Sumsub industry provider profile

Sumsub supplies identity-verification, fraud-prevention and compliance-workflow technology to businesses, including FX and CFD brokers. For a brokerage, its role can extend from collecting evidence at account opening to screening, monitoring and investigating activity after onboarding. Its trading-industry materials describe configurable identity and address checks, payment verification, questionnaires and device-related signals. The deployment is therefore a set of selected checks and decision workflows, not one universal pass/fail product that meets every broker’s requirements without configuration.[1]

Business Verification is particularly relevant when a broker onboards companies, institutional counterparties or business partners. Sumsub’s documentation distinguishes company information from the associated people and ownership relationships that must be assessed. A record of the company’s existence is consequently only one part of the workflow. The customer needs to specify which parties require identity checks and what evidence must be obtained for a multilayer ownership structure.[2]

For transaction monitoring, Sumsub describes reusable rule bundles and customer-defined rules, including the ability to try rules before applying them live. This matters because an alert is the output of a particular configuration, not proof of wrongdoing. Investigation and reporting tools can bring transaction context together, but a broker still needs a defined review process, owners for unresolved cases and a decision on which data feeds reach the system.[4]

The API documentation describes a REST interface with sandbox and production environments and versioned breaking changes. It also warns that new response fields can be added. For the integrating broker, that makes tolerant response parsing and explicit handling of unknown fields part of reliable maintenance. The applicant identifier in the CRM should remain traceable to the verification record so that later updates are associated with the correct customer.[6]

A mobile integration needs a separate decision about the onboarding flow for companies. MobileSDK offers native capture for individual verification, but its documented exclusion of Business Verification means a broker cannot assume the same in-app path covers corporate onboarding. The corporate process may need another supported interface. Platform and framework support should also be matched to the app version actually shipped to customers rather than inferred from the existence of an SDK brand.[7]

Salesforce integration is a defined connector with requirements, rather than a generic statement that Sumsub works with any CRM. Its documentation identifies edition and Lightning requirements, data mappings and webhook setup, and describes paid integration scope. A brokerage using Salesforce Classic or a different edition cannot assume the described package applies. Standard configuration and more extensive customization also need separate commercial treatment.[8]

HubSpot’s connector similarly connects verification to specific business records. Its documentation covers contact and deal workflows, mapping and enablement through a Customer Success Manager. The broker should decide which record represents the legal customer, how duplicate contacts are handled and which reverification events update that record. Those are workflow choices around the connector, not evidence that HubSpot itself performs the verification.[9]

The minimum commitment is a spending floor, not a promise of unlimited checks. Sumsub says the full verification-bundle price applies even when a customer chooses not to use every feature. Enterprise products such as business verification, transaction monitoring and more specialized checks need their own commercial scope. Basic’s advertised positioning also makes it inappropriate to assume the lowest headline unit price includes the programme a regulated brokerage requires.[10]

The FAQ addresses applicants who do not complete verification and says those checks are not charged, using the phrase successful verifications.[10]

The terms define a completed Check by Approved, Rejected or Resubmission requested status. Completion therefore differs from approval; confirm the billable event in the applicable plan rather than reading the FAQ as approval-only pricing.[11]

The advertised trial lasts 14 days and includes 50 free checks.[10]

Trial eligibility is discretionary. The terms require payment method, company/billing details and activation of the selected plan; customers then activate the trial themselves. Dashboard terms set its scope and duration, some features may be unavailable, and services automatically become chargeable when the trial ends.[11]

The general terms set 12-month initial and renewal periods, subject to their exceptions and the customer’s agreement.[11]

Sumsub’s sandbox is an integration-testing environment. Its documentation expressly says it does not contain the production approval algorithms, and it supports forced or simulated outcomes for testing workflows. A successful sandbox path therefore demonstrates that the application handles a configured test result; it does not measure real applicant approval rates, fraud detection or production review performance. That distinction is material when moving from a technical proof of connection to a live onboarding process.[12]

Webhooks can deliver notifications to an HTTP endpoint or to supported messaging/email destinations. Sumsub describes logging, retries and manual resending through its webhook tools. These facilities help diagnose delivery problems, but the broker’s receiving application still needs to associate events correctly and avoid treating a repeated notification as a new account or new payment instruction. Operational records should show which event changed the client status and when it was applied.[13]

The service privacy notice distinguishes handling on the customer’s behalf from certain independent purposes, including reusable-identity services. A buyer should map those roles to the actual features purchased and preserve an exit plan for required evidence. The public notices do not establish one processing country, retention schedule or export format for every deployment. Location, subprocessors and the treatment of retained copies need to be matched to the selected service arrangement.[15]

Sumsub’s support guidelines distinguish product help from operating the customer’s compliance function. They describe troubleshooting and configuration guidance, but the actual entitlement remains subject to contract. The guidelines also generally redirect end users to the business whose verification flow they used; support is not an appeal route that substitutes for the broker’s own decision-making process.[18]

The public status service is a useful incident-information route, but a green status indicator at one point in time does not establish the availability achieved for a particular broker or create a contractual service level. The contract should identify incident severity, response expectations and the relevant customer contacts. Internal monitoring should also distinguish a Sumsub incident from an error in the broker’s own integration.[20]

A completed verification supplies evidence for the customer’s review. Sumsub’s support guidelines leave assessment of results and business decisions with the customer; those responsibilities do not transfer through a support case.[18]

Sumsub’s Trust Center provides a starting point for supplier assurance, including information-security and continuity material. This profile reviewed the public descriptions, not restricted audit reports. A brokerage assessing a particular deployment needs the relevant report period, covered legal entities and services, and any controls assigned to the customer. Certification titles should not be converted into a claim that the broker’s complete onboarding or monitoring programme is automatically compliant.[17]

Sumsub says it was founded in 2015, initially working on manipulated-image detection before expanding into identity verification and related controls. The current company page identifies founders with executive and technical responsibilities. This product history explains its combination of document/fraud analysis and broader operational tooling, but the inspected company account does not establish a complete current shareholder register or ownership percentages.[21]

Operator

Sumsub group; contracting entity depends on customer location and agreement

Service scope

Identity and business verification, AML and fraud controls, transaction monitoring, case workflows and crypto Travel Rule technology. Product selection and business decisions remain customer-specific.

Customer types

FX and CFD brokers; Banks and financial-services businesses; Payments businesses; Crypto service providers; Other businesses requiring verification

Delivery

SaaS; API

Pricing publication

Public and quoted pricing

Pricing scope

Public plans have monthly minimums; custom scope is quoted. Contractual completed checks are distinct from approvals.

Implementation

API, SDK and documented CRM connectors, with sandbox integration testing and separate production readiness.

Support

Customer support and documentation; custom engineering, training and business-decision handling have distinct scope.

Permissions and regulatory scope

Compliance technology provider. No brokerage authorisation or transfer of the customer’s regulatory responsibilities is asserted. Public security assurance material is not financial-services permission.

Provider metadata checked 20 Oct 2026Source 1Source 5Source 6Source 10Source 11Source 12Source 17Source 18

API authentication uses an app token and a request signature calculated with HMAC-SHA256, sent over HTTPS. The timestamp must be within one minute of the API server’s time. These requirements make secret handling and server-clock accuracy operational dependencies: a working workflow can still fail when the credential is mishandled, the body used for signing differs from the transmitted request or the clock is wrong. The server-side app secret should be treated separately from the access token used to initialize a client SDK.[14]

Travel Rule functionality should be scoped separately if a brokerage also operates a relevant crypto-transfer service. Sumsub describes counterparty discovery, information exchange and checks involving VASPs and unhosted wallets. These functions answer a different question from whether an individual has passed identity verification. A business using both services needs to connect the customer identity, transfer data and counterparty handling without treating one completed check as evidence that every other obligation has been satisfied.[5]