KYC Rules

Have a purpose

Run a check only to support a defined onboarding, account, lending or risk decision. Before you integrate a service, record why you need it and which result your workflow depends on.

Tell your customer, and get consent where it is required

Tell the customer what information you are collecting, why, and that it will be checked. Obtain any consent the law requires before you send a request.

Use the minimum service

Request full details only when your workflow genuinely needs the extra fields, and display and store no more of them than it needs.

Treat every outcome correctly

A result is one input to your decision, not the decision itself. Keep these outcomes apart so customers always get the right next step:

• Verified: the details match the registered record.
• No record: no matching identity was found.
• Mismatch: a record exists, but the details supplied do not agree with it.
• Provider failure: the source was unavailable, timed out or returned an error. This says nothing about the customer; retry later.

Control access

Give API keys only the scopes they need and keep them on your servers. Turn on two-factor sign-in, give team members the lowest role that lets them work, and remove people promptly when they leave.

Keep good records

Store the request_id against your decision so it can be audited. Keep the reference instead of the full identity response whenever the reference is enough, and apply a written retention period to anything you do keep.

Give customers a route to challenge

Define when a case goes to manual review, and give customers a clear way to question an outcome and to correct their details. Never close an account or refuse a service on a provider failure alone.