KYC providers

GNU Taler operators need to satisfy regulatory requirements in terms of Know-your-customer (KYC) regulation and risk assessment (which usually starts with checking for politically exposed persons (PEPs)). KYC usually requires at the minimum for the customer to upload some identity documents, which then must be verified. KYC often also requires some kind of lifeness checks to ensure that the owner of the documents is the one passing the documentation along. To this end, we have tried to find KYC "solutions" that would help us address this.

Naturally, the goal is to do this with Free Software. However, all of the solutions we found so far are proprietary SaaSS. If you know of a solution that is actually Free Software, we would be eager to hear from you.

In the absence of a proper FLOSS solution, we have looked at other important criteria, such as the solution offering at least FLOSS integration on the client-side, having an open API specification (no NDA!), or even supporting a standard API. Technically, we also need the KYC provider to work nicely over the Web (not just with a smartphone), and from a business perspective we like transparent pricing (alas, this is the least important point).

Criteria Summary

Thus, these are the key evaluation criteria we have:

Supports collecting and validating KYC information, including PEP lists and ID documents from Europe
Open API specification (no NDA, directly on web site)
Web interface support (no required app-only integration, can run KYC process just in a browser)
Supports standard open API (OpenID, OIDC, etc.)
Client-side code is FLOSS (no proprietary JavaScript and/or FLOSS app integrations)
Transparent pricing (prices not only upon inquiry)
Server-side is fully FLOSS (not SaaSS)

The list is not intended to be complete. Other criteria would include where data is hosted, and how privacy-friendly the solution is overall (e.g. is additional data collected, can profiles be easily deleted, etc.). However, already the above list narrows down the field to basically nobody.

Supported Providers

These are the KYC solutions for which a GNU Taler integration is available or under active development:

	KYC?	Open API?	Web?	Standard API?	FLOSS client?	Pricing?	FLOSS server?
Challenger	❌	✅	✅	✅	✅	free	✅
kycaid.com	✅	✅	✅	❌	❌	✅	❌
withpersona.com	✅	✅	✅	❌	some	some	❌

Challenger is our own home-brewed address validation service (under development); it doesn't actually do real KYC by our definition, but may still be useful in some legal scenarios. We additionally selected KYCAID and WithPersona for our first implementations as they seem closest to our objectives (see below for lists of other providers we considered), and we needed some KYC support. That said, there is room for improvement for both of these solutions towards respecting their users' freedom.

Adding support for additional KYC providers largely requires implementing a KYC plugin, that is a shared library exporting the KYC plugin API. If you need help implementing additional KYC adapters, please do not hesitate to contact us, we will be happy to support your efforts!

Other providers

Here is a list of other KYC solutions we have found and evaluated against the criteria above.

	KYC?	Open API?	Web?	Standard API?	FLOSS client?	Pricing?	FLOSS server?
Actico.com	✅	❌	?	❌	❌	❌	❌
iDenfy.com	✅	✅	✅	❌	some	❌	❌
idnow.io	✅	✅	✅	❌	❌	❌	❌
idscan.net	✅	✅	❌	❌	❌	❌	❌
jumio.com	✅	❌	?	❌	❌	❌	❌
kyc2020.com	✅	❌	✅	❌	❌	✅	❌
metamap.com	✅	✅	✅	❌	❌	❌	❌
passbase.com	✅	✅	✅	✅	❌	✅	❌
plaid.com	✅	✅	✅	❌	some	❌	❌
shuftipro.com	✅	✅	❌	❌	❌	❌	❌
SumSub.com	✅	✅	✅	❌	❌	✅	❌
swiftdil.com	✅	✅	tricky	❌	❌	✅	❌
tokenoftrust.com	✅	weird	✅	❌	some	❌	❌
Trulioo.com	✅	❌	?	❌	❌	❌	❌
Ondato.com	✅	❌	?	❌	❌	✅	❌
onfido.com	✅	✅	?	❌	some	❌	❌

Not quite KYC Providers

Here is a list of identity management solutions we found searching for KYC providers that don't actually do the kind of KYC (with identity document verification and PEP list checks) that would be needed. Note that not offering KYC support with document validation and PEP lists is a absolutely hard criteria against the solution: we believe such providers would not usually satisfy the legal requirements. These providers are only listed so that they do not get re-evaluated as they came up in a search (and it took time to understand that they do not actually offer KYC).

	KYC?	Open API?	Web?	Standard API?	FLOSS client?	Pricing?	FLOSS server?
accubits/smart-kyc	❌	✅	✅	❌	✅	free	✅
Authlete.com	❌	✅	?	✅	n/a	✅	❌
Gluu.org	❌	✅	?	✅	?	free	✅
microblink.com	❌	❌	?	❌	❌	❌	❌
nomidio.com	❌	✅	?	✅	?	✅	❌
privo.com	❌	❌	?	❌	❌	❌	❌
scytales.com	❌	❌	❌	❌	❌	❌	❌
Seon.io	❌	✅	❌	❌	❌	✅	❌
Signicat.com	❌	✅	✅	✅	?	❌	❌