Sumsub

Sumsub: frequently asked questions

How much does Sumsub cost?

Sumsub publishes a real rate card (checked 5 November 2026). Basic is 1.35 dollars per verification with a 149 dollar monthly minimum, covering ID verification, liveness and face match, reusable KYC, email and phone verification and Travel Rule. Compliance is 1.85 dollars per verification with a 299 dollar minimum, adding AML screening, ongoing AML monitoring and address verification. Custom is quote-only and adds KYB, database validation, transaction monitoring and fraud prevention. Checks beyond the minimum bill pro rata, only successful verifications count, and a 14-day trial includes 50 free checks. Per-country rates are not published.

How accurate is Sumsub's liveness detection?

It holds two dated third-party results. iBeta, an NVLAP-accredited lab, tested Sumsub Liveness at ISO/IEC 30107-3 Level 3, the highest of its three levels, from 20 August to 17 September 2026 on a Samsung Galaxy S24 Ultra (Android 16) and iPhone 13 (iOS 16.6); its 17 September 2026 letter reports zero successful attacks across 900, an APCER of 0 percent. A March 2025 Level 2 test likewise recorded 0 of 1,500 attacks. The bona fide rejection rate (BPCER) sits in the non-public report, so no BPCER figure should be quoted. We found no Sumsub entry in NIST face benchmarks.

Who owns Sumsub and where is it based?

The operating entity is Sum and Substance Ltd, incorporated in England and Wales on 16 July 2015, company number 09688671, registered at 30 St Mary Axe, London. The group parent is Raritex Trade Ltd, incorporated in Cyprus, confirmed both by Sumsub's own April 2026 corporate statement and independently by its iBeta test letter. The persons with significant control on the UK register are the three Sever brothers, Andrey, Yakov and Peter Severyukhin, all Israeli nationals resident in Cyprus. Sumsub's early customer base was concentrated in Russia and the CIS; the company states it ceased Russian operations in 2022, sold its former Russian subsidiary that year, relocated affected staff to Germany, the UK and Cyprus, and stores end-user data primarily on AWS in Frankfurt with no Russia-based processors. Regulated buyers who need to document this should work from the Companies House register rather than secondary reporting.

Has Sumsub been breached?

Yes, and Sumsub disclosed it on 4 February 2026. An external attacker submitted a malicious attachment through a third-party support ticketing platform, initially compromising a support-related internal environment in July 2024. The intrusion was not discovered until January 2026, roughly 18 months later, which is the most significant detail. Sumsub states live verification workflows, customer-facing APIs and core production systems were unaffected, and that biometric data, identity document images, banking details and government ID information were not compromised. Exposed data was names for a limited number of customer accounts, with email addresses or phone numbers for a smaller subset. No affected-record count was published and the statement does not mention regulator notification. Separately, in March 2025 Sumsub stated that an API misconfiguration by a third-party integrator, not Sumsub itself, exposed Sumsub-issued API tokens.

What compliance certifications does Sumsub hold?

SOC 2 Type II, attested by BARR Advisory and first announced in November 2022, plus SOC 1 Type 1. ISO/IEC 27001, 27017 and 27018, ISO 22301:2019, ISO 31000:2018 and ISO 9001:2015. PCI DSS with an attestation of compliance. It is a certified Identity Service Provider under the UK Digital Identity and Attributes Trust Framework, able to serve medium and high confidence levels including Right to Work and Right to Rent, with the standard IDSP limitation that those checks may only be performed for UK and Irish citizens. ETSI EN 319 and 119 standards are listed in an eIDAS context, but we did not confirm qualified trust service provider status on an EU trusted list. Individual certificates sit behind a gated trust centre.

How many documents and countries does Sumsub cover?

More than 14,000 ID and address document types across 220 or more countries and territories, per its documentation as revised in September 2026. Worth noting for currency: that 14,000 figure was first announced in July 2023 and has not changed since, so it reflects a 2023 expansion rather than recent growth. NFC chip reading is supported, with a dedicated documentation page, though no exact NFC document or country count is published.

What does Sumsub cover beyond identity verification?

More than most IDV vendors. AML screening and ongoing monitoring, proof-of-address verification, KYB business verification, transaction monitoring and fraud prevention are all in the product, alongside a reusable identity product called Sumsub ID and a case management system. Its Travel Rule product is substantial for crypto businesses, listing more than 1,050 VASPs in its client directory, support for over 5,000 assets, transfers below the FATF Recommendation 16 threshold, and unhosted wallet verification. Those figures are vendor-published and not independently audited.

What are the best Sumsub alternatives?

Persona for orchestration-style workflows and a published entry price, though with weaker independent biometric evidence. Entrust IDV, formerly Onfido, for a more established enterprise procurement footprint. Jumio for large regulated deployments. Veriff where a dated iBeta Level 2 result matters and you want a European alternative. Alloy if what you actually need is an orchestration layer over multiple data vendors rather than verification itself. Sumsub's distinguishing arguments remain the published rate card, the September 2026 iBeta PAD Level 3 result, and unusually broad AML and Travel Rule coverage in one product.