October, 2026

User Verification

Kazakhstan Non-Doc Verification for eResidents

We have released Non-Doc Identity Verification for eResidents in Kazakhstan, a service for the electronic verification of foreign nationals and stateless individuals who hold eResidency status. It covers 15,000+ registered eResidents, helping banks, fintechs, crypto platforms, and other businesses onboard them with less friction and strong identity assurance.

The verification works as follows:

• Applicants submit their Personal identification number (IIN) and complete a quick Liveness Check.
• Sumsub validates this data against the Ministry of Internal Affairs of the Republic of Kazakhstan.
• The service confirms that the data matches the government source and belongs to the person onboarding.

New settings for Lite mode

Only the account owner can now switch an existing level between Default and Lite mode. Regular admins can no longer do it.

Each client now has a setting that defines the allowed mode (Default, Lite, or Default & Lite) for ID document, selfie, liveness, and proof of address steps. You cannot save a level, either in the Dashboard or via API, if the allowed mode setting excludes its mode for any of its steps.

SMS OTP turned off for Chinese numbers in crypto and online gambling

To comply with regulatory requirements in China, Sumsub will stop sending SMS one-time passwords (OTP) to Chinese phone numbers (+86) for crypto and online gambling businesses, starting next week.

Applicants of these clients who select China (+86) on the Phone Verification step can no longer request an OTP.

Phone Risk Assessment, Phone Insights, and Identity Enrichment through phone numbers keep working for Chinese numbers.

Questionnaire step status

The questionnaire step now keeps its own status instead of copying the overall review status of the applicant, so applicants no longer fill in a questionnaire they have already completed. Previously, an approved questionnaire turned back to pending whenever the applicant moved to pending for any other reason.

Now the Dashboard, SDK, and API read the step status from a separate Questionnaire check:

• An approved questionnaire stays approved when the applicant goes back to pending, goes on hold, or has to submit another document. The SDK no longer asks the applicant to fill it in again.
• Editing a questionnaire after approval, for example adding a required question, no longer flips approved applicants back. To collect new answers, reset the questionnaire step.
• The applicant timeline shows an entry when the questionnaire result becomes Approved or Rejected.

Issuing state for US driver licenses and ID cards

The state that issued a document can differ from the state in the address of the person, for example when someone moves and keeps their old address while the new card comes from a different state. For US driver licenses and ID cards, we now extract the Authority field, which shows the issuing state, for example California, New York, or Texas.

This differs from the State in the address, which shows where the person lives. We detect the Authority from the document type (its design), not from the address.

Business Verification

Manual review of Corporate AML hits on AutoKYB

Previously, any Corporate AML match on AutoKYB, with either Registry and AML checks or AML checks only, rejected the company automatically, even when the match was a false positive. Manual review was available only with FullKYB.

Now AML matches on company applicants in AutoKYB can go to Sumsub operators for manual review instead of being rejected automatically. The operator clears false positives and confirms true matches, and the AutoKYB flow continues with that decision.

To enable it:

1. Turn on Manual AML review on KYB Auto.
2. In the AML screening settings of the level, with Custom AML screening on, clear the Enable for Company levels option under Automated AML screening review:
   • If you select it (default), the system rejects matches automatically, as before.
   • If you clear it, matches go to manual review.

FullKYB levels always include manual review.

Limits for the number of Associated Parties per role

You can now set minimum and maximum limits for the number of Associated Parties per role, so applicants add only as many parties as you need to verify.

To set the limits, go to Level settings → Associated parties → Set limits. When you enable them, WebSDK restricts the number of Associated Parties that applicants can add in each role.

Registry prefill also respects the maximum. When a registry returns more parties than a role allows, the system keeps the ones with the largest ownership, and companies come before individuals. When a role is full, the cross-check no longer raises missing beneficiary violations for it, since the applicant had no way to add more.

Customisation of Associated Parties links

You can now control how verification links for Associated Parties are shared from the company verification screen.

In the Dashboard, go to Customisations → General and use the following options to hide the buttons you do not need:

• Hide button Verify now
• Hide button Send to email
• Hide button Copy link

You can hide each button on its own. If you hide all three, the button row disappears completely. Send to email still appears only when the party has an email, as before.

Dashboard

App token expiration emails

Clients now receive an email before an app token expires.

Starting a week before expiration, Sumsub sends a daily reminder until the expiration day, then sends one final email when the token expires. The emails go to the person who created the token and to everyone on the account who can manage app tokens.

Disabled tokens and tokens without an expiration date do not trigger emails.

External Applicant ID in the applicants list

The applicants list now shows the External Applicant ID next to the Applicant ID, so you can match records more easily.

For applicants without a name, the External Applicant ID appears on a separate line below the Applicant ID. For applicants with a full name, both IDs appear on the same line, so the row height does not change.

Both IDs show in a shortened format with the first four and last four characters, which makes them easy to match against search results. You can copy the full IDs from the applicant page or view them in a tooltip.

Self-purchasable Non-Doc databases

You can now purchase Non-Doc databases one by one. The single Self Purchase Non-Doc card is gone, and the Solutions page has a new Databases tab with 11 databases.

Each database has its own card, with its own price per check and its own monthly commitment.

Automation

Recording applicant consents via API

You can now record applicant consents through the API without sending the full consent text. This helps clients who collect consents in their own interface, such as API-only integrations, or who take consent before the SDK starts.

Previously, the API method required you to send the full text of each consent, and Sumsub stored it without an acceptance date or an IP address.

Now you send only the confirmation that the applicant accepted: when they accepted and from which IP address. Presenting the consent documents to the applicant remains your responsibility, as described in Applicant Privacy Disclosures and Consent Requirements.

You can also pass the same data inline when you create an applicant, using the new acceptedAgreements object of the Create applicant method.

Transaction Monitoring

Risk Matrix versioning

Applicant Risk Scoring and Risk Levels now have version history, so you can review and restore earlier versions.

• Every save creates a new revision that keeps the full state (tags, weights, risk level thresholds), along with its author and date. A badge next to each revision shows what changed: Initial version, Scores, Risk levels, or Associated parties.
• Click Make actual to restore any previous revision. Its matrix and risk level thresholds replace the current ones, and tags you removed from scoring since then come back.
• The Applicant Scoring page now works as a single form. Press Save to apply your changes or Cancel to discard them, instead of saving on every click.
• You can see changes to the Risk Matrix on the Events page on the Applicant scoring tab.

To open the history:

1. In the Dashboard, go to the Applicant Risk Scoring page.
2. In the top-right corner, click Version history.

Restoring a revision requires the manageKytSettings permission.

The history starts from the moment versioning became available for your account, so earlier changes are not available.

Unlinking a tag from a rule changes the rule configuration, not the Risk Matrix. To revert it, use the version history of the rule.

Case Management

Case path

The new Case path shows the route a case took through your blueprints, including escalations, transfers, dual review, returns to maker, and side branches, all on one board. You can find it in the Dashboard:

1. In Case Management, open the case you are interested in.
2. Open the Events tab of the case.

Case path shows:

• How the case was created, with its priority, start time, and deadline.
• Every blueprint the case visited, in order, with the time spent and the number of visits.
• Arrows for Escalation, Transfer, and Dual review, with a counter when the same transition happened several times.
• Who worked on the case in each blueprint, split into active and waiting time.
• How long the case spent in each stage.

Custom CSV Export for Case Management

Custom CSV Export is now available for Cases, as it already is for applicants data, KYT Transactions, and AML screenings. You can export large volumes of cases, case notes, and case events without the on-screen list limiting you.

On the All cases page, you get three separate exports, each with its own button: Cases, Case Notes, and Case Events. A built-in column selector lets you pick only the fields you need.

The flow matches the Applicants export: the system generates files asynchronously, you find your exports on the reports page, and you re-authenticate with 2FA to download. Generated files expire after 30 days.

Filters work as follows:

• Cases export: all filters from the cases table apply.
• Case Notes and Case Events exports: only the date range applies. These exports do not depend on the filtered cases list.

To use the export, you need the seeCaseManagement and manageCaseManagementSettings permissions, as well as one of the Custom CSV Export permissions: downloadAnonymousApplicantReport or downloadSensitiveApplicantReport.

The same key rules as the Applicants export apply: the key needs an Owner, except for demo and trial keys.

SDK

MobileSDK update

Version 1.47 has been released. Changelog:

• iOS
• Android

Dashboard

Customizable default SSO user roles

You can now define a fallback default role assigned to new single sign-on (SSO) users when no identity provider (IdP) group mappings are configured.

What’s new:

• Default role selection: A mandatory Default role setting is now available in SSO settings when IdP group mappings are absent. Any non-owner role can be selected as the baseline role.
• Access control: New SSO users automatically receive the configured default role upon initial login instead of defaulting to the Admin role. Role changes made manually after initial login are preserved.
• Deletion restriction: Roles currently set as the default SSO role cannot be deleted.

Add-ons in level settings

Self-purchasable products are now displayed directly within level settings as locked options with an Add-on badge. Selecting the badge opens the product drawer, and purchasing the add-on automatically activates the setting for that level.

Signed authentication cookie for Dashboard security

The Dashboard at authentication cookie is now an ES256-signed JSON Web Token (JWT) to allow signature verification at the network edge.

What’s new:

• Edge verification: Cloudflare can verify token authenticity using public keys without sending database lookup requests to backend servers, enhancing DDoS defense and rate-limiting capabilities.
• Signature validation: Backend servers validate token signatures on every request, rejecting expired, altered, or invalid keys automatically. Existing unsigned session cookies remain valid to prevent user logouts.

User Verification

Liveness option in Real-Time Identification Recording

The Real-Time Identification Recording verification flow now supports two video-recorded selfie verification options: Web camera photo and Advanced liveness check.

User Verification

New AML screening provider

AML Watcher is now available as an AML screening provider, alongside ComplyAdvantage. You can use it in KYC, KYB, and Transaction Monitoring.

It covers sanctions, PEPs, watchlists, and adverse media across 235+ countries and jurisdictions, with name matching in 80+ languages. It also includes ongoing monitoring and criminal and judicial record coverage.

Real-time coaching in the liveness check on WebSDK

Applicants no longer need to complete the whole liveness check on WebSDK before they learn that their photo was not good enough and they have to try again. The check now coaches users in real time: it spots the problem while the applicant is still in front of the camera and shows how to fix it right away, for example Move to a better-lit place, Hold your camera steady, or Take off your glasses.

Automation

Ongoing Document Monitoring: After expiry setting

Ongoing ID Monitoring now has a new After expiry setting that gives applicants a grace period when their ID expires.

Previously, when an ID expired, the applicant moved to Resubmission Requested, and many clients blocked platform access right away. Now, applicants stay approved for the number of days you set after their ID expires, and only then receive a request to upload a new one.

To set it up, go to Global settings → Ongoing document monitoring → ID document, select After expiry, and enter the number of days.

Dashboard

Reusable KYC and Periodic Verification in Self Purchase

You can now purchase two more products yourself on the Solutions page:

• Reusable KYC: Self Purchase now sells the new dedicated Reusable KYC service instead of the legacy Applicant verification checks.
• Periodic Verification: you can buy it directly from the Solutions page. After you enable it, set up a scheduled rule to re-verify approved applicants automatically.

Transaction Monitoring

Applicant Risk Scoring: score associated parties by applicant

Previously, the system scored associated parties per role, so a party with several roles, for example Director, Shareholder, and UBO, counted once for each role and added to the company score two or three times. You can now choose how Applicant Risk Scoring builds the score of a company from its associated parties.

In the Associated parties section of the Applicant Scoring settings, select one of two counting approaches:

• Role-based: the company score comes from the role scores of associated parties, so one individual or company can count several times, as before.
• Applicant-based: the company score comes from the scores of associated parties, so each party counts once, no matter how many roles they have.

With the applicant-based approach, you set two calculation methods, each with Max, Average, or Sum:

• Per-applicant: how the role scores of an applicant contribute to the score of the applicant.
• Company: how the scores of all applicants contribute to the company score.

The Applicant Risk Scoring breakdown on the applicant page follows the approach you choose, with rows by role or by applicant.