DEV Community: Max Primebiometry

How a Lazy KYC API Integration Can Secretly Double Your Startup's SaaS Bill

Max Primebiometry — Tue, 14 Jul 2026 12:13:39 +0000

Here is a classic startup scenario:

You get a Jira ticket to "add identity verification to user onboarding." You check the docs of a vendor like Veriff or Sumsub, install their Web SDK, spin up an Express route to listen to webhooks, and flip a is_verified boolean in your database. It takes a couple of days, works perfectly in the sandbox, and passes QA.

Three months later, your CFO drops into your Slack DM with a screenshot of a $5,000 invoice.

"Hey, we only onboarded 1,500 new users this month. Why are we paying for 5,000 KYC checks?"

As developers, we rarely think about how our API design interacts with a vendor’s billing model. But when it comes to KYC (Know Your Customer), a lazy implementation will burn your company’s runway faster than almost any other integration.

Here is why your code is probably costing your company too much money, and how to refactor your onboarding architecture to fix it.

The Billing Reality: Attempts vs. Successes

Most developers assume KYC is billed per verified user. It usually isn't.

KYC vendors generally bill you in one of two ways:

Pay-per-Attempt (e.g., Veriff Essential at $0.80/check): You pay every single time a user clicks "Submit" and sends their data to the vendor's servers. If they fail, you still pay.
Pay-per-Success (e.g., iDenfy at $1.35/check): You only pay when a user actually passes the check. If they get rejected, it costs you $0.

In a perfect world, everyone passes on their first try. In reality, retail users are terrible at taking photos of their documents. They use expired IDs, upload blurry selfies in dark rooms, or accidentally hold up a credit card instead of a driver's license.

In fintech or crypto, user failure rates routinely hit 30% to 50%.

If you are using a pay-per-attempt vendor and your integration lets users blindly retry 5 times with a blurry photo, you just paid $4.00 to reject a single user.

1. Stop Useless API Calls (Client-Side Pre-Validation)

The easiest way to cut costs is to never trigger the KYC SDK if the document is obviously invalid. Before you initialize the vendor's session on your backend:

Enforce Aspect Ratio and Resolution: If a user uploads an image, check the metadata in JavaScript. If the resolution is too low (e.g., under 1000px), reject it on the client side with a helpful UI tooltip. Do not waste an API call on a thumbnail.
Run Local OCR on Expired Docs: If you use a lightweight, free OCR library on the frontend, parse the expiration date first. If the ID expired in 2024, block the submission before the vendor's billable SDK runs.
Simple Input Masking: If the user has to type their document number or name manually before uploading, match it against basic regex. Don't send empty or garbled data to the KYC vendor.

2. Lock Down Your State Machine

A loose database schema is a breeding ground for duplicate KYC charges. If your UI lets a user click "Retry" while a webhook is still processing, you’re double-paying.

Keep a strict PostgreSQL state machine to lock down the onboarding flow.


CREATE TYPE kyc_status AS ENUM (
    'NOT_STARTED', 
    'PENDING_UPLOAD', 
    'SUBMITTED_TO_VENDOR', 
    'VERIFIED', 
    'TEMPORARY_REJECTION', 
    'PERMANENT_REJECTION'
);

CREATE TABLE user_kyc (
    user_id UUID PRIMARY KEY REFERENCES users(id),
    status kyc_status DEFAULT 'NOT_STARTED',
    attempt_count INT DEFAULT 0,
    vendor_session_id VARCHAR(255),
    updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP
);

The Rules of the State:

If status is SUBMITTED_TO_VENDOR or VERIFIED, block any attempts to initialize a new SDK session.

If status is TEMPORARY_REJECTION (e.g., blurry photo), allow a retry but increment attempt_count. Cap retries at 3.

If status is PERMANENT_REJECTION (e.g., suspected fraud or fake document), freeze the UI entirely and flag the user for manual compliance review. Never let a suspicious user run unlimited automated attempts on your dime.

3. Handle Webhook Race Conditions Idempotently

Because identity verification is asynchronous, handling webhooks safely is non-negotiable. If you don't use database row-level locking, a double-fired webhook or a rapid user reload can cause race conditions.

Here is a clean Node.js / Express implementation that uses Knex.js to lock the KYC state during updates:

const express = require('express');
const router = express.Router();
const db = require('../db'); // Your database connection
const { verifyWebhookSignature } = require('../utils/crypto');

router.post('/v1/kyc-webhook', async (req, res) => {
    const signature = req.headers['x-kyc-signature'];
    const rawBody = req.rawBody;

    // 1. Never skip signature validation in production
    if (!verifyWebhookSignature(rawBody, signature, process.env.KYC_WEBHOOK_SECRET)) {
        return res.status(401).send('Invalid signature');
    }

    const { userId, eventType, result } = req.body;

    try {
        await db.transaction(async (trx) => {
            // Use SELECT FOR UPDATE to lock the row and prevent race conditions
            const kycRecord = await trx('user_kyc')
                .where({ user_id: userId })
                .forUpdate()
                .first();

            if (!kycRecord) {
                return res.status(404).send('Record not found');
            }

            // If they are already verified, ignore stale webhooks
            if (kycRecord.status === 'VERIFIED' || kycRecord.status === 'PERMANENT_REJECTION') {
                return res.status(200).send('No-op');
            }

            if (eventType === 'verification.passed') {
                await trx('user_kyc')
                    .where({ user_id: userId })
                    .update({ status: 'VERIFIED', updated_at: new Date() });

                await trx('users')
                    .where({ id: userId })
                    .update({ is_verified: true });
            } 

            else if (eventType === 'verification.failed') {
                const isFraud = result.reason === 'spoofing' || result.reason === 'fake_document';
                const newStatus = isFraud ? 'PERMANENT_REJECTION' : 'TEMPORARY_REJECTION';

                await trx('user_kyc')
                    .where({ user_id: userId })
                    .update({ 
                        status: newStatus, 
                        attempt_count: kycRecord.attempt_count + 1,
                        updated_at: new Date() 
                    });
            }
        });

        return res.status(200).send('Received');
    } catch (err) {
        console.error('KYC Webhook Error:', err);
        return res.status(500).send('Internal Server Error');
    }
});

Don't Forget the "AML Tax"

Many developers build their entire onboarding flow around Veriff’s $0.80 API only to realize during an audit that they also need to run Sanctions and PEP checks (AML screening).

Most entry-level KYC SDKs don't include this out of the box. If you buy AML checks as an add-on, it adds another $0.50 to $1.50 per check.

If your team is regulated (e.g., fintechs under MiCA or FinCEN rules), it is often cheaper and simpler to choose a vendor that bundles both into a single endpoint. For example, Sumsub's Compliance tier costs $1.85, but it bundles identity verification and AML screening in one API call—saving you from writing and maintaining a second integration.

Wrapping Up

Before writing a single line of integration code, sit down with your product manager and look at your target audience:

If you expect high document rejection rates (emerging markets, high-risk sectors), look for a vendor with pay-per-success pricing like iDenfy.

If you have highly tech-savvy users and near-zero fraud risk, a raw pay-per-attempt model like Veriff is the cheapest route.

If you need AML screening and want to keep your backend architecture simple, compare bundled compliance APIs.

If you just want to run your own numbers and compare monthly costs side-by-side based on your expected volume and failure rates, use our interactive KYC Cost Calculator.

For a complete architectural and cost breakdown of 9+ major KYC/AML APIs, including API limits, setup fees, and contract terms, we mapped out all the real developer data over at PrimeBiometry: KYC Pricing 2026: Real Vendor Rates & Developer Breakdown.

How are you handling KYC state lockouts on your backend? Let’s chat in the comments.

Sumsub vs. Veriff: Building a Modern Fraud Prevention Architecture That Doesn't Break Under Load

Max Primebiometry — Wed, 08 Jul 2026 05:43:00 +0000

Somewhere between 90 and 95 percent of alerts generated by traditional rule-based transaction monitoring systems are false positives, which means the analysts staffing your fraud queue spend most of their week chasing nothing. That statistic alone explains why the conversation around modern fraud prevention architecture has shifted from "which vendor has the best logo" to "which stack actually reduces manual review load without introducing new failure points." We put Sumsub and Veriff side by side because they represent the two dominant philosophies buyers are choosing between right now: the consolidated compliance stack versus the specialized, high-accuracy point-solution.

This comparison is part of the ongoing vendor research at PrimeBiometry. More info here. We evaluate KYC and fraud prevention stacks against a documented scoring methodology.

Key Takeaways

Factor	Sumsub	Veriff
Architecture philosophy	Single-vendor stack (KYC + KYB + AML + transaction monitoring)	High-accuracy identity verification layer, modular pricing
Entry pricing	$1.35/verification · $149/mo minimum (Basic)	$0.80/verification · $49/mo minimum (Essential)
Compliance Coverage	Full AML, KYT, business verification	Core IDV, AML/device checks in higher tiers
Best fit	Crypto exchanges, iGaming, fintech needing five compliance functions under one contract	Consumer apps and marketplaces needing 99.6% decision accuracy at scale
Avoid If	You need on-premise deployment for data sovereignty	You need transaction monitoring bundled into the same API

Is Sumsub or Veriff better for a modern fraud prevention architecture? Sumsub wins on breadth (one API covering compliance end-to-end); Veriff wins on verification accuracy and per-check pricing transparency.

Do I need a full fraud detection platform or a single fraud prevention tool? That depends on transaction volume and regulatory obligation; see our fraud prevention category overview for the full vendor landscape.

What does compliance coverage actually mean in a scoring context? In our methodology it's 25% of the total weighted score, alongside Integration Depth (25%), Pricing Transparency (20%), Market Coverage (20%), and User Sentiment (10%).

Why We're Comparing Architecture, Not Just Vendors

Identity verification procurement is broken. Pricing is hidden behind sales calls, compliance claims are unverified, and most comparison sites are thinly veiled affiliate directories with no original analysis.

PrimeBiometry started as an internal research project: evaluating KYC vendors for a regulated fintech during an FCA authorization process. That 300-plus-hour exercise became the basis for the scoring methodology we still use today, and it's the reason we refuse to publish a review without checking pricing pages ourselves.

Compliance is verified against public certificates and DPA templates, not self-attestation. No editorial shortcuts.

What a Modern Fraud Prevention Architecture Actually Requires

A fraud management tool that only checks a driver's license photo isn't an architecture, it's a single point-solution. A real stack needs several layers working together, and buyers building for 2026 volumes are typically assembling:

Document authentication against forensic databases (Regula covers 254 countries here)
Liveness and biometric matching to defeat deepfake and injection attacks
AML/KYT screening against sanctions and PEP lists, ideally with ongoing monitoring, not a one-time check
Transaction monitoring tuned to reduce the false-positive rate that currently drowns most compliance teams
Device and behavioral intelligence layered on top for account takeover detection

The unit economics of this stack matter enormously. A per-verification price of $1.35 looks trivial until you multiply it across a million onboarding events a year — at which point pricing transparency, including monthly minimums and overage rates, becomes the difference between a predictable budget line and a renegotiation nightmare.

Did You Know? For every $1 lost to fraud, U.S. financial services lenders spend $5.75 once operational, compliance, and reputational costs are counted.
Source: LexisNexis Risk Solutions True Cost of Fraud Study 2025 (U.S. lending segment)

Sumsub: The All-in-One Compliance Stack

Sumsub is the most complete one-vendor compliance stack in the market. KYC, KYB, AML, transaction monitoring, and device intelligence all live behind a single API, which is genuinely valuable for crypto and iGaming operators who would otherwise be managing five separate point-solution contracts.

Pricing is usage-based with monthly minimums:

Plan	Per verification	Monthly minimum
Basic	$1.35	$149
Compliance	$1.85	$299
Enterprise	Custom	Custom

The Basic tier covers ID verification and liveness checks. Compliance adds AML screening, ongoing monitoring, and address verification. Enterprise unlocks white labeling, SSO, reusable KYC, and dedicated support.

Best For: Crypto exchanges, iGaming platforms, and fintech apps needing a full compliance stack from a single API at transparent per-verification pricing.

Avoid If: your organization has strict data sovereignty requirements needing on-premise deployment. Sumsub is cloud-only with limited published data residency options, which rules it out for a chunk of the regulated-industry buyers we talk to.

Veriff: The High-Accuracy Point Solution

Veriff sells accuracy first: 99.6% decision accuracy across 230-plus countries, with a free trial (15 days, up to 50 sessions, no credit card required) that runs on real verifications rather than sandbox data, which lets engineering teams validate performance before committing budget.

Pricing is tiered with monthly minimums:

Plan	Per verification	Monthly minimum
Essential	$0.80	$49
Plus	$1.39	$129
Premium	$1.89	$209
Enterprise	Custom	Custom

Essential uses a fully automated AI engine. Plus and Premium add hybrid verification — combining AI decisions with manual fallback to human specialists — for stronger fraud protection and higher accuracy.

Best For: Marketplaces and consumer platforms that need best-in-class document and biometric verification accuracy at scale, without necessarily bundling full AML orchestration into the same contract.

Avoid If: you need transaction monitoring and ongoing AML screening baked into the same API contract as your identity checks. Veriff's core strength is the verification layer, not full compliance orchestration, so heavier AML programs will still need a companion tool.

Head-to-Head: Compliance Coverage, Integration Depth, and Pricing Transparency

Running both vendors through our five-point weighted score (Compliance Coverage 25%, Integration Depth 25%, Pricing Transparency 20%, Market Coverage 20%, User Sentiment 10%) produces two very different profiles rather than a single winner.

Criterion	Sumsub	Veriff
Compliance Coverage (25%)	Strong: AML, KYT, business verification included	Moderate: IDV-first, AML added at higher tiers
Integration Depth (25%)	Broad SDK/API surface for multi-function onboarding	Streamlined SDK focused on verification flows
Pricing Transparency (20%)	Published per-tier rates + monthly minimums up to Enterprise	Published per-tier rates + monthly minimums, most granular below Enterprise
Market Coverage (20%)	Strong in crypto/iGaming verticals; 220+ countries, 14,000+ document types	Strong in 230+ countries, consumer platforms

Neither vendor publishes Enterprise numbers, which is standard friction across this category. We built this comparison at PrimeBiometry for IT directors, security officers, and compliance teams that need honest, structured analysis before committing to a six-figure identity stack — not a sales call as the first step.

Where Other Vendors Fit Into a Layered Fraud Prevention Platform

Neither Sumsub nor Veriff is the only piece most compliance teams end up deploying. A genuinely layered fraud prevention platform often stitches in specialists at the edges:

Regula handles forensic-grade document authentication across 254 countries, useful when Sumsub or Veriff's optical scanning needs a second, deeper check on physical security features.
Ondato is the EU-first option, priced from roughly €0.50 to €1.40 per verification (or from $10/month for smaller volumes), and fits gambling and telecom operators that need EU regulatory alignment baked in.
Oz Liveness is a liveness-only component, not a full IDV suite, so treat it as a biometric layer you bolt onto an existing stack rather than a replacement for one.
Jumio targets mid-market to enterprise buyers needing ID, biometrics, and AML in one platform, though pricing is entirely custom-quote, which is the kind of opaque procurement friction we flag consistently.
Faceki serves early-stage fintechs needing sub-30-second eKYC on usage-based pricing, though the lack of a published rate card makes it harder to model cost at scale.
Experian Identity Proofing is a fit specifically for enterprises in banking, insurance, or healthcare that already license Experian data and want unified identity plus fraud tooling.

Single-Vendor Stack or Multi-Vendor Fraud Detection Platform?

The industry's shift toward generative fraud is forcing this decision faster than most compliance roadmaps anticipated. 46 percent of surveyed businesses reported a year-over-year increase in deepfake and generative AI-driven fraud attempts, which puts pressure on whichever liveness component sits inside your architecture.

A single-vendor stack like Sumsub reduces integration overhead and gives you one contract, one support line, and one compliance audit trail. That's attractive for smaller compliance teams who don't have the headcount to manage five vendor relationships and reconcile five sets of webhooks.

A multi-vendor fraud detection platform built around a best-in-class verification layer like Veriff, supplemented by Regula for document forensics and a dedicated AML/KYT tool, gives you more control over each layer but demands more integration engineering and ongoing vendor management. At high volume, per-verification pricing on either approach scales unfavorably compared to flat-rate enterprise alternatives, so model your projected onboarding volume before signing anything.

Did You Know? 44% of North American financial institutions still primarily rely on manual processes to combat fraud, despite the volume of automated attacks they face.
Source: LexisNexis Risk Solutions True Cost of Fraud Study 2025

Which Fits Your Modern Fraud Prevention Architecture?

If your team is a crypto exchange or iGaming operator that needs KYC, AML, and transaction monitoring under one contract with predictable per-verification pricing, Sumsub is the more efficient starting point. It has the organizational maturity of a scaling company without forcing you to stitch together five separate compliance vendors.

If your priority is high-assurance onboarding accuracy across a huge geographic footprint, and you're comfortable running AML or KYT as a separate contract, Veriff's per-tier pricing and 99.6% decision accuracy make it the stronger identity verification foundation.

For ecommerce fraud prevention software buyers specifically, the calculation usually tilts toward whichever vendor's device intelligence and chargeback-relevant signals integrate fastest with your existing checkout stack, which is a question worth asking directly in a technical scoping call rather than assuming from a pricing page.

Conclusion: There Is No Single Right Modern Fraud Prevention Architecture

Sumsub and Veriff both solve real problems, but they solve different ones. Sumsub consolidates compliance functions that would otherwise require separate contracts; Veriff pushes verification accuracy and pricing transparency further than most competitors in its category.

Every assessment on PrimeBiometry is written against a documented methodology and updated when vendors change pricing or compliance coverage, because a modern fraud prevention architecture built on stale vendor claims is worse than no architecture at all. Whichever direction you go, treat the free trial as due diligence, not a formality, and verify every compliance claim against the actual certificate before it becomes a line item in your six-figure identity stack.

Frequently Asked Questions

What is a modern fraud prevention architecture?
A modern fraud prevention architecture is a layered system combining document authentication, biometric liveness detection, AML/KYT screening, transaction monitoring, and device intelligence, usually delivered through APIs rather than a single monolithic tool. It's built to reduce the false-positive rate that plagues legacy rule-based fraud management software.

Is Sumsub or Veriff better for a small fintech startup?
Sumsub's all-in-one compliance stack tends to suit fintechs that need AML and KYT alongside identity verification from day one. Veriff is a stronger fit if your priority is fast, accurate onboarding and you're comfortable sourcing AML separately. Both have monthly minimums ($149 for Sumsub Basic, $49 for Veriff Essential), so factor that into early-stage budget planning.

How much does a fraud detection platform cost per verification in 2026?
Entry-level pricing across the vendors we've reviewed ranges from roughly $0.80 (Veriff Essential, $49/mo minimum) to $1.85 (Sumsub Compliance, $299/mo minimum), with Enterprise tiers requiring a custom sales quote. Ondato's EU-focused pricing runs from about €0.50 to €1.40 per check, which is competitive for regulated European deployments. See the full breakdown on PrimeBiometry.

Do I need multiple vendors to build a complete fraud management software stack?
Not necessarily. A consolidated vendor like Sumsub can cover KYC, KYB, AML, and transaction monitoring in one contract, but organizations needing forensic-grade document checks or EU-specific compliance often layer in a specialist like Regula or Ondato.

Why are false positives such a big problem in fraud prevention tools?
Traditional rule-based transaction monitoring generates false positives on 90 to 95 percent of alerts — a benchmark that originates from PwC analysis first cited around 2017–2018 and consistently reproduced in subsequent industry research. Manual review of each alert costs an estimated $25 to $50 at mid-size financial institutions. AI/ML-assisted systems reduce that false-positive rate significantly, though actual improvements vary widely depending on data quality and institution-specific calibration, which is why architecture choice matters more than any single feature claim.

Is ecommerce fraud prevention software different from KYC/AML tooling?
Yes. Ecommerce-focused fraud prevention software emphasizes device fingerprinting, behavioral analytics, and chargeback risk scoring, while KYC/AML vendors like Sumsub and Ondato focus on identity proofing and regulatory screening; a complete architecture for online retailers usually needs both.

Is Veriff worth it in 2026 compared to enterprise incumbents like Jumio?
Veriff's published per-tier pricing and 99.6% decision accuracy make it more transparent to evaluate than Jumio, which requires a sales call for every quote. For teams that value pricing transparency during procurement, Veriff is generally the faster and less opaque option to validate.