Handout

Sumsub
User
Verification
Course
Module 1

Understanding
User Verification
Sumsub User Verification Course 2
Module 1 Session 1:
What identity verification
is and why it matters

User verification, or identity verification, is the process of

confirming that a person is who they claim to be. It can involve
checking ID documents, comparing a user selfie to an ID photo,
and cross-checking personal details using trusted databases.
The goal is to ensure that real people, not fake or stolen profiles,
interact with the system.

Today, this matters because fraud depends on anonymity.

Without proper checks, bad actors can create fake accounts,
use stolen identities, or combine real and false data to bypass
onboarding, and then move money, hide illegal activity, or exploit
platforms for profit.

Why user verification ↘ Reduces fraud by stopping fake, stolen, or manipulated

matters identities at onboarding

↘ Supports compliance: KYC and AML laws require companies

to verify customers

↘ Builds trust by confirming identity before access to services

and sensitive actions

Sumsub User Verification Course 3

 Compliance and ↘ European Union: shaped by EU Anti-Money Laundering
privacy expectations Directives and eIDAS; GDPR requires protecting personal
data and obtaining clear consent

↘ United States: shaped by the Bank Secrecy Act and the

PATRIOT Act; enforced through FinCEN and regulators such
as the SEC and OCC; privacy rules can also exist at state
level, such as CCPA

↘ Across regions, the shared goal is the same: ensure users

are genuine and keep financial systems transparent

Where verification ↘ Onboarding: opening a bank account, registering on a crypto

happens exchange, creating a digital wallet

↘ Ongoing lifecycle triggers: large or unusual transactions,

suspicious behavior, or key profile changes

↘ Industry example: iGaming may require repeat verification

once users reach certain spending limits

CDD vs EDD ↘ Customer Due Diligence, or CDD: confirms identity, screens

against sanctions lists, and checks whether a user is a
Politically Exposed Person, or PEP

↘ Enhanced Due Diligence, or EDD: used for higher-risk cases

and may require additional documents, source of funds or
income checks, and more frequent monitoring

Sumsub User Verification Course 4

 User experience ↘ If verification is too strict, users drop off. If it’s too loose,
vs security fraud increases

↘ Modern verification balances this with tools like liveness

detection, automated document checks, and integrations
with government databases

Takeaway User verification has evolved from a regulatory checkbox into

a trust system. It protects users and businesses, supports
compliance, and keeps the digital economy safe, while still
needing a careful balance between security and a smooth
onboarding experience.

Sumsub User Verification Course 5

Module 1 Session 2:
Overview of a typical
verification flow

A typical verification flow follows a structured sequence

designed to confirm identity, assess risk, and reach a decision:
approve, review, or reject. It begins when someone tries to
access a product or service that requires them to prove who
they are, such as opening a bank account, registering on a
fintech app, or joining a crypto exchange.

Watch a demo of a verification process with Sumsub here

Core stages of a ↘ Access request: the user attempts to access a service that
verification flow requires identity proof

↘ Information request: the user provides basic details like full

name, date of birth, address, and sometimes nationality

↘ Document submission: the user uploads a government-issued

ID, and in some cases supporting documents

↘ Biometric verification: the user completes a selfie or short

video for liveness and face matching

Information ↘ Details are typically entered through an online form or

request app interface

↘ This data becomes the foundation for all verification

checks that follow

Sumsub User Verification Course 6

 Document ↘ The most common documents requested are passports,
submission and driver’s licenses, or national identity cards
authenticity
checks ↘ Depending on local regulations or the user’s risk level,
supporting documents may also be required

↘ Supporting documents can include proof of address, such

as a utility bill or bank statement, or proof of income

↘ Modern systems use AI and optical character recognition to

extract data and automatically check authenticity

↘ These tools analyze elements such as holograms, fonts, and

security patterns, and detect signs of tampering or forgery

Sumsub User Verification Course 7

 Biometric ↘ This step ensures the person presenting the document
verification is the rightful owner

↘ Most often, it’s done through a selfie or short video recording

↘ Liveness detection checks that the person is physically

present and not using a static photo, mask, or digital replica

↘ Face-matching algorithms then compare the captured image

or video to the photo on the submitted ID to confirm a match

↘ Some systems also use other biometrics, such as fingerprints,

voice patterns, or behavior-based data, but facial verification
remains the most common because it works easily on
mobile devices

Risk assessment ↘ Throughout the process, the system evaluates whether the
and Enhanced Due user presents low, medium, or high risk
Diligence
↘ Low-risk users can often be approved automatically, while
higher-risk users are flagged for manual review

↘ In more complex cases, known as Enhanced Due Diligence,

the flow may include additional checks such as proof of
funds, source of wealth, or even a short interview

↘ Risk scoring can also include behavioral and technical

signals such as IP address, location, device fingerprinting,
or activity velocity

↘ These signals help identify suspicious patterns, such as

multiple accounts being created from the same device or
location

Sumsub User Verification Course 8

 Database and ↘ Once data is gathered, it’s cross-checked against external
watchlist screening databases and watchlists

↘ This includes sanctions lists, politically exposed persons

databases, and adverse media sources

↘ These checks help ensure the applicant isn’t linked to

financial crime, terrorism, or other high-risk activities

Decision-making ↘ The system, or sometimes a compliance analyst, reviews the

collected information to determine the outcome: approve,
reject, or escalate for further review

↘ Automated rules handle most low-risk cases instantly

↘ Higher-risk profiles may require manual investigation or

additional documentation

Ongoing monitoring ↘ Verification does not end after onboarding. Continuous

and re-verification monitoring is a key part of the cycle

↘ This includes ongoing transaction monitoring to detect

unusual activity and periodic re-verification when documents
expire, regulations change, or user behavior shifts

↘ Example: if a customer logs into their account from a new

country or a device not seen before, the system can trigger
re-verification or extra due diligence

Sumsub User Verification Course 9

 User experience ↘ The best verification flow feels fast and intuitive while
vs security keeping security high

↘ Too many steps or complicated interfaces can lead to

drop-offs

↘ Too few checks increase the risk of fraud or regulatory

penalties

↘ Modern providers use adaptive flows, adjusting the

number of steps based on the user’s risk profile

↘ A low-risk user might complete verification with only an ID

and selfie, while a higher-risk user goes through more
detailed checks

Takeaway A typical verification flow includes data collection, document

submission, biometric checks, database and watchlist
screening, risk assessment, decision-making, and ongoing
monitoring. Each step exists to answer two key questions:
is this person who they claim to be, and is it safe and
compliant to do business with them?

Sumsub User Verification Course 10

Module 1 Session 3:
Available checks

Verification typically combines document checks, biometric

checks, and risk screening. When layered properly, these checks
strengthen the accuracy and confidence of the final decision,
and can also adapt based on risk to keep the experience
smooth for genuine users.

Document-based ↘ Verification usually begins with document-based checks,

checks still the most common way to confirm identity

↘ Users submit a government-issued document such as a

passport, driver’s license, or national ID card

↘ Depending on regulations or risk level, they may also need

to provide proof of address or income

↘ Once uploaded, modern systems use AI and optical character

recognition to extract data and confirm authenticity

↘ Fraud-prevention tools can detect if a document has been

altered, forged, or reused

Read more about document verification with Sumsub here

Sumsub User Verification Course 11

 Non-document ↘ Non-documentary verification methods are increasingly
verification common, especially in countries with strong digital identity
systems

↘ These methods verify data directly against government

registries

↘ Examples include eIDAS-compliant systems across the

European Union, Aadhaar in India, or SingPass in Singapore

↘ Non-document verification confirms personal details and

helps establish that the person completing verification is
genuinely linked to the digital identity being verified

↘ The goal is to make verification faster, more secure, and more

inclusive for users without traditional IDs or on older devices

Read more about Non-Doc verification with Sumsub here

Documentary vs Non-Documentary Verification (2025)

Additional digital ↘ Phone number and email verification add supporting

checks confidence signals

↘ Device fingerprinting helps detect suspicious patterns and

repeat attempts

↘ Open-banking data can provide behavioral and contextual

signals that increase confidence in the outcome

Read more about phone and email screening with Sumsub here

Sumsub User Verification Course 12

 Liveness ↘ Liveness detection ensures that a biometric sample comes
Detection from a real person and isn’t a spoof attempt

↘ Active liveness requires users to blink, smile, or rotate

their head

↘ Passive liveness works in the background, analyzing details

such as reflections, skin texture, or depth

↘ Passive methods are usually easier for users, while active

methods provide stronger security

↘ Some systems also use 3D face mapping to reduce spoofing

risk and improve accuracy in different lighting or camera
conditions

Read more about Liveness Detection with Sumsub here

Face matching ↘ Face matching compares the image from the ID document
with the selfie or video captured during verification

↘ The result is a similarity score indicating whether both

images belong to the same person

Sumsub User Verification Course 13

 Proof of ↘ Proof of address is a common step, especially in
Address financial services

↘ Users provide documents such as utility bills, bank

statements, or government letters that display their name
and residential address

↘ These documents are checked for authenticity and

matched with previously submitted information

↘ Proof of address also helps assess jurisdictional risk, since

some countries are considered higher risk for money
laundering or sanctions exposure

Read more about address verification with Sumsub here

220+ 59 sec. 3
countries and to verify address fast options to
territories supported on average verify address

Sumsub User Verification Course 14

 Sanctions, watchlist, ↘ Once identity is established, organizations perform sanctions
PEP, and adverse and watchlist screening as part of anti–money laundering
media screening obligations

↘ Personal data is checked against international lists from

bodies such as the Office of Foreign Assets Control, the
European Union, the United Nations, and HM Treasury in
the UK

↘ Screening includes identifying politically exposed persons,

or PEPs, due to higher corruption and bribery risk

↘ Screening also involves checking databases and

adverse media sources for links to sanctions lists or
suspicious activity

↘ Because sanctions and risk profiles change frequently,

screening must be repeated on an ongoing basis

Read more about sanctions screening with Sumsub here

40,000+ 60%
Global data Reduction in
sources screened false positives with
AI precision

Sumsub User Verification Course 15

 Layered and ↘ Together, these checks create a layered onboarding
adaptive verification process where each step strengthens the accuracy
and confidence of the final decision 

↘ Automated systems combine data points in real time,

approving users when everything aligns or flagging cases
for manual review when inconsistencies or risks appear

↘ Verification flows can also adapt in real time based on risk.

On platforms like Sumsub, early signals from email, phone,
device, or network data can be analyzed to calculate an initial
risk score

↘ Users are categorized as low, medium, or high risk:

1 Low-risk users might pass with a quick ID and selfie check

2 High-risk users trigger extra steps like proof of address,

active liveness, or deeper AML screening

Read more about risk scoring with Sumsub here

Takeaway Modern verification works best as a layered, risk-based

framework. By combining document checks, biometrics,
supporting signals, and ongoing screening, organizations can
confirm identity, assess risk, and maintain compliance, without
slowing genuine users down.

Sumsub User Verification Course 16

Sumsub
is looking
forward to
seeing
you soon!

Sumsub User Verification Course 17

 © Sum and Substance Ltd. (UK), 2026.
All rights reserved. Company number 09688671.