August, 2026

User Verification

Verification of Payee

A new service, Verification of Payee (VoP), has been released. It works within both the User and Business Verification solutions and is designed to verify whether the provided account holder name matches the specified IBAN.

Under the EU Instant Payments Regulation, this check is becoming mandatory for euro-denominated SEPA transfers. Beyond regulatory compliance, VoP helps organizations processing payments and payouts detect incorrect or potentially fraudulent bank account details before funds are sent.

How it works:

To perform the check, provide the applicant’s IBAN and account holder name (individual or company). The service returns one of the following results:

• Match — VoP check is performed successfully and confirms that the provided data matches the account data.
• Close Match — VoP check is performed successfully and confirms that the provided data closely matches the account data.
• No Match — VoP check is performed successfully and confirms that the provided data does not match the account data.
• Not Applicable — VoP check is performed successfully, but the check is not applicable.
• Check Unavailable — VoP check cannot be performed because the external service is unavailable.
• Not Enough Data — VoP check cannot be performed because the request contains incomplete data. This result can be returned if the IBAN is missing or invalid, or if the payee name is missing.

Learn more about Verification of Payee in the documentation.

Email rate limiter

We have introduced a per-recipient rate limit for outgoing emails to protect users from being flooded with repeated messages.

What's new :

• Email sending limits — Each recipient can now receive a maximum of 200 emails per hour under a single client account.
• Automatic suppression — If a recipient exceeds this limit, any additional emails sent to them during that hour will be automatically skipped to prevent spamming.
• Reliability protection — If the system monitoring these limits experiences a temporary issue, your emails will continue to send normally without interruption.
• Improved delivery tracking — We added behind-the-scenes metrics to better monitor successfully sent and blocked emails.

Bulk editing extra fiends for Supported ID documents

We have updated how bulk editing works for extra document fields in Supported ID documents, making it much clearer and easier to manage fields across multiple countries.

You now have two dedicated tabs to control extra fields for your target countries:

• Fields to show — Select the fields you want to turn on.
• Fields to hide — Select the fields you want to turn off.

Travel Rule

New country bundles

New Travel Rule country bundles have been added:

• Thailand
• Montenegro
• Namibia
• Oman

More flexibility for Unhosted wallet verification settings

The Unhosted wallet verification setup now features more options to verify wallet ownership. A digital signature is no longer mandatory, and you can now choose whether to include digital signatures or rely solely on other methods, such as a Satoshi Test or a Self-Declaration form.

Dashboard

Markdown rendering and clickable links in Notes

All notes across the Dashboard now support Markdown formatting. Additionally, to streamline your workflow, notes generated in Case Management now include clickable case links.

Formatting hints:

• - text → Bulleted list
• 1., 2., 3. → Numbered list
• **text** → Bold
• *text* → Italic
• __text__ → Underlined
• ~~text~~ → Strikethrough

Links to sumsub.com become clickable automatically, while any other links stay as plain text.

Transaction Monitoring

Applicant Risk Level: Dedicated risk category for every applicant

We are rolling out Applicant Risk Level, a dedicated, standalone field on the applicant profile that converts complex risk data into a clean, standardized category.

What's new:

• First-class risk category — Rather than relying solely on tag clouds and total scores, applicants are automatically assigned a clear risk category (e.g., Low, Medium, High) based on customizable score thresholds and risk matrix rules.
• Dashboard & API overrides — View the assigned risk level and score breakdown directly on the Applicant page. Authorized users can manually override and lock a risk level, or update it externally via a new PATCH /resources/applicants/{applicantId}/assessment/riskLevel API endpoint.
• Workflow automation — A new riskLevel action node in Workflow Builder allows you to set or update an applicant's risk level automatically as part of your flow.

Permissions & access:

To manage this feature, two new permissions have been added:

• manageApplicantRiskScoring — Required (along with existing KYT permissions) to configure risk levels, score thresholds, and matrix tags in Settings.
• changeApplicantRiskLevel — Required to manually override an applicant's risk level on the Applicant page or via the API.

Case Management

Case notifications

Case assignees will now receive email notifications when key changes occur on their assigned cases, eliminating the need to manually refresh or monitor the case page.

What’s new:

• Assignment updates — Receive an email whenever a case is assigned or reassigned to you. When reassigned, the previous assignee is also notified.
• Status changes — Get notified immediately when a case's status changes (e.g., set to resolved or blocked).
• Blueprint updates — Receive an alert when a case's blueprint changes. If both the blueprint and assignee change in the same action, they are combined into a single notification.

Each notification includes a direct link to the case page and an unsubscribe option (managed under Profile settings → Notifications → Case notifications).

Automation

Ongoing AML and ID document monitoring for UAE LDP

You can now run ongoing AML and ID document monitoring within the UAE Local Data Processing (LDP) region, ensuring full compliance with local data storage requirements without cross-border transfers.

User Verification

Argentina DNI Verification: new employment, tax, and banking data

Argentina DNI verification now returns richer data, including employment status, tax registration details, and banking history — on top of everything it already provided.

This gives clients running AML and source-of-funds checks in Argentina a registered income signal and banking corroboration that was not available on the platform before.

New fields include the following:

• Whether the applicant has been employed within the last 6 months.
• Whether the applicant is registered as self-employed (under the Monotributo regime or as an Autónomo).
• Tax registration activity code and description.
• Latest and highest (last 24 months) bank balance.

Rejection labels and reject buttons

We have updated rejection labels and reject buttons to give reviewers more precise, accurate options.

New rejection labels:

• SUSPICIOUS_DOCUMENT — the document appears suspicious and cannot be confidently verified as authentic.
• HIGH_RISK — an unacceptably high level of risk was detected.

New reject buttons:

• Screen Replay — User uploaded a screen capture. A new submission has been requested.
• High Risk — High risk signals were identified on the profile. Based on the overall risk assessment, the applicant cannot be accepted.

Updated mapping:

• The Suspicious Document button now maps to the new SUSPICIOUS_DOCUMENT label instead of the previous BAD_PROOF_OF_IDENTITY label.

Dashboard

Flow Tree: automated checks at a glance

Flow Tree is a new tab on the applicant page that shows a visual, node-by-node breakdown of every automatic check that ran on an applicant, including its status (passed or failed) and how long it took.

Click any node to see the exact rejection reason with supporting context, such as the image or document IDs evaluated, and jump straight to the relevant block on the applicant page.

What is new:

• Nodes are grouped into readable categories.
• Failed nodes show the concrete rejection reason and let you jump straight to the related applicant block.
• For rejected applicants, the Flow Tree tab opens by default.
• Switch between verification runs, with the latest on top.

Webhook updates: test mode and full delivery tracking

We have made the following updates to webhooks for clearer test tracking and more reliable delivery across channels:

• Test webhooks sent from the Webhook Manager now carry "testMode": true, so you can tell them apart from real events. Slack, Telegram, and email test messages carry a [TEST] prefix, and test entries in the dashboard logs skip the Resend button.
• Delivery tracking, retries, and resend now work for Email, Slack, and Telegram. These channels now go through the same delivery pipeline as HTTP webhooks.
• Webhook logs also gained a Receiver column and filter, so you can view deliveries by channel.

KYB Company Documents redesign

We have redesigned the Company Documents block for clearer, faster review.

The new Company Documents area shows each document's preview and its OCR fields together, and now lives under the Photos/Documents tab.

The update includes the following:

• Open documents in a new tab without downloading.
• Anchor links to specific documents still land correctly.
• Inactive documents show a clearer inactivity marker.
• Pixel analysis shows only for image files, not for PDFs, videos, or other formats.
• Multi-page PDFs show the first page with pagination buttons.
• The Reject button stays active regardless of applicant status.

A switcher lets you toggle between the new and old document view, and the old Documents block still appears for document types the new view does not support yet.

Custom company name in PDF reports

PDF reports now use a custom company name from SDK customization if one is set, giving clients more control over how their company appears on generated reports.

Previously, reports picked the name in this order: client's display name, then client ID.

Now, they check for a custom company name from SDK customization first, then fall back to the client's display name, then the client ID.

Account deletion: now managed by owners

Owners can now request applicant deletion directly from the applicants page, with the process automated end to end.

By default, you can request up to 10 applicant removals per day through the Dashboard. Clients who already have full data-deletion access retain their existing, unrestricted limits.

Each deletion request shows a confirmation pop-up reflecting one of two outcomes:

• By default, the requested data is archived for 30 days. During this period, some data, including applicant actions, remains traceable in the Dashboard, and the system permanently removes it once the period ends.
• If your account supports instant deletion, the system deletes the requested data immediately, with no recovery option.

This feature is not available for self-service clients.

Case Management

Supervisors setting on Case Management blueprints

Previously, only users with full case management settings access could see and reassign cases across a blueprint.

Now, you can give operational leads reassignment control on your team's blueprint without handing out access to configuration settings or escalated cases meant for management review.

What is new:

• Blueprint assignment settings include a new optional Supervisors field.
• Supervisors see all cases on that blueprint and reassign them among handlers, without full case management settings access.
• If you leave the field empty, only users with full case management permissions can reassign cases, same as before.
• The All Cases page is now open to anyone with case management viewing access, automatically filtered to their own assigned and supervised cases, with no way to see beyond that.

Business Verification

HubSpot integration: Company Verification

Sumsub's HubSpot integration now supports both individual and business verification. Alongside running KYC checks on contacts, teams can now run KYB checks directly from the company record in HubSpot.

• Once the check clears, the confirmed details are written back, so the CRM reflects verified applicant data rather than manually entered information.
• On a deal, a single Sumsub card brings everything together: the verification status of the company and every contact linked to that deal, with the option to start a check right there.
• Sales and compliance teams can see whether a customer or counterparty is verified without switching tools or copying results manually.
• It is a native HubSpot app: teams decide who to verify and which checks to run, and no custom development is required.

Fraud Prevention

Fraud Network Auto-Reject is now live

Fraud networks that match a fraud rule's criteria now get rejected automatically, including newly added members, rather than waiting for manual review after the fact. Rejection happens automatically as soon as a network matches a fraud rule.

Sumsub analyzes and sets up the rules, and applies them either globally or to specific clients.

Auto-reject works with both network types:

• Online networks, such as shared device, are computed in real time, so new applicants get rejected automatically as soon as they pass verification, at the AutoCheck stage.
• Offline networks, such as shared address, are recomputed once a day, so applicants added to such a network get rejected automatically as well.

Business Verification

Periodic Registry re-check changes tracking

A new feature automatically compares a latest successful Company check against the previous approved (GREEN) check to track changes between periodic reviews. Tracked changes include:

• Company registration details
• Company officers
• Persons with significant control

New sources for Europe

We have integrated new corporate data sources to expand Business Verification coverage and real-time registry access across European jurisdictions.

Supported jurisdictions and key features:

• Poland. Real-time retrieval of both corporate entities and sole proprietor records.
• Ukraine. Comprehensive company and sole proprietor information.
• Monaco. Real-time registry access.
• British Virgin Islands (BVI). Real-time access providing company name and registration number.
• Czech Republic, Croatia, Estonia, and Greece. Real-time shareholder data retrieval.
• Bulgaria. Access to cached shareholder data.

New source for Mexico

A new integration with the Servicio de Administración Tributaria (SAT) allows you to verify Mexican company tax information directly using the company's RFC number.

Retrieved data points include:

• Company name
• Operational status
• Registered email address
• Registration date

Improved UBO classification

You can now specify UBO types in both WebSDK and the Dashboard. Form fields and verification logic adapt dynamically based on the selected subrole:

• Ownership-based UBO. Displays the Percentage of ownership field and enforces threshold validation.
• Control-based UBO. Requires filling in the Nature of control field.
• Substitute UBO / Senior Managing Official. Omits ownership percentage and threshold checks.

Duplicate applicant handling

The new Applicant account duplicates section under Business Global settings allows you to reject, ignore, or restrict duplicate company applicants based on email addresses and source keys.

SDK

MobileSDK update

Version 1.46.0 has been released. Changelog:

• iOS
• Android

Key updates:

• VPN detection. Added VPN checks for the Proof of Address with Geolocation step.
• Video Identification enhancement. Added support for pre-entering a phone number prior to starting a Video Identification session.

Transaction Monitoring

BIN lookup

BIN Lookup is now available as an additional check in Transaction Monitoring for payment card transactions. The check identifies the card issuer, issuing country, card brand, and card type based on the Bank Identification Number (BIN). It also determines whether the card is prepaid, virtual, gift, or commercial.

Company check fields in rule builder

You can now build Transaction Monitoring rules referencing company fields directly from an applicant's latest Company check result, featuring autocomplete and typed validation.

Available fields include:

• status
• type
• legalForm
• employeesNumber
• registeredCapitalAmount
• industryCode.codes
• industryCode.descriptions
• incorporatedOn
• startDate
• licenseInfo.issuedDate
• licenseInfo.validUntil

Validation updates for Applicant risk scoring parent tags

We have updated Applicant risk scoring to eliminate score calculation mismatches between configured rules and parent tags. Scoring calculations rely solely on child tags, meaning rules attached directly to parent tags with children are not executed.

How it works:

• Tag hierarchy rules. You can no longer add child tags to a tag that already has assigned rules, nor can you assign parent tags with children to a rule.
• Configuration warnings. A warning banner now highlights existing setups where rules are attached to parent tags.
• One-click unlinking. Affected tags include the Unlink option to detach rules from parent tags while keeping the underlying rules active.

Rule table updates

The installed and archived rule tables now feature new logic and structure to streamline rule management.

What's new:

• Unified execution details. The installed and archived rule tables now feature a consolidated Execution column that displays Priority, Stop on match, and mute duration settings in a single view. Priorities of zero or lower are hidden automatically to maintain readability.
• Mute filter. A dedicated Mute filter has been added to the installed rules table to quickly locate muted rules.
• Library view cleanup. The unassigned Rules library table omits the Execution column and the standalone Stop on match filter to keep the overview focused.

Rule backtesting with historical data

You can now test and compare SumScript rule modifications against historical transaction data before publishing changes to production.

How it works:

• Historical simulation. Run backtests on updated conditions without affecting live transaction processing, scores, or production statuses.
• Performance comparison. Compare match rates and total transaction volume impact between current and draft rule versions side by side.
• Supported rule types. Backtesting is currently available for SumScript rules. Scheduled event rules and legacy no-code rules are not supported.

User Verification

Transaction CSV export permission update

We have updated access controls for transaction CSV exports (including Download displayed transactions and Download last 100,000 transactions) to protect personally identifiable information (PII).

You must now possess the View applicant's personal data permission alongside View TM transactions to export transaction CSV files.

Fraud Prevention

Residential proxy detection

Residential proxy detection has been designed to identify sophisticated anonymization attempts that route traffic through legitimate residential and mobile networks rather than data centers.

How it works:

• Prerequisites. Requires Device Intelligence> or Advanced IP check services enabled, with Capture device data active on the verification level.
• Risk labels:
  • High chance residential proxy. Assigned when an IP is flagged as a residential proxy, has served as a proxy on at least 25% of the days over the past week (configurable), is not a mobile IP, and exhibits genuine location data (not hosting or data-center based).
  • Medium chance residential proxy. Assigned when an IP is reported as a residential proxy within the past week but does not meet all criteria for the high-confidence label (such as lower usage frequency or mobile network classification).
• Automation. High and medium residential proxy labels display under the Risk labels section on applicant profiles and can be referenced within Workflow Builder, Transaction Monitoring rules, and the API.

AML Screening

Source name filtering in Resolution Rules

You can now reference specific screening sources directly within AML Resolution Rules using the match.sources.names variable.

This update allows you to handle or clear specific data sources using targeted logic without whitelisting entire sources globally or setting up separate screening profiles.

Example rule logic:

• match.sources.names contains "United States of America California Department of Corrections and Rehabilitation Inmates" => false_positive

Travel Rule

Unhosted wallet verification improvements

We have updated Unhosted wallet verification to give you more control over verification workflows and expand supported networks.

• Primary method selection. You can now set a primary verification method for levels configured with multiple verification options. The selected primary method is automatically highlighted as the first choice within the SDK. Configure this directly on the level settings page by selecting Primary Method.
• Expanded Satoshi Test chain support. Added Satoshi Test support for 15 additional chains:
  • Litecoin (LTC)
  • Stellar Lumens (XLM)
  • Algorand (ALGO)
  • Linea (LINEA)
  • Mantle (MNT)
  • Plasma (XPL)
  • Monad (MON)
  • Ether on ZKsync Era (ETH)
  • Vaulta, formerly EOS (A)
  • Cardano (ADA)
  • Celestia (TIA)
  • Sei (SEI)
  • Injective (INJ)
  • XION (XION)
  • NEAR Protocol (NEAR)

Business Verification

KYB scoring: flexible formulas and ownership weighting

We have added two upgrades to how company risk scores are calculated.

You can now set a calculation formula per structure member group (UBO, Shareholder, Director):

• Max — uses the highest member score.
• Average — averages all member scores.
• Sum — adds up all member scores, so the total grows with member count.

For UBOs and Shareholders, you can also factor ownership percentage directly into the group's score, so a member who owns 50% of the company carries more weight than one who owns 5%.

Dashboard

Password confirmation field removed

We have removed the Confirm password field from sign-up, the invited-member setup link, and forgot-password.

Each of these now uses a single password field with a show/hide toggle. The strength checklist and all validation rules stay exactly as they were.

ID photo preview

You can now control whether applicants see a photo preview screen during ID capture, using a new Enable confirmation screen setting in Customizations.

By default, the setting is disabled and the preview stays off. Enabling it turns the preview on.

PII data masking

We now mask personal data in transaction tables and reports for users who do not have permission to see personal data.

Without the seePersonalData permission, personal data shows as masked characters instead of plain text:

• Transaction table — counterparty and applicant names are replaced with an external ID; payment method issuing country and wallet address are hashed.
• Transaction page — name, date of birth, place of birth, email, phone, address, LEI code, licence and registration numbers, CEO, payment account ID and issuing country, and device IP, coordinates, and address are hashed.

Empty fields stay as they are since there is nothing to mask.

Proof of Address upload

Proof of Address upload in the Dashboard now follows the same rules as the SDK.

What is new:

• You can upload a maximum of 2 files at a time, instead of an unlimited batch.
• A country selector appears before upload, covering the files you are adding.
• Uploading a new Proof of Address image automatically deactivates the old one, instead of leaving both active.
• When an applicant has two Proof of Address steps, you now pick which step the files go to using a radio button.

Show map on applicant page update

Document fields used to open their own inline map, which expanded within the page and behaved differently from other location views on the applicant page. Every Show map and View on map action now opens the same Locations modal already used for device/IP checks and address.

What is new:

• Document fields, including ID document, Proof of Address, and the new Proof of Address, now open the shared Locations modal instead of an inline expanded map.
• The inline expanded map is gone entirely.
• All existing map data and markers carry over into the modal.

This update applies to individual applicants only; KYB applicants are unaffected for now.

CSV export: invoice charges by child account

Clients with a parent-child billing hierarchy can now export a CSV breakdown of invoice charges by child client key, directly from the Billing page.

A new Download line items CSV button appears next to the existing Get report button on the Billing overview page. It downloads a CSV showing exactly how much each child client key was charged on that invoice.

• The button appears only for parent accounts with billed child sub-accounts; standalone clients and child accounts do not see it.
• It is enabled only when the selected invoice has at least one line with a non-zero charge.
• The CSV includes one row per service line, sorted by client key, with service period, child client key, line description, quantity, unit price, line total, tax, and currency.

This complements the existing Get report export, which covers aggregated usage for the whole invoice; the new export breaks the same invoice down per child account. This feature does not apply to self-service and single-key clients.

User Verification

PDF upload restriction for Identity document step

Uploaded PDF files are no longer accepted on the physical Identity document (POI) verification step.

Key updates:

• Format requirement. Applicants must upload physical identity documents as PNG or JPEG image files. PDF uploads on physical POI steps trigger an automatic request for an image upload.
• Digital documents. Digital document PDFs and non-POI verification steps (including Proof of Address and Business Verification) remain unaffected.

South African address enrichment

We have deployed an AI-driven address enrichment engine for South African address verification.

What’s new:

• Automated parsing. Converts unstructured or incomplete township and rural stand address inputs into structured profiles.
• Geolocation processing. Cross-references mapping services to fill missing geographical parameters automatically.
• Data refinement. Features suburb-versus-city auto-correction, postal code recovery, and automated exclusion of post office box addresses.

Level-specific email customization

Outgoing user emails can now inherit the service name and logo directly from the level SDK customization settings rather than relying on account-wide configurations.

What’s new:

• Branding preference. Email branding automatically prioritizes large logo variants over default square formats.
• Character encoding. Sender names use RFC encoding to support non-ASCII corporate titles reliably.
• Service name selection. The display name is determined directly by the name key in customStyles.

New Sandbox testing templates

We have added 16 new proof of identity (POI) templates to the Sandbox environment to streamline integration testing.

What’s new:

• Supported POI jurisdictions. Added Approved and Rejected document templates for Austria, Brazil, Mexico, Nigeria, Greece, Romania, and France.
• POI as POA coverage. Added the United States New Jersey driver's license template to test POI as Proof of Address verification.
• Testing requirements. Template files must be uploaded without altering file names or image hashes. Templates automatically override existing Sandbox result presets.

Fraud Prevention

Anti-detect browser signal separation

Device Intelligence now distinguishes between general device anomalies and dedicated anti-detect browser usage.

What’s new:

• Anti Detect Browser. A dedicated risk signal now explicitly identifies specialized evasion tools (such as Octo Browser, AdsPower, or Dolphin[anty]) used to disguise device footprints or bypass liveness checks.
• App Tampering. This signal remains reserved for general hardware or operating system inconsistencies.

Case Management

AML Screening permission update

Accessing the AML Screening section no longer requires the general View case management permission. Holding the dedicated View AML screening permission alone grants full access to the section.

Blueprint table source column

A new Case creation source column (WF, AML, or Rules) has been added to the blueprints overview table to show how cases are generated without requiring you to open individual blueprints.

Transaction Monitoring

Rule table filtering updates

The installed rules table now includes the Adds a note and Send reminder options within the Affects filter.

Confirmation prompt for transaction decisions

A new option, Ask for confirmation before approving or rejecting transactions, is available under the General (Transaction Monitoring) settings. When enabled, a confirmation prompt appears before approving or rejecting transactions marked as Requires action to prevent accidental clicks.

Applicant Risk Level customization updates

We have updated Applicant Risk Level threshold configurations, maximum score bounds, and system event notifications.

Key enhancements:

• Decimal precision. Risk scoring ranges now accept decimal increments (1, 0.1, or 0.01) alongside dynamic upper bounds and a threshold normalization helper.
• System cap enforcement. The 16-level limit is enforced across both backend API endpoints and dashboard interfaces.
• Event webhooks. The applicantRiskLevelChanged webhook fires whenever an applicant's risk level changes. The payload includes applicantId, previousRiskLevel, newRiskLevel, and triggerReason.