GBG: identity verification, fraud intelligence and onboarding controls

GBG supplies the checks and workflows around customer onboarding. Its current crypto and FX offering combines identity data, document and biometric checks with fraud signals, allowing stronger proofing when a journey indicates greater risk. For a broker, the operating use is to collect and assess evidence about an applicant, route exceptions and retain the resulting verification record.[3]

In Go Investigation, authorised staff can review a session in detail or change decisions from the dashboard. The documented choices include acceptance, manual review and rejection, with an optional explanatory note. A decision cannot be changed while the journey is still processing. Review also depends on the session remaining within the organisation’s retention period: records already removed by that policy will not appear for an override.[14]

Go’s v2 migration guide says that access is limited to selected customers in certain regions and requires discussion with GBG before migration. The v2 delivery routes below therefore describe that release’s documented integration, rather than availability for every existing account.[7]

The quickstarts require an API client separate from the dashboard login and a published journey resource ID and version. Bearer credentials belong on the backend. In the API-first flow, outstanding fields drive collection and partial submissions can advance once all required elements are present. An accepted submission is one processing step; the application still needs the completed journey result before applying its business decision.[9]

Go’s commercial unit is the annual volume of journeys initiated, not simply applicants who pass. Modules, data sources, licence fees and professional work are set through the order and applicable schedules. Preview access is limited to agreed monthly volume and existing customer data; it is for non-production, non-commercial use. Excess Preview usage is chargeable under the order and unused allowance does not roll over.[19]

The optional professional-services schedule covers agreed configuration, Preview testing, assistance and training. Customer deliverables include branding assets, approvals and testing. Production use is deemed acceptance. Scope changes can alter charges and dates; customer-caused delay can leave scheduled milestone charges payable and generate additional reasonable costs. Support passes from the project or hypercare arrangement to the helpdesk unless continuing professional services are ordered.[21]

Moving from v1 to v2 requires new journeys built in the platform, the right API-client permissions and changes to endpoints, interactions and result parsing. The migration guide does not describe a direct conversion of an existing v1 journey. Its document-module compatibility statements are internally inconsistent, so module variants need explicit GBG confirmation for the proposed migration.[7]

Go’s role model separates viewing, creating, updating, publishing and accessing resources. A Customer Admin creates custom roles; available permissions also depend on the licence. This allows a journey designer to change a workflow without automatically gaining the right to publish it, and lets an investigator receive a different set of rights from an integration administrator.[11]

The July 2026 Go schedule targets 98.5% availability per calendar month, excluding planned or emergency maintenance and updates. It is a reasonable-endeavours target with third-party dependencies. Faults can be reported around the clock; ordinary enquiries follow regional Business Hours.[22]

The clock starts from GBG acknowledgement. Outside Business Hours, Target Times begin at the next Business Day’s opening. Unresolved P2–P4 faults pause outside Business Hours. Regional hours are EMEA 08:00–18:00 GMT/BST, Americas 08:30–20:00 ET/EST and Australia 09:00–17:00 AET/AEST. These are restoration targets.[22]

Temporary assistance access is separately controlled in Go v2. The customer can permit GBG access for seven days or until manually disabled, and can withdraw it earlier. Access and actions are audited. Removing the permission can limit the assistance GBG can provide, so it is an explicit support-access decision rather than a permanent default administrator account.[16]

GBG’s support-site disclosure says its services are not a consumer-reporting service under the US Fair Credit Reporting Act and must not be used for the listed credit, insurance or employment eligibility purposes.[27]

The EMEA/APAC contract separately restricts deployment as high-risk AI under Article 6 of the EU AI Act. That is a condition of permitted service use, not a determination that an individual customer’s proposed workflow falls within that legal classification.[20]

The grid lists UK, US and Australian locations for relevant Go components and identifies customer-selected regions for document verification and Investigation. Identity-data checks can also involve supplier locations and onward transfers. A regional application endpoint therefore does not by itself establish the location or legal role of every data source used in a journey.[24]

GBG’s trust centre makes assurance information available by business and product, including separate ExpectID and greenID SOC 2 entries and the group’s ISO 27001 programme. Detailed reports may require customer status and a confidentiality agreement. The centre’s individual listings should be matched to the contracted service; they are not interchangeable certification claims for every module in the group.[26]

GB Group plc is the UK public limited company registered under number 02415211, incorporated on 21 August 1989 and active on the Companies House record. Its registered office is in Chester.[1]

The order identifies the GBG contracting company, which can differ from the billing entity.[20]

The group acquired Loqate in 2015, IDology in 2019 and Acuant in 2021. Its US businesses were integrated under GBG IDology in 2023. GBG Go launched in 2025, while Loqate remains the location-intelligence part of the portfolio. The history records transfer to London’s Main Market on 30 October 2025 and FTSE 250 admission on 22 December 2025.[2]

Operator

GB Group plc and the GBG entity identified in the order

Service scope

Identity, document and biometric verification, fraud intelligence and configurable onboarding journeys.

Customer types

FX and crypto businesses; Financial institutions; Other organisations verifying customers

Delivery

Hosted; API

Pricing publication

Quote only

Headquarters

Chester, United Kingdom

Platforms

GBG Go; GBG IDology; Acuant; Loqate

Integrations

Go APIs; Hosted Go journeys; Core SDK; Bridge SDKs

Pricing scope

Order-based modules, journey volumes and professional services; regional invoice and minimum-commitment conditions apply.

Implementation

Configure checks and decision rules, test journeys, allocate API and staff permissions, then publish. Go v2 access is restricted to selected customers and regions.

Support

Go has a scoped standard support schedule with monthly availability and priority restoration targets; regional business-hour rules apply.

Permissions and regulatory scope

Identity and fraud technology. Data-processing roles vary by module and jurisdiction; the customer determines its onboarding decision and permitted use.

Provider metadata checked 20 Oct 2026Source 2Source 1Source 20Source 28Source 3Source 6Source 19Source 7Source 22Source 25

Investigation export is a permissioned feature that must also be enabled for the organisation. It exports filtered sessions as nested JSON Lines, not CSV, and retains the masking rules of the user’s role. Exports containing more than 20,000 sessions are split into multiple files. This gives operations and compliance teams a structured route into their own analysis or evidence systems without flattening document scans and individual checks.[12]

A user with deletion permission can remove a whole session or selected personal information, documents or biometrics while retaining the remaining session record. Deletion is irreversible and the audit log records what was removed and who acted. Retention and manual deletion therefore affect different parts of the record lifecycle; exporting evidence must occur while the required data is still available.[13]

The DPA’s processor clauses require return or destruction, at the controller’s choice, within 30 days after the DPA expires or terminates, subject to legal retention exceptions. A breach concerning the other party’s controller data must be reported without undue delay and no later than 72 hours after awareness. The stated subprocessor-objection window is 30 days after receipt of notice. These clauses apply within the DPA’s role allocation, rather than overriding GBG’s separately disclosed controller records.[23]

The regional terms end service use on termination but allow continued use of Results subject to the applicable schedule, additional terms and DPA.[20]

Separately, the Go schedule requires express consent where sample identity documents are supplied for improving its document library. That is a specific reuse permission, rather than a blanket right to reuse every applicant’s documents.[19]