Shufti Pro Review
7.1/10UK-registered identity verification vendor (Companies House 11039567, founded 2017) selling document, biometric, and AML checks on a published pay-as-you-go price of $0.75 per verification on the Standard pack, holding a Pennsylvania PGCB Certified gaming registration and an iBETA Presentation Attack Detection Level 3 result with 0% error, with a named WhiteHat Gaming compliance testimonial and Penn National on its gaming page.
Our read
Broad spread on one API: document, biometric, fully passive single-selfie liveness, age estimation, NFC, electronic IDV, AML against 4,000+ watchlists, address, behavioral, device, transaction monitoring, and self-exclusion register integration plus 1:N multi-accounting, with 240+ countries and under 30 seconds vendor-stated.
Pennsylvania PGCB Certified (Shufti Pro Limited, exp 01/18/2027, the higher class most bigger names lack) plus a gold-class dated cert, iBETA PAD Level 3 (Lab Code 200962, 0% APCER and BPCER on both iOS and Android, 900 attacks, testing Mar 27 to Apr 24 2026), first European company on both, while ISO 27001 and SOC 2 lead with iBETA rather than a published cert and grade claimed.
API-first with versioned native iOS and Android SDKs, a 7-day free trial, and self-serve signup, low-friction for the tier, with a DevCode Identity orchestration edge, but not an orchestration-canvas story at the GBG GO or Signicat level, so breadth and price rather than a journey builder.
Gaming-native and better-evidenced than the thin group: WhiteHat Gaming with a named compliance-officer testimonial plus Penn National on the page at list level, on the deepest self-exclusion and responsible-gaming map in the set (UKGC Licence Condition 17, MGA, KSA, GluStV), with Penn evidence pending operator corroboration.
Clean record with no incident, no enforcement, transparent UK ownership, and one $20M Updata round, set against a dated accuracy complaint pattern (G2 and Capterra 2026: false accepts on damaged documents, over-rigid passport country-match rules) that sits in tension with the 0% liveness marketing, plus a real 140 to 180-person scale and concentration risk and no audited financials.
Published pay-as-you-go: $0.75 per verification on the Standard pack (category-low, undercuts the enterprise field) and $1.20 on Starter, no resubmission charge, and a 7-day trial, with the one friction a $2,500 setup fee.
Methodology. Our own score, a weighted average of six dimensions, tilted toward verification coverage and compliance. Scored on the identity-verification weighting, which leans hardest on verification coverage (0.22) and compliance and certifications (0.20), a fit for a vendor whose iBETA Level 3 liveness and PA-Certified register carry the case while its published price offsets a small-scale trust profile. Read the full methodology
- Published, genuinely low pricing: $0.75 per verification on the Standard pack undercuts the enterprise field, billed pay-as-you-go with no resubmission charge and a 7-day free trial (vendor pricing page, Jul 2026).
- iBETA Presentation Attack Detection Level 3 at 0% APCER and 0% BPCER over 900 attacks, claimed as the first European company to reach Level 3 on both iOS and Android (iBeta Lab Code 200962, May 2026), a gold-class independent liveness result.
- Pennsylvania PGCB Certified gaming registration (Shufti Pro Limited, exp 01/18/2027), the higher US-state class that Trulioo, Persona, Sumsub, Signicat, and IDnow do not hold.
- Gaming-native compliance: self-exclusion integration for GamStop, Spelpaus, Cruks, and OASIS, 1:N face verification for multi-accounting, and a page mapped to UKGC Licence Condition 17, MGA, and the EU regimes.
- Broad check spread on one API: document, biometric, passive liveness, age estimation, NFC, electronic IDV, AML against 4,000+ watchlists, address, behavioral, and device, with native iOS and Android SDKs and a clean incident record.
- Small scale: roughly 140 to 180 staff, one $20M funding round, and no audited financials, a real size and concentration risk against GBG, Socure, and Sumsub for a large regulated-gaming operator.
- A dated accuracy complaint pattern on marketplace reviews (G2 and Capterra 4.3, 2026): false accepts on damaged documents and deepfakes reported by buyers, plus over-rigid passport country-match rules that reject valid users when residence and issuing country differ, sitting in tension with the zero-error liveness marketing.
- A $2,500 one-time setup fee is the friction line in an otherwise low, transparent price.
- Penn National is named only at list level, with no operator quote to corroborate it, so the headline gaming reference is thinner than the client wall reads.
Cost-sensitive and mid-market operators, and platforms or aggregators reselling KYC, that want published pricing, strong passive liveness, and deep UK and EU self-exclusion coverage without enterprise minimums.
The largest US operators that need a big-balance-sheet, audited vendor with a broad named tier-one roster, or buyers who weight the edge-case accuracy complaints heavily.
Markets & licensing
Shufti's compliance trail is its strongest card, and both anchors are checkable. The Pennsylvania PGCB lists Shufti Pro Limited as a Certified gaming service provider for identity and document verification, expiring January 18 2027, which is the higher of the two PA classes and one that Trulioo, Persona, Incode, Signicat, Sumsub, and IDnow do not hold. The second anchor is an iBETA Presentation Attack Detection Level 3 result, issued by iBeta Quality Assurance (NVLAP Lab Code 200962), showing 0% APCER and 0% BPCER across 900 presentation attacks on both a Google Pixel 4 and an iPhone 12 Pro, with Shufti claiming the first European company to reach Level 3 on both operating systems. ISO 27001 and SOC 2 are asserted but the site leads with iBETA rather than a published certificate, so we grade those claimed until one surfaces. Verification stands at verified on the strength of the PA register pull and the iBeta lab report.
The Pennsylvania PGCB Certified registration is the fact that put Shufti on this roster: a small European vendor holding the higher US-state gaming class while several larger names sit at Registered or nowhere. It expires January 18 2027 and sits on the Certified provider list as of March 2026. Beyond Pennsylvania there is no broad US state-by-state gaming footprint yet, so treat this as one strong anchor rather than national coverage.
Shufti Pro Limited is a UK company (Companies House 11039567) based at One Canada Square, and the European domicile underpins both its self-exclusion coverage and its first-European iBETA claim. The gaming page maps directly to UKGC Licence Condition 17 and integrates GamStop, so a UK operator gets a vendor that already speaks the regime. There is no DIATF certification on record, which is the gap against Sumsub, Veriff, and the DIATF-anchored peers.
- Pennsylvania PGCB registrationPennsylvania, United States
- Certified gaming service provider for identity and document verification checks (KYC), the higher of the two PA classes · Shufti Pro Limited, DBA Shufti Pro · exp 01/18/2027 · on the Certified list as of Mar 25 2026
- iBETA PAD Level 3ISO/IEC 30107-3 conformance
- Presentation Attack Detection Level 3 for fully passive single-selfie liveness, 0% APCER and 0% BPCER over 900 attacks across silicone, urethane, and resin masks on iOS and Android · iBeta Quality Assurance, NVLAP Lab Code 200962 · testing Mar 27 to Apr 24 2026 · announced May 7 2026
- Companies House registrationUnited Kingdom
- Shufti Pro Limited, the legal entity holding contracts and the PA gaming registration · Companies House 11039567 · One Canada Square, Canary Wharf, London E14 5AA
Licensing tier: One strong US-state gaming register plus a gold-class independent liveness certificate, without the DIATF leg the top of the segment carries. The Certified class and the iBeta lab report are both checkable, which is why this grades verified and not partial.
The product runs wherever an operator integrates it, with the named regulatory anchors in Pennsylvania gaming and the UK and EU self-exclusion regimes (Jul 2026).
No restricted-market list is published (Jul 2026).
Platform & capabilities
The feature set: what's built in. Capabilities light up when present. Anything not shown isn't offered or isn't disclosed.
Integrations & engineering
One contract and one API instead of a separate deal per studio, feed, or PSP. Here's what connects, how fast, and on what stack.
Integration runs through one REST API with native iOS and Android SDKs, the same builds iBeta certified (Android 1.9.8, iOS 1.3.42). An operator can start on a 7-day free trial with self-serve signup, then move to pay-as-you-go billing with no resubmission charge. Document, biometric, passive liveness, age estimation, NFC, electronic IDV, and AML screening all sit behind the same connection, and self-exclusion register checks against GamStop, Spelpaus, Cruks, and OASIS run in the gaming flow. The delivery pitch is breadth of checks plus a low published price, not a no-code orchestration canvas.
No formal integration-time claim for gaming (Jul 2026). The self-serve trial and versioned SDKs make an early sandbox test possible before a sales call, so the real calendar comes out of your own build.
Products & tools
One API covers the whole onboarding check: document verification, biometric face match with fully passive single-selfie liveness, age estimation, NFC e-passport reads, electronic IDV, AML screening against 4,000+ watchlists, and self-exclusion register checks against GamStop, Spelpaus, Cruks, and OASIS.
Identity Verification Suite
The core onboarding flow: document authentication with tamper forensics, biometric face match, fully passive single-selfie liveness, age estimation, and NFC reads for e-passports, all callable from one API and native iOS and Android SDKs.
- Fully passive liveness tested at 0% APCER and 0% BPCER by iBeta (Level 3, testing window Mar 27 to Apr 24 2026)
- Age verification with age estimation for the 18-plus gate
- NFC verification for chip e-passports
- 240+ countries actively processed (vendor-stated, Jul 2026)
- Native iOS SDK 1.3.42 and Android SDK 1.9.8, the versions iBeta certified
AML Screening & Ongoing Monitoring
Sanctions, PEP, and adverse-media screening against 4,000+ watchlists with ongoing monitoring, run alongside the identity check inside the same onboarding call.
- 4,000+ watchlists screened (vendor-stated, Jul 2026)
- Ongoing monitoring for changes after onboarding
- Runs in the same flow as document and biometric checks
- Address verification and consent verification available in the suite
- Behavioral biometrics, device fingerprinting, and transaction monitoring on the platform
Gaming Compliance & Self-Exclusion
The gaming-specific layer: self-exclusion register checks against GamStop, Spelpaus, Cruks, and OASIS, plus 1:N face verification for multi-accounting detection, mapped to the named gambling regimes on the vendor's own gaming page.
- Self-exclusion register integration for GamStop, Spelpaus, Cruks, and OASIS
- 1:N face verification to catch duplicate and multi-account sign-ups
- Mapped to UKGC Licence Condition 17, MGA, Dutch KSA, Sweden Spelpaus, and Germany GluStV plus OASIS
- FATF Recommendation 22 and EU Digital Services Act framing on the gaming page
- Named on the gaming page with a WhiteHat Gaming compliance testimonial and Penn National
API, SDKs & Free Trial
An API-first platform with versioned native mobile SDKs, a 7-day free trial, and self-serve signup, unusually low-friction for a compliance vendor and the delivery side of the published-price posture.
- REST API with native iOS and Android SDKs
- 7-day free trial with self-serve signup
- Pay-as-you-go billing, upgrade or downgrade anytime
- No charge for resubmission sessions, billed only for successful verifications
- DevCode Identity named as an orchestration partner on the gaming page
On the record
The history that matters: the milestones, the scale, the awards, and who runs it.
Shahid Hanif and Victor Fredung founded Shufti Pro in 2017, building an API-first identity verification platform out of the UK with an engineering presence in Pakistan. Company registries and the Forbes Business Council list Victor Fredung as CEO and Shahid Hanif as co-founder and CTO, which is the reading we follow, though the 2026 iBETA press release quotes Hanif as CEO, so either he moved into the seat or the release mislabeled him. The company raised a single disclosed institutional round, a US$20M Series A from Updata Partners, and otherwise stayed founder-led and private with no M&A in or out. By mid-2026 it employs roughly 140 to 180 people per third-party estimates, which makes it a small vendor next to GBG at about 1,300, Socure, and Sumsub. The gaming vertical is deliberate rather than incidental: the product maps to UK and EU self-exclusion regimes and carries a Pennsylvania Certified gaming registration, and the 2026 iBETA Level 3 result is the milestone the company has led its marketing with.
Brands & clients on the platform
Corporate
Leadership
Milestones
- 2017
Shahid Hanif and Victor Fredung found Shufti Pro as a UK-registered identity verification vendor (Companies House 11039567).
- 2021-2023
Raises a US$20M Series A from Updata Partners, the only disclosed institutional round, and builds out the gaming vertical with self-exclusion register integration.
- 2026
Listed as a Certified gaming service provider on the Pennsylvania PGCB list (exp Jan 18 2027), the higher US-state class.
- 2026
iBeta certifies the passive single-selfie liveness at PAD Level 3 with 0% APCER and 0% BPCER over 900 attacks (Lab Code 200962, testing Mar 27 to Apr 24), announced May 7, claimed first European company on both iOS and Android.
Where they're pushing next
- US state gaming beyond Pennsylvania as further registrations are pursued
- UK and EU operators bound by UKGC and EU self-exclusion regimes
- Platforms and aggregators reselling KYC on the published pay-as-you-go price
Trust signals
The checks an operator runs before signing: incidents, enforcement, ownership, and longevity, from our research.
Shufti Pro vs alternatives
The same attributes, side by side, from our normalized provider set, useful for seeing where this vendor fits against its peers.
| Attribute | Shufti Pro | iDenfy | Sumsub |
|---|---|---|---|
| Founded | 2017 | 2017 | 2015 |
| Team | 177+ | 55+ | 500+ |
| US market | Available | — | — |
| Pricing | Public | Public | Public |
| Country coverage | 240+ countries | Document verification for ID… | Document-free verification in… |
| UK DIATF | None | Not certified | Certified IDSP |
The take: iDenfy is the closest rival, the other value player publishing a full per-check schedule, but it holds no DIATF and no US gaming register, where Shufti carries a PA-Certified registration and an iBETA Level 3 liveness result. Sumsub publishes pricing too but sits pricier and bigger with a far deeper certification stack. Pick Shufti when a published low price, strong passive liveness, and deep UK and EU self-exclusion coverage outweigh scale and a dated edge-case accuracy pattern.
Pricing & terms
Shufti Pro publishes pricing. Ranges are below, and final terms are quoted per project.
Pay-as-you-go per verification: $1.20 on the Starter pack and $0.75 on the Standard pack, each with a one-time $2,500 setup fee, no long-term commitment, and no charge for resubmission sessions (vendor pricing page, Jul 2026)
Turnkey
White-label
Support & account management
The service layer operators inherit: availability, the channels support runs on, and language coverage.
Frequently asked
The things operators actually ask before signing.
How much does Shufti Pro actually cost?+
Shufti publishes its pricing, which is rare in this segment. The pricing page (Jul 2026) lists a Starter pack at $1.20 per verification and a Standard pack at $0.75 per verification, each with a one-time $2,500 setup fee. Billing is pay-as-you-go with no long-term commitment, no charge for resubmission sessions, and a 7-day free trial, so an operator can model cost and test before a sales call. The $0.75 Standard rate undercuts the enterprise field and is the reason Shufti sits in the value tier.
Are there accuracy problems buyers report?+
Yes, and it is worth stating plainly. Shufti markets a 0% iBETA liveness error rate and high accuracy, but B2B marketplace reviews (G2 and Capterra at 4.3, 2026) show a small but consistent complaint pattern: false accepts on damaged documents and deepfakes passing undetected, and over-rigid passport country-match rules that reject valid users when country of residence differs from the passport's country of issue even when nationality is captured correctly. This is a real edge-case handling limitation rather than a scandal, so test on your own reject population before committing.
How strong is the liveness and anti-spoofing?+
This is the strong card. iBeta Quality Assurance (NVLAP Lab Code 200962) certified Shufti's fully passive single-selfie liveness at Presentation Attack Detection Level 3, with 0% APCER and 0% BPCER across 900 presentation attacks (450 per device, three mask types in silicone, urethane, and resin) on both a Google Pixel 4 and an iPhone 12 Pro. Testing ran March 27 to April 24 2026 and was announced May 7. Shufti claims to be the first European company to reach Level 3 on both operating systems for passive single-selfie liveness, a small club.
Which gambling operators use it, and is it registered in the US?+
The named gaming references are WhiteHat Gaming, which carries a quoted Director of Compliance and is the strong reference, and Penn National Gaming, which appears at list level on the gaming page with no operator quote. On the US register side, the Pennsylvania PGCB lists Shufti Pro Limited as a Certified gaming service provider for identity and document verification, expiring January 18 2027, the higher of the two Pennsylvania classes and one several larger IDV names do not hold. There is no broad US state-by-state gaming footprint beyond Pennsylvania yet.