Shufti: identity verification, screening and broker onboarding controls

Shufti, previously branded Shufti Pro, provides identity verification, business verification and financial-crime screening technology. Its forex offering explicitly addresses brokers and CFD trading businesses, with document checks, facial verification, address checks and AML screening used around account opening and continuing customer review. The service supplies evidence and risk outputs to the broker; it does not itself open or operate the trading account.[1]

The KYB documentation distinguishes registry findings from optional AI business insights. When registry coverage is insufficient, an AI-assisted route can draw on alternative information sources. That is a different evidence basis from an official registry record. Hosted business verification, backend requests and document-supported checks allow different onboarding workflows, but the presence of a company-search result does not establish that every beneficial owner has passed an individual identity check.[3]

Mode changes apply to new verification requests and are locked for 48 hours after selection. In particular, Rapid Plus’s initial result and later human review are separate events; a broker using that mode needs to account for the later outcome in its customer workflow. These are documented mode descriptions, not independently measured turnaround times.[6]

The core interface uses REST requests with JSON data. Shufti documents Basic authentication with the client ID and secret, alongside token authentication. Credentials are managed in the back office; the secret is displayed when generated and must be regenerated if lost. Test identity documents are available for evaluating the integration before live customer submissions.[7]

In the onsite flow, the merchant starts a request and receives a verification URL for the user. Shufti then collects evidence and interacts with the person through its hosted form or embedded component, with results returned through the API or back office. OCR can extract information for the user to check; the non-OCR route instead compares manually entered details with submitted evidence. Onsite describes the customer interaction, not a requirement to install the service on the broker’s premises.[2]

Role-based access and multi-tenancy address different problems. Custom roles limit what a staff member can see or do inside an account, while the parent/child arrangement lets a group oversee several brands. The latter is a support-enabled configuration, rather than an automatic consequence of creating several ordinary accounts.[8][9]

The pricing FAQ describes Free and Essentials as pay-as-you-go with no monthly minimum or lock-in. It also says successful verification attempts are billable and resubmissions are not charged.[11]

Absent an agreed initial term: 24 months from the last Sales Order signature. One further 24-month renewal has three months’ non-renewal notice; later renewal requires agreement.[12]

Shufti offers cloud, on-premises and hybrid deployment. Its deployment description includes environment assessment, installation, local inference and governance configuration for the on-premises route. Local AML operation involves licensed watchlist data and refresh arrangements. This makes deployment a wider decision than where a verification form appears: infrastructure operation, data access and updating the screening inputs all form part of the selected service.[13]

The provider describes local deployment across document, face, address, AML and business-verification functions. That is a product description, not proof that every external registry or data source is available offline in every country. The selected deployment and contracted data connections determine which checks can actually run for the broker’s customer population.[13]

For ongoing individual AML monitoring, the API documentation requires the ongoing flag and, separately, the adverse-media monitoring flag where that service is wanted. Monitoring is available in production rather than the test environment. The stated default refresh is 15 minutes and can be configured; changes can generate webhook, back-office or email notifications. Monitoring therefore needs its own operational alert handling, beyond the original onboarding request.[4]

A practical consequence of callback replay is that a broker’s integration must recognise an already processed event. The callback log and resend controls provide delivery visibility, but replaying a result should not create a second customer record or repeat an already completed action. This is an implementation implication of the documented replay capability, rather than a claim that Shufti manages the broker’s downstream database.[10]

Monthly support obligations cease once work exceeds 20 staff hours within Business Hours; further charges may apply. Availability targets 99% monthly on reasonable endeavours, with exclusions including hosting faults.[12]

The technical-support workflow includes a back-office Contact Us module with issue categories, supporting information and ticket tracking. It covers integration questions, verification results and reports, with additional website assistance and a knowledge base. The useful operating distinction is that an account’s technical query can be tracked in the service, while a new commercial enquiry begins with the product and expected-volume form.[14]

The published security page reports SOC 2 Type II assurance, PCI assessment and iBeta presentation-attack testing. These address different security or verification properties; they are not a financial-services licence or a guarantee that every identity decision will be correct. The certification statements here are attributed to Shufti, and this profile does not claim to have conducted a security audit or live verification test.[17]

The September 2026 Services Privacy Notice says clients make final decisions about onboarding, blocking or reporting an individual when Shufti acts as processor. It separately identifies controller activities such as model training and fraud prevention. Repurposing client-instructed data requires the stated written agreement and lawful basis; biometric training data has additional segregation and access safeguards.[16]

The contract specifies seven years after service ends without alternative instructions. It and the later notice describe different default conditions; the Sales Order and recorded client instructions need to establish the applied retention period.[12][16]

The deletion endpoint requires a completed verification, a reference of 6–250 characters and a reason of 5–100 characters. It is a specific operational control for verification records. A broker leaving the service also needs to distinguish its retained audit evidence from Shufti’s separately described controller processing; deletion of one verification is not a documented account-wide data-exit mechanism.[18]

Companies House records Shufti Pro Limited as an active UK private company, number 11039567, incorporated on 31 October 2017. Its registered office is Coppergate House, 10 Whites Row, London E1 7NF. The current Shufti brand therefore coexists with the Shufti Pro legal name; a brand change should not be mistaken for an unidentified replacement contracting company.[20]

The current company page identifies Shahid Hanif as co-founder and chief executive and Victor Fredung as co-founder and chairman. Earlier announcements use different executive titles, so this profile uses the current leadership page rather than carrying forward titles from the funding announcement.[19]

Shufti announced a $20 million Series A led by Updata Partners in March 2022. That provides historical funding context, not a current ownership percentage or a claim that the investor controls the company today.[21]

Operator

Shufti Pro Limited

Service scope

Identity and business verification, AML screening and transaction-risk tools for onboarding and ongoing review.

Customer types

FX and CFD brokers; Financial institutions; Fintech businesses; Other identity-verification customers

Delivery

API; SaaS; On premises; Hybrid

Pricing publication

Public and quoted pricing

Platforms

Shufti Backoffice; Shufti AI; Shufti MCP Server

Pricing scope

Published Free and Essentials plans coexist with Sales Order commercial terms.

Implementation

REST integration with hosted collection, configurable verification modes and cloud, on-premises or hybrid deployment.

Support

Back-office technical tickets, documentation and commercial enquiry routes.

Permissions and regulatory scope

Verification and screening technology; client controllers retain final onboarding and reporting decisions. Security certifications are not brokerage authorisations.

Provider metadata checked 20 Oct 2026Source 1Source 20Source 7Source 13Source 14Source 11Source 16Source 22Source 23

Shufti AI is a back-office assistant for questions about verification activity, customer information, billing and official product documentation. Its documented functions include tables, trends, filters, customer views and conversation history. These features can help a compliance or operations team investigate its account data; the description does not establish an autonomous authority to approve trading accounts or change staff permissions.[22]

The MCP server adds a separate integration route for compatible AI assistants. Documentation lists 27 tools, divided between knowledge functions and verification actions: an assistant can initiate a hosted verification, run supported screening and retrieve outcomes. The merchant still needs the corresponding Shufti services enabled. This is more than a documentation chatbot, because some tools initiate actual service requests.[23]

The MCP privacy notice keeps document images, selfies and biometric capture in the hosted verification page, while agent-assisted requests may carry identifying information needed for AML or business searches. Returned outputs include status, references, decline reasons and screening outcomes, but not extracted document data. The connected AI operator is a separate client relationship rather than a Shufti subprocessor. The notice also discloses logging of the full reference and the first 120 characters of knowledge queries, so those fields should not be used to carry unnecessary personal information.[24]