Question 1

What does Sumsub do?

Accepted Answer

Sumsub (Summary Verification) is a comprehensive identity verification and compliance platform used by over 2,000 businesses globally to verify users, screen for AML risks, monitor transactions, and onboard corporate entities. Headquartered in London with offices across Europe and the Americas, Sumsub powers KYC (Know Your Customer), KYB (Know Your Business), AML screening, and fraud prevention through a single API and no-code workflow builder.

## What the API Does

Sumsub provides a suite of verification products accessible through a unified REST API. At the core is its document verification engine, which supports over 14,000 ID document types from more than 220 countries and territories. The platform extracts data from submitted documents using OCR, validates authenticity through tamper detection and security feature analysis, and cross-references extracted data against government databases where available.

Beyond document checks, Sumsub offers biometric face matching — comparing a selfie to the document photo — combined with active and passive liveness detection to prevent spoofing attacks using printed photos, videos, or 3D masks. The platform also includes Nigerian NIN slip recognition, voter card parsing, and international passport verification, making it well-suited for Nigerian developer compliance requirements.

## How Developers Use It

Developers integrate Sumsub via REST API or through pre-built mobile/web SDKs for iOS, Android, React Native, and Flutter. The typical integration flow involves creating an applicant (a user object in Sumsub), generating an SDK access token, and embedding the Sumsub Web SDK or Mobile SDK to collect the user's documents and selfie. The SDK handles the camera capture, liveness instructions, and document upload entirely in-browser or in-app, and fires a webhook back to your server when verification completes.

For server-side processing, key endpoints include: `POST /resources/applicants` to create an applicant, `GET /resources/applicants/{applicantId}/status` to check verification status, `GET /resources/applicants/{applicantId}/one` to retrieve full check results, and `POST /resources/applicants/{applicantId}/requiredIdDocs` to configure which document types to accept.

Sumsub Studio is the platform's no-code workflow builder where teams can design custom verification journeys — choosing which checks to run (document, biometric, AML, database, etc.) in what order, with conditional branching based on risk signals, without writing additional code.

## Pricing & Fees

Sumsub operates on a per-verification pricing model with monthly minimum commitments. For non-regulated use cases (e.g., marketplaces, gig economy), pricing starts at $149/month with a per-verification cost of approximately $1.35. For regulated entities (fintechs, banks, crypto exchanges), the minimum rises to $299/month with per-verification costs around $1.85. Enterprise plans with custom pricing are available for high-volume customers. Sumsub does not publicly list a free tier; however, a sandbox environment with test credentials is available to all registered developers at no cost.

## Authentication

Sumsub uses a dual-token authentication system. Each API request requires an App Token (passed in the `X-App-Token` header) and a request-specific HMAC SHA-256 signature (passed in the `X-App-Access-Sig` header, generated by signing the request body + timestamp using your Secret Key). This scheme prevents replay attacks and ensures requests cannot be tampered with in transit. Developers must store the Secret Key securely and never expose it client-side. The Sumsub SDK separately uses short-lived SDK Access Tokens generated server-side to authenticate end-user sessions.

## Rate Limits

Rate limits are not publicly published and vary by plan tier. Sumsub's enterprise plans are designed for high-volume throughput, and production limits are negotiated as part of the contract. Developers on standard plans should contact Sumsub support to confirm their applicable limits. The sandbox environment has its own separate limits appropriate for testing.

## Compliance & Regulations

Sumsub is ISO 27001 certified and GDPR compliant. The platform supports compliance with FATF (Financial Action Task Force) recommendations for AML screening, PEP and sanctions list checks against global watchlists including OFAC, EU, UN, and UK Treasury lists. For Nigerian businesses, Sumsub's checks are compatible with CBN KYC guidelines (customer due diligence requirements), NDPR data handling requirements, and EFCC AML obligations. For crypto businesses, the platform includes a Travel Rule module supporting compliance with the FATF Travel Rule for Virtual Asset Service Providers (VASPs), enabling originator/beneficiary data transmission for transactions above regulatory thresholds.

## Challenges & Gotchas for Nigerian Developers

1. **No native BVN lookup**: Sumsub does not directly query the NIBSS BVN database. For BVN verification, you would need to combine Sumsub with a Nigerian BVN API like Mono or Okra.
2. **HMAC signing complexity**: The request signing process is more involved than a simple API key — developers must correctly generate the HMAC SHA-256 signature on every request. Using the official SDK wrappers significantly reduces integration friction.
3. **Pricing for Nigerian scale**: At $1.35–$1.85 per verification, the cost can be significant for mass-market Nigerian apps with millions of users. Factor verification costs into your unit economics early.
4. **Data residency**: Sumsub stores verification data in EU-based infrastructure by default. For NDPR compliance, confirm your data processing agreement covers Nigerian user data appropriately.
5. **Webhook reliability**: Always verify incoming webhooks using the Sumsub signature header before trusting the payload — do not skip webhook signature validation in production.

## Company Background

Sumsub was founded in 2015 and is headquartered in London, United Kingdom. The company has raised over $30 million in funding and serves clients in banking, crypto, lending, insurance, and marketplace industries. Notable clients include Bitpanda, Mercuryo, and Rapyd. Sumsub has a dedicated compliance team and regularly updates its watchlist databases and ID document templates.

## Frequently Asked Questions

**Q: Can I use Sumsub without a business registration in Nigeria?**
A: You can sign up and start testing in sandbox mode without a Nigerian business registration. Going live and enabling billing requires a valid business entity and may require compliance documentation.

**Q: Does Sumsub support NGN billing?**
A: Sumsub bills in USD. Nigerian businesses will need to pay via USD card, wire transfer, or through a payment provider that supports USD billing.

**Q: How long does a verification take?**
A: Automated decisions are returned in under 60 seconds in most cases. Manual review (for edge cases flagged by the system) typically takes a few hours.

**Q: Is there a free trial?**
A: Sumsub provides a full-featured sandbox environment for testing. A paid subscription is required to go live and run real verifications.

Question 2

How much does Sumsub cost?

Accepted Answer

Sumsub is a paid API. Starts at $149/month (non-regulated) or $299/month (regulated). Per-verification: $1.35 (non-regulated) or $1.85 (regulated). Custom enterprise pricing available for high volume.

Question 3

How do I authenticate with the Sumsub API?

Accepted Answer

App Token + Secret Key (HMAC SHA-256 signed requests via X-App-Token and X-App-Access-Sig headers)

Question 4

Is there a rate limit on Sumsub?

Accepted Answer

Varies by plan; enterprise plans support high-volume throughput. Contact Sumsub for specifics.

Question 5

Does Sumsub offer a sandbox or test mode?

Accepted Answer

Yes — Sumsub provides a sandbox or test environment so you can integrate and test before going live.

Question 6

What is Sumsub best suited for?

Accepted Answer

Nigerian fintech startups, neobanks, crypto exchanges, and lending platforms that need enterprise-grade KYC, KYB, and AML screening with global document coverage including Nigerian NIN, BVN, and CAC verification.

Question 7

Is there anything else I should know before integrating Sumsub?

Accepted Answer

Sumsub covers 220+ countries and 14,000+ ID document types including Nigerian NIN slips, voter cards, and international passports. HMAC SHA-256 request signing is mandatory — all API requests must include a valid X-App-Access-Sig header. Sandbox environment is available for full integration testing before going live.

Question 8

Where can I find Sumsub's documentation?

Accepted Answer

The official API documentation is at https://docs.sumsub.com. The provider's website is https://sumsub.com.

Question 9

Does Sumsub support Nigerian developers?

Accepted Answer

Yes — Sumsub explicitly supports Nigerian developers/use cases.

Sumsub

Features Included

Not Supported

Key Highlights

Required Access Documents

Use Cases

Ask question or give feedback

Sign in to participate

Discover similar API's

Ask question or give feedback

Sign in to participate