Skip to content
ProductArena

Identity Verification & KYC Arena

Identity Verification & KYC arenaBuyer checklist

Every requirement we judge identity verification & kyc products against, as a ready-to-send RFP checklist — with each item's priority, why it matters, and how the top-ranked products score on it today.

53 requirements · 13 themes · verdicts for 6 products · updated 2026-09-15 · priorities mirror the story weights our scoring uses (methodology)

Procurement report →
Show the markdown export
# Identity Verification & KYC — buyer checklist (RFP)

Derived from ProductArena's evidence-graded user-story taxonomy for Identity Verification & KYC: 53 judged requirements. Priorities mirror story weights (3 = must-have, 2 = should-have, 1 = nice-to-have).

## Agenticness

- [ ] **[must-have]** Plug MCP servers into this product so it can use their tools
- [ ] **[must-have]** Connect an agent via an official MCP server
- [ ] **[must-have]** Drive the product through a documented public API
- [ ] **[must-have]** Delegate tasks to a built-in AI assistant inside the product
- [ ] **[should-have]** Point an agent at llms.txt or agent-oriented docs
- [ ] **[should-have]** Run the product headlessly / in CI for automation
- [ ] **[should-have]** Use an official CLI
- [ ] **[should-have]** Issue scoped/least-privilege API credentials for an agent
- [ ] **[should-have]** Build against official SDKs
- [ ] **[should-have]** Subscribe to events via webhooks
- [ ] **[should-have]** Get AI-generated insights and suggestions from my data inside the product
- [ ] **[should-have]** Set up automations that run autonomously in the background
- [ ] **[should-have]** Operate the product with natural-language commands
- [ ] **[should-have]** Explore an interactive API reference with runnable examples
- [ ] **[should-have]** Download a machine-readable API spec (OpenAPI or equivalent)
- [ ] **[should-have]** Rely on versioned APIs with a documented deprecation policy
- [ ] **[nice-to-have]** Test against a sandbox environment without touching production data

## Automation depth

- [ ] **[must-have]** Define rules that trigger actions automatically on events
- [ ] **[should-have]** Perform bulk operations across many items at once
- [ ] **[should-have]** Schedule recurring jobs or workflows
- [ ] **[nice-to-have]** Version, review, and roll back my automations

## Biometric liveness

- [ ] **[must-have]** Selfie checks match the live user to the document portrait with liveness detection — documented defenses against printed photos, screens, and replayed video
- [ ] **[should-have]** The vendor documents specific defenses against AI-generated faces, deepfakes, and camera-injection attacks — named detection capabilities, not just a marketing mention of fraud
- [ ] **[should-have]** The platform detects repeat and duplicate identities across verifications — the same face or document resurfacing under different names is flagged automatically

## Data checks

- [ ] **[should-have]** Verify identity against authoritative databases without documents — SSN, national registries, or credit-header data — for lower-friction flows where a doc scan is overkill
- [ ] **[should-have]** Verify businesses, not just people — registry lookups, UBO identification, and documented KYB flows that chain into KYC on the owners
- [ ] **[should-have]** Enrich verifications with phone, email, and device risk signals — carrier checks, address history, device fingerprint — as additional documented check types

## Document coverage

- [ ] **[must-have]** The platform verifies government IDs from a documented breadth of countries and document types — passports, national IDs, driver licenses, residence permits — with the supported list published
- [ ] **[should-have]** Verified sessions return the extracted document fields as structured data — name, date of birth, document number, address, expiry — retrievable via the API, not just a pass/fail flag

## Idv agent access

- [ ] **[must-have]** An agent can operate the verification pipeline — create sessions, poll outcomes, retrieve extracted data, and trigger re-checks through the API or an MCP surface with scoped credentials
- [ ] **[should-have]** Verification outcomes come back structured enough for an agent to decide on — machine-readable check results, risk signals, and failure reasons an automated onboarding flow can branch on

## Integration dx

- [ ] **[must-have]** A sandbox lets me exercise every outcome before going live — documented test documents, personas, or magic values that deterministically produce pass, fail, and review results
- [ ] **[must-have]** The whole verification lifecycle is drivable through the API — create a session, get its status, retrieve results and captured media, and cancel or redact it — with every step documented
- [ ] **[should-have]** Verification lifecycle events arrive as signed webhooks — created, processing, verified, requires-input — so my system reacts to outcomes without polling

## Openness

- [ ] **[must-have]** Export all of my data in open formats and leave
- [ ] **[must-have]** Self-host the core product
- [ ] **[should-have]** Do everything through the API that I can do in the UI
- [ ] **[should-have]** Read the product's source under an open license

## Privacy posture

- [ ] **[must-have]** Prevent my data from being used to train AI models
- [ ] **[should-have]** Choose where my data is stored (region/residency)
- [ ] **[should-have]** Control data retention and deletion
- [ ] **[should-have]** Opt out of telemetry and usage tracking

## Privacy retention

- [ ] **[should-have]** The vendor documents how biometric data is handled lawfully — GDPR bases, US biometric statutes like BIPA, and the consent language my flow needs — so legal review has something to review
- [ ] **[should-have]** Control what happens to collected identity data — documented retention windows and a redaction or deletion API that scrubs PII on demand

## Verification flows

- [ ] **[must-have]** Launch a complete document-plus-selfie verification with a hosted or drop-in flow — create a session server-side, redirect or embed, and read the result — without building capture UI myself
- [ ] **[should-have]** I get native iOS, Android, and web SDKs with guided camera capture — glare, blur, and edge detection coaching the user to a usable document photo on the first try
- [ ] **[should-have]** Send a verification to someone with a no-code link or QR code — no engineering ticket to verify a one-off customer, contractor, or seller
- [ ] **[should-have]** A person verified once can be recognized and reused across sessions or products — documented re-verification and reuse of a prior passed check instead of forcing a full re-run

## Verification orchestration

- [ ] **[must-have]** Configure verification logic without code — conditional steps, risk-based routing, country-specific requirements, and template changes that don't need an engineering deploy
- [ ] **[should-have]** See verification funnel analytics — pass rates, drop-off points, completion time by country and document type — to know what verification is costing me in signups
- [ ] **[should-have]** Borderline verifications land in a manual review queue with the full evidence — document images, extracted fields, check results — and reviewer decisions feed back into the record

## Watchlist screening

- [ ] **[should-have]** Screening is not one-shot — previously verified users are continuously re-screened against watchlist updates, and changes raise events I can act on
- [ ] **[should-have]** Screen verified users against sanctions, PEP, and adverse-media watchlists as part of the same verification — one vendor, one API, one review surface

---

Source: https://ultrametric.ai/productarena/arena/identity-verification (evidence-graded verdicts for 6 products) · methodology: https://ultrametric.ai/productarena/methodology

Chips show the top 5 ranked products' current verdict on each requirement — ✓ full · ~ partial · ! disputed · — none · n/a not applicable.

Agenticness — how well agents can access and operate the productAgenticness· 17 items

How well agents can access and operate the product

Automation depth — how much of the product can run unattendedAutomation depth· 4 items

How much of the product can run unattended

Biometric liveness — stories about biometric liveness in this arenaBiometric liveness· 3 items

Stories about biometric liveness in this arena

Data checks — stories about data checks in this arenaData checks· 3 items

Stories about data checks in this arena

Document coverage — stories about document coverage in this arenaDocument coverage· 2 items

Stories about document coverage in this arena

Idv agent access — stories about idv agent access in this arenaIdv agent access· 2 items

Stories about idv agent access in this arena

Integration dx — sandboxes, test modes, webhooks, and how fast a developer gets to a working integrationIntegration dx· 3 items

Sandboxes, test modes, webhooks, and how fast a developer gets to a working integration

Openness — open source, data portability, and self-hosting storiesOpenness· 4 items

Open source, data portability, and self-hosting stories

Privacy posture — data-handling and privacy storiesPrivacy posture· 4 items

Data-handling and privacy stories

Privacy retention — stories about privacy retention in this arenaPrivacy retention· 2 items

Stories about privacy retention in this arena

Verification flows — stories about verification flows in this arenaVerification flows· 4 items

Stories about verification flows in this arena

Verification orchestration — stories about verification orchestration in this arenaVerification orchestration· 3 items

Stories about verification orchestration in this arena

Watchlist screening — stories about watchlist screening in this arenaWatchlist screening· 2 items

Stories about watchlist screening in this arena

Full evidence behind every verdict lives on the arena page and each product page — chips above deep-link straight to the judged story.