ID-Pal: identity verification, business due diligence and ongoing monitoring

ID-Pal supplies the checks and evidence used to establish who a customer is and to keep that assessment current. Its financial-services offering combines document, biometric, database and address verification for banks, payment providers and wealth businesses. For a broker, these capabilities sit in customer onboarding and ongoing due diligence, where identifying an individual and understanding a corporate customer require different evidence.[1]

Political exposure is handled as a reason for proportionate due diligence, rather than an automatic rejection rule. Screening can recognise differing exposure levels, run enhanced reviews and rescreen when list data changes. This gives an onboarding team controls over matching and escalation without turning a potential name match into a confirmed legal conclusion.[5]

Phone validation supplies a different kind of evidence: number format, country code, carrier, line status and whether the line is mobile, landline or VoIP. The published workflow starts with a link sent to the supplied number and returns those validation signals into KYC processing. These checks help identify questionable contact details; the described result should not be expanded into a universal guarantee of the subscriber’s legal identity.[8]

IP verification is passive. It checks location and VPN or geographic inconsistencies without a separate user action, and ID-Pal explicitly describes it as supporting evidence rather than standalone proof of identity or business legitimacy. Used alongside bank and document checks, it helps explain why an otherwise plausible application may need further review.[9]

Agreed API rate limits apply; penetration testing requires prior written approval.[13]

Pricing is by proposal, based on monthly check volumes, selected features, business users, integration, coverage and support. The public page separates the KYC and KYB packages, so a feature advertised elsewhere on the platform is not necessarily included in every subscription.[12]

The June 2026 general terms start a 36-month term at first use or order acceptance, whichever is earlier, then renew for 12 months. Non-renewal requires 30 days’ written notice. ID-Pal separately reserves termination at any time on 30 days’ written notice.[13]

Configuration includes the evidence collected, the sequence of checks and the point at which a case needs a person. The platform describes a waterfall that starts with simpler checks and adds evidence or biometrics when the result calls for greater assurance. The dashboard separates passes, cases requiring review and document-expiry alerts. Every submission generates a CDD report combining verification, screening and risk results.[2]

For corporate customers, WorkStation brings company-registry information, connected entities, supporting documents and screening into a shared case. Teams can follow parent-company and beneficial-owner relationships, move investigations through configured stages and preserve actions, reviews and decisions in an audit trail. This is especially relevant where the customer is a company with several layers of ownership rather than the individual presenting an ID.[22]

Monitoring continues after the initial case. Customers configure how and when individuals or businesses are rescreened according to risk, then investigate alerts about changes to the relationship. The described monitoring concerns customer and corporate risk information; it is not evidence of a trade-execution surveillance engine.[6]

The separate end-client terms require the person to accept the terms before accessing the products and to provide accurate information. A broker’s onboarding design therefore includes the customer-facing consent and notice step, as well as the technical capture. The end-client agreement also directs data questions to the organisation that commissioned the check.[25]

Iris is the published first-line support assistant for both end users and administrators, with a route to the team when further help is needed. Human support covers setup, user access, verification workflows, interpreting results and ongoing configuration. The public support page describes these services without a numerical response-time or uptime commitment; the agreed support arrangement determines that operational coverage.[14]

The current UK digital-verification register identifies ID-Pal Limited’s service under the Identity role, medium M1A profile, with Right to Work and Right to Rent supplementary codes. It records Kantara assessment, a certificate issued on 2 October 2026 and expiry on 19 October 2029. This is a scoped identity-service certification, not a financial-services permission for a broker.[18]

ID-Pal also publishes separate IDSP terms for UK employers and landlords; they expressly exclude enterprise customers with a separate software licence. Those terms should not be carried across as the default contract for brokerage KYC.[26]

The June 2026 privacy notice also permits overseas processing under adequacy decisions or standard contractual clauses. European storage therefore does not mean every processing activity stays in Europe. Automated technical checks contribute to the customer organisation’s overall decision; the notice assigns that decision to the customer.[16]

The public Trust Centre currently lists ISO/IEC 27001:2022 and ISO 9001:2015 and provides request-based access to certificates, penetration-test material, subprocessors and organisational measures. Its public index is useful for locating the diligence documents, while the underlying gated reports supply the detailed scope and findings.[17]

ID-Pal is headquartered in Dublin. Its origin dates to 2016, when founder and current CEO Colum Lyons, previously a trader and stockbroker, connected with co-founders James O’Toole and Robert O’Farrell. The company describes a UK launch in 2022 and US expansion in 2023, with additional offices in London, New York and Lisbon.[20]

The current privacy notice identifies ID-Pal Limited and ID-Pal UK Limited.[16]

Companies House records the UK company as active, number 16879400, incorporated on 28 November 2025. Its registered office is in Ross-on-Wye; this corporate registration is distinct from the group’s operating-office list.[19]

ID-Pal announced its acquisition of NorthRow on 2 December 2025, adding KYB and AML capabilities. The announcement said existing NorthRow services would continue without interruption while a longer-term roadmap brought the platforms closer together. The current NorthRow offering is therefore part of this provider’s portfolio, with the specific application and contract still identifiable.[21]

Operator

ID-Pal Limited and ID-Pal UK Limited

Service scope

Identity and business verification, AML screening, risk monitoring and onboarding case management.

Customer types

Financial institutions; Wealth and asset managers; Payment providers; Fintechs and other regulated businesses

Delivery

SaaS; API

Pricing publication

Quote only

Headquarters

Dublin, Ireland

Platforms

ID-Pal; WorkStation; ID-Detect; ID-Pal Once

Pricing scope

Quotes reflect verification volumes, selected checks, users, integration, coverage and support.

Implementation

Hosted web/native journeys, API or SDK integration, and Salesforce; configurable verification and review workflows.

Support

Iris support assistant, human support and implementation guidance; contractual support scope is agreed.

Permissions and regulatory scope

Verification technology and evidence. The UK register certification covers an Identity service with Right to Work/Right to Rent codes, not brokerage authorisation.

Provider metadata checked 21 Oct 2026Source 1Source 16Source 15Source 2Source 12Source 14Source 18Source 20Source 21Source 22

ID-Pal Once addresses repeat verification within an existing customer relationship. The business references a stored submission ID, the returning user completes a new liveness check, and the face is compared with the earlier submission. This avoids requiring another complete document submission each time. It is reusable evidence within the configured workflow, not a claim that every financial institution must accept one common digital identity.[23]

The March 2026 Injection Attack Detection enhancement extends the liveness function to alert on software- or session-level manipulation, including attempts to bypass the physical camera and inject recorded or synthetic media. That complements presentation checks against photographs, screens and masks. ID-Pal describes these as detection capabilities; a flag still enters the organisation’s investigation and risk process.[24]

On exit, download customer data before termination. The general terms provide instructed deletion, subject to legal retention; confidential materials are returned or destroyed within 14 days, with legal and evidentiary exceptions. Service use and licences end immediately.[13]