Trulioo: identity verification, corporate ownership and onboarding workflows

Trulioo supplies identity verification and risk information to businesses that need to establish who a customer is and whether to accept or continue the relationship. Its forex offering covers individual traders, corporate accounts and the people who own or control those companies. For a broker, the operational role sits around account opening and subsequent review: collecting evidence, checking it against configured sources, escalating exceptions and recording the result. Workflow Studio combines these steps into customer journeys that can vary by country and risk policy.[2]

Data verification and document verification answer different questions. A data match checks consistency with a source record; a document workflow examines the presented credential and, where configured, the person presenting it. Trulioo describes automatic capture assistance for blur and glare, document classification and extraction, front-and-back analysis, facial comparison and liveness checks. The customer can select accepted document types and combine modules instead of treating every applicant as the same verification case. The resulting indicators still need to be interpreted within the broker’s acceptance and escalation policy.[18]

Corporate work can involve several linked checks rather than one company-name search. Trulioo’s KYB product supports location-specific identifiers, source waterfalls and the connection between a legal entity and its beneficial owners. It describes AI-assisted normalization and translation of business information. Those mechanisms help bring records from different jurisdictions into a usable format; they do not make a sparse registry as complete as a detailed one. The relevant output is the ownership evidence and unresolved gaps for the particular business being assessed.[5]

The developer interface uses REST over HTTPS with JSON requests and responses. Trulioo publishes libraries for several common programming languages and advises integrations to tolerate new fields and changes in field order. That matters for a broker connecting verification to a CRM: a parser that assumes an exact historical response layout can fail even when the API has only added information. The public overview describes a flexible rate policy without providing one universal numerical allowance for every account and service.[10]

The MCP service is an execution interface, rather than a catalogue of documentation for a chatbot. Trulioo says it can perform checks, adapt the next step and request missing information or human input while recording activity. Its significance is that an agent can participate in a verification workflow. The customer still defines what that agent may do, and the integration does not automatically activate every Trulioo product. The separate Know Your Agent service supplies identity and authorization evidence about agents; it performs a different job from MCP.[3]

Authentication also depends on the API generation. Platform services and Normalized API v3 use OAuth 2, while the documentation distinguishes older Basic-authentication integrations. Client credentials come through customer success. The token response supplies its expiry, and the application must handle an expired-token response by obtaining a replacement. Issuing a new token does not invalidate an existing one. Consequently, routine refresh and the removal of compromised credentials are different operational events; simply generating another token is not evidence that the previous token has been revoked.[13]

The current public platform and product pages lead to a sales discussion and do not provide a common numerical tariff for the complete service. Trulioo presents data and document verification through a common integration and contract, but that does not establish that every check, data source or monitoring service has the same charging basis. A commercial schedule needs to identify the enabled products and countries, the billable event and the treatment of repeated checks. No public universal minimum commitment, implementation fee or cancellation period is established by the inspected product material.[1][19]

Consent is a data-source requirement as well as a customer-interface issue. The developer documentation does not describe one consent statement that automatically covers every jurisdiction and source. Instead, it provides calls to discover the applicable requirements. A broker changing its source selection therefore needs to keep the collection journey aligned with the checks it actually requests. This is especially relevant when a workflow falls through from one source to another or adds a new country.[14]

The hosting reference explicitly warns that a selected region does not necessarily prevent processing through another region, including where data-provider requirements or workflow-generated experiences are involved. Regional endpoints and portal configuration therefore need to be considered together. A statement that an account is “in Europe” is not, by itself, a description of the complete route taken by every enabled check.[11]

Trulioo publishes separate sales and technical-support routes and describes global customer support as available around the clock. The developer material provides request and response references, integration guidance and troubleshooting context. The public contact page does not specify a universal response-time commitment; availability of a support channel and a contractual incident-resolution target are separate service terms.[12]

Trulioo supplies verification and screening capabilities; its role in this profile is technology and information provision. An AML result is a potential match to investigate, not a direction from a regulator to accept or reject the customer. The screening product uses additional identifiers such as date of birth and country to help distinguish similar names. Ongoing monitoring can identify changes after onboarding, but the broker must connect those changes to its own review process and account controls.[20]

The Services Privacy Policy identifies Trulioo Information Services Inc. and its affiliates. It describes Trulioo primarily as a processor for customer-directed services, with controller roles for some business verification, fraud and product-development activities. Certain personal-data uses for machine-learning development or improvement are permitted where allowed by the customer and applicable law; the policy is not a blanket promise against model training. It also describes international processing through infrastructure and data partners. For processor-held information, the customer determines the relevant purposes and handles the end user’s rights request.[6]

The security page states ISO 27001:2022 and SOC 2 Type 2 assurance and describes encryption, multifactor authentication, single sign-on, least-privilege access, redundancy and third-party penetration testing. These are provider-published security controls. An assurance report concerns the systems and period in its scope; it is distinct from a financial-services permission and from the broker’s obligation to configure and operate its own onboarding process.[4]

Trulioo now presents its business around identity and risk decisions across the customer lifecycle, extending the earlier emphasis on a check at the point of onboarding. Its current leadership page names Vicky Bindra as chief executive. The product range reflects that broader positioning: individual and corporate verification sit alongside continuing screening, ownership research and identity credentials for AI agents. These are related capabilities, but their integration routes and permissions remain product-specific rather than one automatically enabled bundle.[17]

Operator

Trulioo Information Services Inc. and affiliates

Service scope

Identity, document, business and AML verification, with workflow automation, ownership research and KYA agent-identity tools in Alpha.

Customer types

FX brokers; Financial institutions; Fintech firms; Digital platforms

Delivery

SaaS; API; Hosted

Pricing publication

Quote only

Headquarters

Vancouver, Canada

Platforms

Workflow Studio

Pricing scope

Sales-led terms; no common numerical product tariff established in the inspected public material.

Implementation

Country and product configuration, consent collection, capture integration and event handling.

Support

Global customer support advertised 24/7; separate sales and technical routes.

Permissions and regulatory scope

Verification and risk-information technology. Customer policy governs acceptance and compliance decisions; security assurance is separate from financial authorisation.

Provider metadata checked 20 Oct 2026Source 2Source 6Source 3Source 1Source 12Source 20Source 14Source 15Source 4Source 9

Biometric retention has its own published rule. The July 2025 policy says facial-scan data is destroyed immediately after verification or retained for up to one year after the last interaction, according to customer instructions, with a longer period where legally required. Trulioo says it supplies verification or fraud results to the customer rather than sharing the facial-scan data itself. This statement concerns the derived facial scan: it should not be applied indiscriminately to document photographs, other personal information or the transaction record.[7]

Workflow Studio’s end-client deletion endpoint removes the selected records from Client Manager, but its documentation expressly says service transaction data remains until the configured retention period purges it. That distinction matters when closing a customer record or ending a deployment: successful client deletion is not confirmation that all underlying verification evidence has disappeared. The retention configuration and the removal of client records must be understood as separate controls.[16]

Separate rules apply to information Trulioo holds for its own purposes. Its Services Privacy Policy ties processor retention to customer instructions, but retains controller data for KYB, fraud or product development while a legitimate business need remains. Information awaiting deletion from backups may be isolated from further processing until deletion is possible.[6]