KYC/KYB Verification in Mobile Apps: Integration & Implementation

KYC/KYB Verification in a Mobile App

KYC (Know Your Customer) and KYB (Know Your Business) are not just "upload a passport photo." They are a set of technical and regulatory requirements: identity verification, liveness detection, sanctions list screening, AML screening, data storage, and audit logging. The mobile app is the data collection point and process orchestrator. We implement KYC/KYB turnkey: integrate SDKs, configure the backend, and handle all verification statuses. Timelines start from 15 business days. Mistakes here are costly—license revocation or regulator fines. Our team has 5+ years of experience and has completed 50+ KYC integration projects. We guarantee compliance with regulatory standards, including GDPR and AML directives. Certified engineers handle every integration. Contact us for a consultation to assess your project. Integration costs typically range from $5,000 to $15,000 depending on complexity, but choosing the right provider can reduce maintenance costs by 30%.

How to Choose a KYC Provider?

Building KYC in-house is rare. Document processing, liveness detection with attack protection (photos, deepfake video, 3D masks), sanctions screening (OFAC, EU, UN)—this is a separate product requiring years of development and constant updates. Integrating a ready-made SDK is orders of magnitude cheaper than building from scratch, saving project budget.

Mature SDKs on the market include Onfido, Jumio, Sumsub, IDnow, Veriff, and Stripe Identity. The choice depends on user geography, document types, regulator requirements, and pricing model. We integrate the provider's SDK into the mobile app, configure server-side webhooks, build the UI flow, and handle all verification states. Contact us—we'll help you choose the optimal provider.

Sumsub SDK Integration Example

Sumsub is a popular choice for CIS and Europe. SDK for iOS (SumSubSDK) and Android (com.sumsub.sns:core).

General flow:

1. Backend creates an applicant via Sumsub API: POST /resources/applicants with externalUserId.
2. Backend generates an access token for the SDK: POST /resources/accessTokens with applicantId and levelName.
3. The mobile app receives the access token from your backend.
4. The SDK launches with this token.

// iOS import IdensicMobileSDK let sdk = SNSMobileSDK.init( accessToken: receivedToken, baseUrl: "https://api.sumsub.com", flowName: "basic-kyc", locale: "ru" ) sdk.onStatusDidChange = { sdk, prevStatus in switch sdk.status { case .ready: break case .incomplete: self.handleIncomplete() case .pending: self.showPendingScreen() case .approved: self.handleApproved() case .declined: self.handleDeclined() case .failed: self.handleError(sdk.failReason) @unknown default: break } } sdk.present(from: self) 

// Android val sdk = SNSMobileSDK.Builder(this) .withAccessToken(token, onTokenExpiration = { callback -> viewModel.refreshApplicantToken { newToken -> callback(newToken) } }) .withLocale(Locale("ru")) .build() sdk.launch() 

The onTokenExpiration handler is important: the token lives for 10 minutes. If the user lingers on the photo step longer, the SDK calls the callback and waits for a refreshed token.

How Does Liveness Detection Work?

Modern liveness detection is passive (the user looks at the camera) or active (blink, turn head). Passive relies on ML models, active uses motion detection.

Camera requirements: at least 720p, autofocus. Poor lighting is a common cause of failure. SDKs provide real-time feedback: "Improve lighting," "Hold the phone steadier."

Attacks on liveness:

• Photo—basic protection in all SDKs.
• Video replay—more sophisticated protection.
• 3D masks—protected by enterprise-class SDKs (Jumio, Onfido).
• DeepFake—an active area of development; not all SDKs protect against it.

Document Scanning

All SDKs support automatic capture: they detect document edges, check for blur, reflections, and readability. The user does not press a button—the SDK takes the snapshot when a quality threshold is met. This is critical: manual capture yields 30–40% poor images, automatic capture yields 5–8%. Automatic capture is twice as good in quality. Over 50% of identity fraud attempts involve spoofing; automatic scanning reduces this risk.

Supported documents depend on the SDK and region. Sumsub covers 220+ countries, Onfido 195. Each SDK has a database of supported documents.

MRZ (Machine Readable Zone)—the bottom strip of the passport with encrypted data. The SDK extracts data from the MRZ and compares it with the visual zone—an extra validation step.

KYB: Business Verification

KYB is more complex than KYC: it requires company registration documents, proof of address (utility bill not older than 3 months), and KYC of beneficial owners (UBO—beneficial owners with a share of 25% or more).

Sumsub Business Verification and Jumio KYB support KYB flows with a wizard for document collection. A key point: each UBO undergoes full KYC separately. If a company has three beneficial owners, three KYC checks are required, which may happen asynchronously.

The mobile app must support this asynchronous flow: the user sent company documents, now waiting for UBO-1 verification, UBO-2 in progress, UBO-3 not started. We build a status dashboard with progress for each participant.

Webhooks and Polling

Verification is an asynchronous process (from minutes to days for manual review). After document submission, the SDK reports a pending status. The real result comes via a webhook to your backend.

The backend handles the webhook (applicantReviewed, applicantPending), updates the user's status in the database, and sends a push notification to the mobile app.

The mobile app shows a "Under review" status with animation. Polling every 30–60 seconds is a fallback mechanism.

Data Storage and GDPR Compliance KYC

Document images are not stored on our servers—only with the KYC provider. We only store the applicantId, status, and verification date. Users' right to delete data (GDPR Article 17) is implemented via the provider's API: DELETE /resources/applicants/{applicantId}.

According to GDPR, users have the right to erasure of personal data. We ensure compliance through provider APIs.

Retention policy: most providers store data for 5–7 years (AML/FATF requirements). Upon deletion from the provider, we document that data has been deleted—for regulatory audit.

What's Included in the Work

• Integration documentation (Sequence diagram, flow description)
• Access to the provider's test environment
• Training for the product team
• Technical support during launch
• Security audit and regulatory compliance review

Work Stages

Timeline: 15–25 business days. Depends on the provider, regulatory requirements, and whether KYB is included.

Server-side components (webhook handling, AML integration, audit trail) are estimated separately with the backend team. Integration cost is calculated individually; choosing the right provider can reduce maintenance costs.

For a consultation and assessment of your project, contact us. We'll evaluate the task within 1 business day.