC Suite of Services (AICPA & CIMA, accessed October 16, 2026); Agencies issue final guidance on third-party risk management (Federal Reserve, FDIC and OCC, June 6, 2023); Third-Party Risk Management: A Guide for Community Banks (Federal Reserve, FDIC and OCC, May 2024); Letter 07-CU-13, Evaluating Third Party Relationships (NCUA, December 2007); 31 CFR 1020.220, Customer identification program requirements for banks (eCFR, current as of October 14, 2026). This article is general information, not legal or compliance advice.
